Why Indirect Access Mitigation Is Critical
SAP “indirect access” remains one of the top triggers for license compliance audits. This term refers to when external systems or users access SAP software via a third-party interface, rather than through direct SAP logins.
The stakes are high: companies have faced surprise bills in the tens of millions of dollars when such indirect usage was deemed out of compliance. Without mitigation strategies, an enterprise can suddenly owe unbudgeted license fees and back maintenance for activity they didn’t even realize required an SAP license.
To protect against this, organizations need a two-pronged approach. First, implement technical and process controls to minimize and monitor indirect usage.
Second, negotiate strong contractual protections that clearly define and limit how SAP licenses indirect use. Together, these strategies can significantly reduce financial and compliance risks associated with indirect access.
Technical Mitigation Strategies
A sound system architecture can prevent indirect access issues before they start. Key technical mitigation strategies include:
- Interface Design: Funnel third-party integrations through a controlled gateway rather than direct SAP connections. For example, use SAP’s middleware (SAP PI/PO or CPI) to channel external data in and out of SAP. Similarly, instead of creating thousands of SAP user accounts for external users, use a few licensed “proxy” user IDs that external systems share. This approach encompasses the licensing footprint, facilitating easier monitoring of indirect usage.
- Role-Based External Access: Only give external systems the minimum access they need. Design interfaces so that third-party applications can retrieve or update only specific data (and nothing more). Where feasible, keep critical transactions and document creation within SAP itself instead of letting an outside system directly create SAP records. By limiting what external software can do in SAP, you reduce the chance of triggering licensable events.
- Reduce Document Volumes: If you use SAP’s Digital Access (document-based licensing), reduce the number of documents external systems generate. Archive inactive data and avoid unnecessary transactions (like test or duplicate orders) that would count toward your license. The leaner your external document traffic, the lower your indirect usage costs.
- Automation & Monitoring: Set up monitoring to watch external calls into SAP. Regularly review interface logs and usage reports, and get alerts for unusual spikes. Early detection of a third-party system making excessive SAP calls suddenly lets you adjust or rework the integration before it becomes a compliance issue.
For insights, read Measuring SAP Indirect Usage (2025): Tools & Tips.
Process Mitigation Strategies
Technical controls alone aren’t enough; you also need governance processes to catch indirect access risks in day-to-day operations.
Consider these best practices:
- Mandatory Indirect Access Review: Require an indirect access impact check for every new integration project. Before connecting any third-party system to SAP, evaluate how it will interact with SAP and whether that could trigger license requirements. Catching these issues in the design phase prevents surprises (and fees) after go-live.
- Involve License Experts Early: Loop in your SAP licensing or compliance team before integrating any external platform (CRM, e-commerce, IoT, etc.) with SAP. They can spot indirect use risks in the design and suggest mitigations before deployment.
- Training and Awareness: Educate project managers and architects about what counts as indirect access. They should be aware of the red flags (for example, external apps reading or writing SAP data) and raise those concerns promptly. Proactive awareness within teams helps prevent accidental compliance issues.
Contractual Protection Tactics
No matter how well you design your systems, it’s critical to have contract language that protects you if SAP ever questions your indirect usage.
When drafting or renegotiating SAP agreements, consider adding clauses like:
- Clear Named User Definition: Define “Named User” clearly in the contract to mean only direct human users who log into SAP. This prevents SAP from stretching the term to cover external systems or casual data viewers as “users.” If possible, explicitly exclude certain user types (for example, users who only view SAP data via third-party tools) from requiring a license.
- Indirect Use Clause: Include a clause that certain third-party integrations will not incur additional SAP license fees. For example, “SAP access via external systems X, Y, and Z shall not trigger any additional named user charges.” By naming your key non-SAP systems in the contract, you get SAP’s agreement in writing that those use cases are exempt from extra licensing. You can also set reasonable limits (e.g., a capped number of external users or transactions) to clearly define the scope.
- Audit & Dispute Process: Modify the audit clause so that indirect usage findings aren’t automatically deemed non-compliant. For example, require that if an audit flags potential indirect use issues, SAP must review them with you first and allow a cure period (say 60–90 days) to resolve or license any shortfall before penalties apply. This ensures you have a fair chance to address indirect access questions, rather than facing unexpected fees.
- License Conversion Flexibility: Negotiate rights to convert between license types as your needs change. For example, allow a certain number of unused Named User licenses to be converted into Digital Access document credits if you shift to the document-based model. This lets you adapt your licensing (using what you’ve already paid for) instead of buying new licenses from scratch when your usage pattern evolves.
- Digital Access Terms: If you opt for SAP’s Digital Access model, lock down the details. List exactly which document types count as chargeable and how each is measured. Also, secure a fixed pricing or a cap on the cost per document for the contract term, so SAP can’t unexpectedly raise rates on your indirect usage. Clear definitions and price locks will prevent surprises down the road.
- Usage Transparency: Ask SAP to help you monitor indirect use. For example, include a clause that SAP will provide Digital Access Evaluation Tool (DAET) reports or similar usage data to you periodically at no charge. This gives you ongoing visibility into your indirect usage, allowing you to address any overages long before an audit.
Checklist: 5 Must-Have Indirect Access Contract Protections
When negotiating your SAP agreement, make sure you have these critical protections in writing:
- ✅ Clear Named User definition – with specific exclusions for certain use cases.
- ✅ Indirect use carve-out clause – covering key external systems so they don’t incur extra fees.
- ✅ Pre-agreed measurement method – a clear way to measure indirect usage (no surprises in counting).
- ✅ License conversion rights – flexibility to swap Named User licenses for Digital Access documents as needs change.
- ✅ Price protections or caps – locked pricing or fee caps on Digital Access to prevent cost spikes.
When to Negotiate Which Strategy
The balance of technical vs. contractual mitigation can depend on your SAP landscape and plans.
Consider these scenarios:
- Legacy ECC Customers: Focus heavily on tightening your contract’s indirect access terms. Older ECC agreements often have vague definitions that didn’t anticipate modern integrations. Ensure that you add the named user clarity and carve-outs discussed above, so you’re not surprised by claims that your existing interfaces require additional licenses. In other words, cover those gray areas in writing. Technical controls help, but strong contract language is your best defense on ECC.
- S/4HANA Migrators: If you’re moving to S/4HANA, SAP will likely pitch the Digital Access (document) model. This can work in your favor if you negotiate wisely. Use the migration as leverage: obtain conversion credits for your existing named users (which will offset document license costs) and secure a reasonable rate for digital documents going forward. Whether you stick to users, switch to documents, or use a mix, ensure the new S/4HANA contract clearly defines it all so you won’t face surprise charges.
- Cloud (RISE) Customers: In SAP’s cloud subscription (e.g., RISE), make sure indirect access is explicitly covered. Don’t assume “all inclusive” means every integration is free. Spell out in the contract that your key integrations (like connecting SAP to your CRM or webshop) are permitted without extra fees. If the standard cloud terms are vague, add language to clarify that external interfaces are allowed as part of your subscription. This prevents the cloud transition from introducing new indirect use charges.
Recommendations & Next Steps
Mitigating indirect access risk requires ongoing effort, but it pays off in avoided costs and headaches. Here are some final recommendations:
- Assess your exposure: Before your next SAP contract negotiation (or any major SAP upgrade), audit all external systems and interfaces connected to SAP. Identify where indirect access is currently happening or could potentially occur. This insight enables you to proactively address those areas with technical fixes or contract terms, rather than reacting after an audit.
- Use a dual approach: Don’t rely on just technical fixes or just legal clauses – combine them. Smart system design will minimize license triggers, and strong contract language will protect you if something slips through. Together, they create a robust defense against indirect access issues.
- Future-proof your licensing: If you anticipate changes like moving to S/4HANA, adopting digital access, or adding lots of new integrations, address it in the contract now. It’s much easier to get conversion rights, fixed document pricing, or other concessions before you’re locked in than after the fact.
- Document and govern: Maintain documentation of all your SAP integrations and any assurances or exceptions SAP has agreed to. We also have an internal process to review new integrations for their licensing impact. If an audit occurs, having a paper trail and a proactive compliance process will put you in a stronger position to resolve any issues.
By taking these technical precautions and contractual steps, CIOs and IT procurement leaders can significantly reduce the risk of surprise indirect access fees. Ultimately, the goal is to enable your business to integrate SAP with other systems freely and innovate with confidence – without fear that a hidden licensing trap will spring on you down the road.
Read more about our SAP Digital Access Advisory Service.
