Indirect Access License Optimization for On-Premise SAP
Indirect access to SAP – when external systems or users use SAP without direct logins – presents a costly licensing challenge for CIOs and CTOs. SAP offers two paths: Traditional named user licenses or the newer Digital Access (document-based) licensing.
This article explains how each model works and guides you in choosing the optimal approach to minimize cost and compliance risk.
The Indirect Access Dilemma
Every interaction with an SAP system requires a license, even if users never log in directly to the system. This is the core of the indirect access dilemma. High-profile cases (like the SAP vs. Diageo lawsuit) highlighted how indirect use can trigger massive unplanned fees.
CIOs face a choice: continue licensing indirect use through named user accounts (the legacy approach) or adopt SAP’s Digital Access model, which charges by the number of documents created.
Each option has cost implications and compliance risks, especially in on-premise SAP environments where indirect integrations are common.
Key Challenge:
Indirect access often involves third-party portals, IoT devices, or partner systems connecting to SAP. Traditional licensing struggled to accommodate these scenarios, leading to either over-licensing (purchasing too many user licenses as a precaution) or under-licensing (risking audit penalties).
The introduction of Digital Access is SAP’s answer to this challenge, but it’s not automatically the cheaper or easier choice in every situation.
Traditional Named User Licensing for Indirect Access
In the traditional SAP model, Named User licenses are the primary way to cover usage:
- Named Users: Each individual (employee, partner, or even customer) accessing SAP – directly or indirectly – needs an appropriate named user license. Types range from Professional users (full access, highest cost) to Limited or Employee Self-Service users (restricted access, lower cost).
- Indirect Use via Named Users: Historically, if an external system accessed SAP data, SAP’s stance was that all end-users behind that system needed to be licensed. For example, if 500 customers place orders through a non-SAP web portal that interfaces with SAP, the strict interpretation would require the purchase of 500 named user licenses.
- Order Engine Licenses: SAP offered special engine licenses (like Sales and Purchase Order Processing licenses) as an alternative to licensing each external user. These allowed a fixed number of documents (e.g., sales orders) to be processed for a fee. However, SAP has phased out many of these legacy engines from price lists, pushing customers toward new models.
Pros of Traditional Approach:
- Familiar and established model – most organizations already manage named users.
- Predictable costs when user counts are stable. For example, if you have 100 employees on SAP, you can budget for 100 user licenses (often ~$3,000 each for a Professional user, plus annual support ~22%).
- Straightforward user compliance – each user is tied to a license, which is easy to understand administratively.
Cons of Traditional Approach:
- Indirect access complexity: Counting and identifying indirect users is a challenging task. You may not even be aware of how many external users or devices are interacting with SAP via interfaces, making compliance a game of guesswork.
- Over-licensing risk: Companies often over-buy licenses “just in case” for indirect use, leading to shelfware and wasted budget. For instance, purchasing 500 extra licenses for that customer portal could cost hundreds of thousands of dollars one-time (plus 20% per year in maintenance) – potentially far more than actual usage justifies.
- Audit exposure: If you undercount and an SAP audit finds unlicensed indirect usage, the financial penalties can be extreme. This threat often pressures companies into conservative (over-licensing) behavior.
SAP’s Digital Access Licensing Model
SAP introduced Digital Access in 2018 as a new method for licensing indirect use. Instead of tying licenses to users, it ties them to digital documents created or processed in SAP by indirect access.
Document-Based Approach:
Under Digital Access, you purchase entitlements for a certain number of SAP documents per year. SAP defined nine core document types that count, covering common business objects:
- Sales Order documents (line items)
- Purchase Order documents
- Invoice documents
- Service & Maintenance documents
- Manufacturing documents
- Material documents (goods movements)
- Quality management documents
- Financial documents (journal entries)
- Time management documents
Each document type has a weighting factor (most are weighted at 1.0; financial and material documents have a weighting of 0.2 to reflect their typically high volume).
You count each document created via third-party or automated processes. For example, one sales order equals one document, but one financial posting equals 0.2 (so five financial postings count as one document for licensing purposes).
How It’s Licensed:
Digital Access is sold in blocks, typically 1,000 documents per block per year. Pricing is usage-based with volume discounts:
- List Price: SAP’s price list may quote, for instance, around $20,000 per 1,000-document block (this amount can vary and is often subject to negotiation).
- Discount Programs: SAP’s Digital Access Adoption Program (DAAP) has offered steep discounts (up to 90% off the list price) to encourage customers to switch. With a 90% discount, the same 1,000-document block effectively costs approximately $2,000. DAAP also allows you to convert certain existing user licenses into credits that can be applied toward document licenses.
- Example: If your integrations create 10,000 qualifying documents a year, you’d need 10 blocks. At the list price, that could be approximately $200,000 annually, but with DAAP, it might drop to approximately $20,000. By contrast, licensing 500 external users via named-user licenses could easily exceed $500,000 upfront (plus yearly maintenance). This illustrates how Digital Access can be financially attractive in high-volume scenarios.
Important:
Adopting Digital Access does not eliminate named users entirely. Human users still need named user licenses for direct SAP login. Digital Access covers only the indirect usage (system-to-system, automated, or external user interactions).
If a single person logs in to SAP and also triggers documents via an external app, you need to license both their user access and their document generation. In other words:
- Direct SAP use = Named User license.
- Indirect SAP use = counted via Digital Access documents.
This double coverage can surprise customers. Switching to Digital Access is mainly beneficial for new external interactions or large volumes of transactions, rather than replacing internal user licenses.
Cost and Compliance Comparison
Choosing between the two models requires analyzing both cost structure and compliance effort.
Below is a high-level comparison:
| Factor | Traditional Named Users | Digital Access (Documents) |
|---|---|---|
| Basis of License | Per individual user (named account). | Per document created via indirect access. |
| Typical Cost Structure | One-time per user (e.g. $1k–$5k each) plus 22% annual support. Volume discounts on large user counts. | Recurring per document block (e.g. list ~$20k per 1k docs/year, with tiered discounts). Actual cost can vary based on negotiated discount (e.g. 90% off under DAAP). |
| Scaling Behavior | Costs grow linearly with number of users, even if some use SAP very little. | Costs grow with transaction volume; idle users incur no cost, but high document throughput increases cost. |
| Compliance Management | Must track every user and their license type. Risk of unnoticed users (especially indirect). Requires periodic user audits and cleanup. | Must measure document counts from all integrations. Requires tools (SAP Passport or audit reports) to estimate document usage. Risk of volume overrun if transactions spike. |
| Predictability | Easier to predict if user count is stable. Surprise costs if new groups need access. | Aligns cost to actual usage; can spike if business grows or new interfaces add volume. Requires volume forecasting in budgets. |
| Audit Risk | Indirect use audits can uncover “hidden” users, leading to large back-charges. Over-provisioning licenses to avoid this is common but costly. | Audits focus on document counts, which are more transparent if measured. Reduces gray areas about “who is using data,” but still requires accurate counting of documents. |
| Typical Use Cases | Suited for scenarios with a known, limited user base accessing SAP (e.g., internal employees, a fixed number of partners). Less ideal for unpredictable external usage. | Suited for integration-heavy environments (IoT sensors, third-party platforms, customer portals) where potentially thousands of transactions occur without direct logins. Ideal when user count is large or unknown, but documents can be counted. |
As shown, traditional licensing gives more certainty when user numbers are small and stable.
In contrast, Digital Access shines in high-volume, integration-rich scenarios by aligning costs to actual system activity.
Choosing the Right Approach for Your Scenario
The optimal licensing approach depends on your organization’s specific usage patterns:
- Low Indirect Usage Scenario: If indirect interactions are minimal or easily tied to known individuals (e.g., a small B2B interface used by 10 partner users), extending named user licenses may be the simplest approach. The cost for 10 additional named users (approximately $30,000 total, plus maintenance) might be less than implementing Digital Access. Additionally, if your third-party integrations generate a low volume of documents (low transaction volume), the administrative overhead of Digital Access may not be worthwhile.
- High-Volume External Transactions: If you have hundreds or thousands of external users or devices driving transactions (such as customers placing orders or IoT devices posting data), the named user model becomes impractical and expensive. For example, an e-commerce scenario with 500 customers and 10,000 orders per year would be cost-prohibitive to cover with individual user licenses. Digital Access, in this case, offers a clear financial advantage and simpler licensing of that activity.
- Complex Integration Landscape: Organizations with numerous third-party applications (e.g., CRM, HR, supply chain systems) that all integrate with SAP should strongly consider Digital Access. It provides a uniform, scalable metric (documents) instead of trying to allocate named users to each integration point. It also avoids the ambiguity of “multiplexing” (one technical user proxying many real users), as only documents are counted.
- Mixed Approach: It’s possible to maintain a hybrid model – continuing with named users for employees and known users, while adopting Digital Access for truly indirect access, such as consumer-facing apps or IoT. However, be cautious: once you license a scenario via Digital Access, you should not double-count it with named users. Work with SAP to define clear boundaries so you’re not paying twice. Many companies transitioning to Digital Access use SAP’s adoption program to replace unneeded named user licenses with document licenses.
Real-World Example: A manufacturing company had 300 warehouse scanners updating SAP (IoT devices creating inventory movements). Under traditional licensing, they would have needed hundreds of “Worker” user licenses, costing an estimated $ 300,000 or more.
Instead, they evaluated the document count – if those scanners create 50,000 material documents annually, they could license that via 50 Digital Access blocks.
With negotiated discounts, the annual cost came to around $50,000, dramatically reducing spend while ensuring compliance.
Optimization and Negotiation Strategies
Optimizing SAP license costs requires both measurement and negotiation:
- Audit Your Usage: Before making any decision, perform an internal audit of indirect usage. Map out all interfaces to SAP, and use SAP’s estimation tools or scripts to gauge document volumes. If tools are not installed, work with SAP or a licensing partner on an indirect usage assessment. Having data on how many documents are generated and by which systems is crucial.
- Model the Costs: Calculate side-by-side scenarios. What would it cost to cover all indirect usage with named users? What would it cost under Digital Access (considering a realistic discount)? This modeling should include not just license fees but also ongoing support costs.
- Leverage the DAAP: If you decide Digital Access makes sense, use SAP’s Digital Access Adoption Program if it’s still available. SAP has offered at least 90% off and flexible conversion options:
- Trade in existing licenses (e.g., excess named users or old order engine licenses) for credit towards document licenses.
- Choose a purchase option that fits your needs – for instance, licensing 115% of your measured documents to get extra buffer (with a volume discount), or simply buying 100% of your needs with the flat 90% off. These program options were designed to mitigate the cost impact for customers switching models.
- Negotiate Contract Terms: Everything is negotiable in enterprise agreements. If you’re adopting Digital Access, negotiate protections such as:
- Price caps or volume bands: Ensure that if your document usage grows, the pricing per block doesn’t suddenly spike. Negotiate tiered pricing upfront for higher volumes.
- Audit clause clarity: Clarify how document counts will be verified and allow for an independent review in the event of a dispute. This prevents surprises.
- Fallback rights: In some cases, clients negotiated the right to revert to named user licensing for certain uses if Digital Access proved too costly later (though SAP’s stance on this varies).
- Monitor Continuously: Regardless of the model you choose, treat license management as an ongoing process. With named users, regularly remove inactive users and adjust license types (to avoid overspending on high-level licenses for low-use employees). With Digital Access, monitor your document consumption quarterly – if volumes trend higher than anticipated, you may need to true-up licenses to avoid compliance issues.
By combining diligent measurement with savvy negotiation, enterprises can significantly reduce their SAP indirect access costs. It’s not just about picking the right model – it’s about getting the right deal for that model.
Recommendations
- Assess Indirect Usage Patterns: Inventory all third-party systems, APIs, and interfaces that interact with your SAP environment. Quantify how many users or transactions originate outside SAP.
- Calculate Dual Scenario Costs: For each major integration, estimate costs under both models (named user vs. document-based). Include initial license fees and annual support in your comparison.
- Engage SAP Early: If you suspect Digital Access could benefit you, open a dialogue with SAP. Early engagement may unlock incentive programs (such as DAAP) or special terms, rather than waiting for an audit.
- Leverage Competitive Bids: Work with SAP licensing experts or third-party advisors to benchmark pricing. Use competitive insights during negotiations – SAP may be more willing to improve terms if they know you are well-informed.
- Optimize Named User Licensing: If sticking with traditional licensing, ensure you have the right mix of user license types. Remove duplicate or inactive accounts and downgrade high-cost licenses that aren’t fully utilized.
- Pilot the Measurement Tools: Consider implementing SAP’s Passport or using the Indirect Use estimation reports on a trial basis. Even if not perfect, they give ballpark figures to inform your decision.
- Plan for Growth: Regardless of the model, build a buffer for growth. If you anticipate additional interfaces or business expansion, consider negotiating for extra capacity (such as extra users or document blocks) at locked-in rates to avoid future surprises.
- Document Everything: Maintain clear documentation of your licensing assumptions. If you use Digital Access, keep records of how you calculated document counts. If you use named users for external access, document those users or technical accounts. This helps justify your position in any compliance discussion.
FAQ
Q1: What exactly counts as indirect access in SAP?
A: Indirect access is any use of SAP data or functions without a direct SAP login. For example, a Salesforce CRM pulling customer data from SAP, or a mobile app updating SAP records. If an external system or person triggers SAP to create, view, or change data, that constitutes indirect use and requires proper licensing.
Q2: Is Digital Access licensing mandatory for SAP S/4HANA?
A: No, it’s not mandatory. SAP strongly encourages it for S/4HANA on-premise, but you can remain on traditional licensing if it suits you better. However, new SAP contracts often include language about digital access, so it’s wise to evaluate it during S/4HANA migrations.
Q3: Can we mix named user and Digital Access licenses?
A: Yes. You will likely have a mix of internal users covered by named user licenses and indirect integrations covered by Digital Access. What you can’t do is double-count the same usage in both models. You must decide for each indirect scenario which model covers it. Many companies transitioning to a hybrid approach use a combination of methods: retaining named user licenses for direct use and selected partner users, while utilizing Digital Access for high-volume interfaces or unknown user populations.
Q4: How do I determine the number of Digital Access documents I need?
A: SAP provides tools, such as the Digital Access Estimation Tool and SAP Passport functionality, to identify documents created indirectly. You can also analyze logs or use third-party scripts. Typically, you run these tools over a period (e.g., a year) to count documents by type. Keep in mind to eliminate double-counting (only the first document in a process is counted). If tools are not installed, consider a consulting engagement to estimate based on your business processes.
Q5: What happens if we exceed the number of documents we licensed?
A: If you adopt Digital Access and your usage exceeds your licensed document quota, you are technically out of compliance (just like using more users than you have licenses). In practice, SAP would address this in an audit true-up, requiring you to purchase additional blocks for the excess. It’s critical to monitor usage and either limit the integrations or be ready to buy more blocks if needed. Negotiating some buffer or an overflow clause up front can provide breathing room.
Q6: Does Digital Access eliminate all indirect usage risk?
A: It mitigates the classic risk of “surprise” indirect users by making licensing more transparent. However, you still have to actively manage and report document usage. There’s less ambiguity (SAP can count documents objectively), so in that sense, it reduces legal friction. However, if you underestimate your needs or if transaction volumes unexpectedly increase, you may face unbudgeted costs, so diligence is still necessary.
Q7: Are there any downsides to not switching to Digital Access?
A: Sticking with the traditional model isn’t a problem if you’re confident that all indirect access is covered via existing licenses. Be aware of SAP’s audit focus on indirect usage – you must regularly ensure that no new integrations appear without a license. Additionally, SAP’s strategic direction favors the document model; future SAP innovations (or contract renewals) may eventually push you toward Digital Access, potentially with less favorable terms if you wait too long.
Q8: How does SAP’s Digital Access Adoption Program (DAAP) work?
A: DAAP is a limited-time incentive where SAP offers heavy discounts (at least 90%) on document licenses. It usually works by first measuring your document usage (with SAP’s help or a self-assessment). SAP offers you two options: Option A, a license at ~115% of the amount, with a special volume discount (pay for 15% and receive 115% coverage), or Option B, a license covering 100% of measured usage at a 90% discount off the list price. You can also retire certain old licenses for credit. It’s designed to make switching financially attractive. If you’re considering Digital Access, taking advantage of DAAP before it sunsets can yield significant savings.
Q9: Will moving to Digital Access reduce our SAP maintenance costs?
A: It depends. If, as part of the switch, you retire a large number of named user licenses, your maintenance base may decrease (since you’d be returning licenses). However, you’ll start paying maintenance on the new Digital Access licenses (SAP typically charges the standard support percentage on the net license fee you paid). Because DAAP heavily discounts the license fee, the total maintenance cost may be lower than it would be for equivalent named-user licenses. Be sure to calculate the maintenance costs for any new licenses and factor them into the long-term costs.
Q10: What are some best practices to avoid indirect access surprises?
A: Whether or not you use Digital Access, best practices include:
- Regular Reviews: Periodically review system interfaces and user lists to catch new uses of SAP.
- Architectural Controls: Implement gating processes so that any new integration with SAP triggers a licensing check.
- Education: Make business units aware that connecting a new tool to SAP isn’t “free” – it has license implications. Early involvement of IT licensing teams can prevent untracked usage.
- Expert Help: Consider an SAP licensing specialist or service to conduct an annual health check. They can identify indirect use footprints and provide continuous advice on optimization.
Read more about our SAP Advisory Services.
