SAP Indirect Usage Alternatives and Mitigations for S/4HANA and ECC

SAP Indirect Usage Alternatives and Mitigations for S/4HANA and ECC

SAP indirect usage – when external systems or users access SAP S/4HANA or ECC without direct logins, poses significant licensing and cost risks for CIOs and CTOs.

This advisory explains the differences between SAP’s traditional and digital access licensing models.

It provides alternatives and mitigations to reduce indirect usage counts, such as utilizing SAP-certified middleware and implementing smart contract strategies.

With proactive management and the right integration approach, enterprises can avoid surprise audit fees and optimize SAP license spending.

The Challenge of SAP Indirect Usage

Indirect usage occurs when people or third-party applications use data or trigger transactions in SAP without directly logging into SAP.

In an SAP S/4HANA or ECC environment, this could be an e-commerce site creating a sales order in SAP or a Salesforce CRM updating customer records in SAP.

These scenarios are common in modern IT landscapes, but they create hidden licensing liabilities.

SAP historically required a named user license for any person or system indirectly accessing SAP. This was hard to track and often overlooked. As a result, many organizations unwittingly accumulated unlicensed indirect use.

The stakes became clear after high-profile cases: in 2017, Diageo was ordered to pay around £54 million for customers accessing SAP via Salesforce, and in another case, SAP claimed approximately $600 million from AB InBev for extensive system integrations.

These examples illustrate how unchecked indirect use can result in multi-million-dollar penalties. Every CIO must recognize that updating SAP data using a mobile app or IoT sensor may be considered usage that requires licensing.

Read Negotiating Indirect Use Terms in SAP Contracts.

Traditional vs. Digital Access Licensing

To address the ambiguity, SAP now offers two models for indirect access in S/4HANA and ECC:

• Traditional Named User Licensing: Every individual or device indirectly using SAP requires a user license (e.g., a “Professional User” or “Limited User” license). This means if 1,000 customers submit orders through a portal, technically all 1,000 would need some form of SAP license. In practice, companies can’t license casual customers, so this model led to compliance gaps and audit risks.
• Digital Access (Document-Based) Licensing: Introduced to mitigate the above issue, this model charges based on documents created in SAP by external systems. SAP defined nine key document types (such as Sales Orders, Invoices, Purchase Orders, etc.). Whenever an external app triggers one of these in SAP, it counts toward a licensed document quota. For example, those 1,000 portal orders would count as 1,000 documents. Reading data (reports, queries) without creating new records typically does not count. This shifts the metric from users to transaction volumes.

Table: Traditional vs. Digital Access

Under the old model, indirect usage costs were unpredictable – you might be fine until an audit discovers hundreds of unlicensed users.

Under Digital Access, costs become more transparent: you pre-purchase, say, 100,000 documents per year and know your exposure.

Many SAP customers adopt a hybrid approach: keep low-volume partners on named-user licenses (or existing contract terms) and use digital document licenses for high-volume integrations.

This avoids double-paying – internal users are already licensed to use SAP via any interface, and only purely external activities consume document licenses.

Hidden Costs and Risks

Without control, indirect access can become a ticking time bomb in your SAP agreement.

SAP’s license audits now analyze technical logs to identify third-party interfaces that create SAP transactions.

Companies have been caught off guard with hefty compliance bills (as seen with Diageo and AB InBev).

To illustrate risk vs. mitigation, consider an online retail portal linked to SAP:

• Risk scenario (Traditional model): 10,000 customers place orders via the portal. In theory, each customer needed a license. No one buys 10,000 SAP logins for occasional users, but an audit could assess back-charges for those 10,000 unlicensed individuals. At a list price of a few thousand dollars per user, the exposure could be tens of millions.
• Mitigated scenario (Digital Access): The same 10,000 orders count as 10,000 documents. If the company had pre-licensed a block of 10k documents (pricing is negotiated, but often a fraction of user licensing), the cost might only be in the tens of thousands. Even if not pre-licensed, the cost to true-up documents is significantly lower than the cost of user licenses for all customers.

These examples demonstrate how selecting the right model can significantly reduce costs.

However, Digital Access isn’t automatically cheaper in all cases – if your external systems generate millions of documents, the bill could exceed the costs of named users.

For instance, one manufacturer found that 5 million sensor updates per year would be cheaper under one licensed system user (unlimited updates) than paying per document. It’s crucial to analyze your own patterns.

Table: Indirect Access Audit Outcomes

The lesson: ignoring indirect use is expensive. But with the right mitigations, you can turn indirect access from a liability into a manageable, forecastable cost.

Integration and Middleware Strategies to Reduce Indirect Usage

A key mitigation is architectural. By designing integrations carefully, you can minimize how SAP “counts” indirect usage:

• Use SAP-Certified Middleware: Instead of numerous point-to-point connections to SAP, channel external interactions through a central integration platform (e.g., SAP Process Orchestration, SAP Integration Suite, or certified third-party middleware). This reduces the number of direct touchpoints. For example, five different applications might all interface via one SAP-certified middleware, using a single SAP login or API account. Fewer direct connections mean fewer technical users to license and potentially fewer documents (if the middleware batches or consolidates transactions). Using SAP-certified interfaces (like standard BAPIs, OData services, or IDocs) also ensures compliance with SAP’s guidelines, so you’re less likely to accidentally violate licensing rules. It won’t eliminate license requirements, but it centralizes and controls the indirect usage, making it easier to monitor and quantify.
• Architect for “Static Reads”: If an external system only needs SAP data occasionally (for reporting or reference), avoid real-time calls to SAP for each query. Instead, push data on a schedule to a data warehouse or use SAP’s data replication tools. Reading a copy of SAP data (that’s kept updated via a certified integration) typically does not incur SAP license charges. For instance, you could export inventory data daily to a cloud database that your e-commerce site reads from, rather than having each web query access SAP in real-time. This way, external apps are reading static data and aren’t counted as SAP usage. Ensure such use-cases are documented as “read-only” in your contract to formalize that they are exempt from indirect licensing.
• Minimize Document Creation: Examine how external systems interact with SAP and determine if it is possible to consolidate transactions. If an external process generates five separate SAP documents, can it be redesigned to create a single one? For example, batch multiple small updates into a single document or transaction when feasible. Each document created by an external app counts against your license; combining them can reduce the total number of documents. Be cautious about combining only when it makes business sense. However, technical teams often find opportunities to streamline integrations. Even using an SAP workflow or extension within SAP may replace the function of an external system, keeping the activity fully within SAP and covered by existing licenses.
• Assign Proper Access Users: When third-party software needs to log into SAP, use dedicated, licensed integration users rather than personal accounts. An integration user can be licensed (as a type of Named User) to cover a whole interface. For instance, one “SAP External Interface” user license could cover all activities of an entire middleware platform. This is especially useful under the traditional model, where a single licensed system account can execute an unlimited number of transactions on behalf of multiple external requests. It’s a compliance gray area if abused (SAP might argue that each end-user still needs a license). Still, many companies negotiate terms to allow a “batch” or “gateway” user for certain integrations. Always get clarity from SAP on whether a single technical user license is sufficient for a given scenario.
• Monitor and Tune: Implement real-time monitoring to track indirect usage. SAP provides the License Audit Workbench (LAW) and log analysis tools that show which documents external systems create. Third-party asset management tools can also alert you if a particular integration experiences a sudden surge in usage. By monitoring, you can adjust your integration approach. E.g., if one API is creating excessive documents, you might refactor it or decide to license that volume via Digital Access before an audit forces the issue.

By leveraging these integration strategies, organizations can significantly reduce the “indirect footprint” on SAP. The goal is to enable external systems to function as needed, while minimizing the impact on license counts or consolidating usage into manageable units.

Contractual Mitigations and Licensing Strategies

Technology alone isn’t enough – you also need the right contractual safeguards to mitigate indirect usage costs.

CIOs and CTOs involved in SAP negotiations should consider these tactics:

• Negotiate Clear Indirect Use Terms: Don’t rely on vague standard language. Define exactly what constitutes indirect use in your contract and what is exempt. For example, explicitly state that certain read-only integrations or data exports do not require additional licenses. If you use a specific middleware or gateway, name it and clarify that the X license model covers interactions through it. This prevents “gotcha” interpretations later.
• Cap and Forecast Charges: If you opt for Digital Access (documents), consider negotiating a cap or tiered pricing for document overages. For instance, agree that if you exceed your licensed documents by 10%, you can buy the extra at a pre-agreed discounted rate (instead of the full list price). Some savvy organizations even negotiate an annual cap – e.g., “Digital Access fees will not exceed $500k per year regardless of volume”. SAP may agree if you’re a large customer or if it’s part of a broader S/4HANA deal. The key is to avoid an open-ended per-document fee; lock in predictability.
• Leverage the Digital Access Adoption Program: SAP’s DAAP has offered steep incentives for switching to document licensing. While the formal program deadlines have been extended multiple times (and as of 2025, there’s no hard end date), you should still ask for the original perks. SAP has provided up to 90% discounts on initial document license purchases or generous credits for existing user licenses you already paid for. For example, if you previously bought extra “indirect” named users that you won’t need after switching, SAP can credit that value toward your document licenses. Always inquire about these credits and discounts – they can save millions in a migration to Digital Access.
• Bundle with S/4HANA or RISE Deals: If you’re moving from ECC to S/4HANA, use that transition as leverage. SAP is keen to get customers onto S/4HANA (especially RISE with SAP cloud subscriptions). In a migration deal, negotiate indirect usage terms as part of the package. You might get a certain volume of Digital Access documents included for free or at a nominal rate. RISE with SAP contracts sometimes bundle digital access entitlements – double-check this and confirm in writing. If not, ask for it. For on-premise S/4HANA licenses, similarly negotiate a favorable addendum for indirect usage while you have procurement power during the upgrade.
• Retain Audit Defense Rights: Even with precautions, you may face an SAP audit. Ensure your contract provides you with a reasonable amount of time to respond, the right to discuss findings, and possibly the ability to remediate issues before penalties are incurred. If you’ve defined things like “static read” interfaces as license-free, make sure auditors know that. It is helpful to document all your third-party connections and the agreed-upon licensing approach for each (for example, an “integration register” attached to the contract). That way, if an auditor flags something, you can show it’s accounted for in the contract. Pushing for audit clause improvements can save headaches in the future.
• Continual License Optimization: Treat indirect access as an ongoing licensing topic. Regularly true-up and optimize your named user licenses. Many companies find during an internal review that they have unused or mis-assigned user licenses that can be reclaimed and reallocated to cover some external access. By optimizing what you already own, you might reduce the need to buy new licenses. Also, stay informed about SAP’s licensing policy updates – SAP occasionally refines definitions or introduces new license types (e.g., a special IoT user license or a new engine metric) that may better cover your scenario.

Coupling these contractual moves with technical strategies gives a one-two punch: you reduce the raw number of licensable events, and you minimize the cost of any events that remain.

The result is a significantly more license-efficient SAP environment, even as you continue to integrate SAP with an expanding array of cloud apps, partners, and devices.

Recommendations

• Map All Integrations: Immediately create an inventory of every third-party system, interface, or user accessing your SAP data. Visibility into these connections is the first step in controlling indirect usage.
• Optimize Existing Licenses: Clean up inactive SAP accounts and right-size users to the proper license types. Free up any surplus named user licenses to cover external access where appropriate before spending on new licenses.
• Consider Digital Access for High Volumes: If you have large transaction volumes from e-commerce, IoT, or B2B portals, evaluate SAP’s Digital Access model. Calculate if a document-based license would cost less than thousands of individual user licenses.
• Use Middleware Wisely: Integrate external systems through a centralized, SAP-certified middleware or API gateway. This not only streamlines the data flow but also makes it easier to monitor and license from a central point, rather than through dozens of scattered interfaces.
• Negotiate Protection Clauses: When renewing or signing SAP contracts (especially moving to S/4HANA or RISE), include specific clauses for indirect usage. Negotiate caps on fees, an exemption for read-only data uses, and discounted pricing for any future expansion of digital access.
• Monitor Continually: Implement tools or processes to track indirect usage on an ongoing basis. Review logs and usage reports quarterly to catch any spikes or new interfaces. Early detection allows you to address licensing needs proactively, avoiding audit surprises.
• Educate Your Teams: Ensure that project managers, architects, and procurement personnel are all aware of the indirect licensing rules. Establish an internal policy that no new integration goes live without a licensing check. A bit of training can prevent costly mistakes, like a developer unknowingly creating a license-liable interface.
• Leverage Expert Help: Consider consulting with SAP licensing experts or utilizing software asset management solutions to obtain an independent assessment of your indirect usage compliance. They can provide optimization ideas and support negotiations with SAP from a position of data and experience.

FAQ

Q1: What exactly is SAP’s “indirect usage” and why is it a big deal?
A: Indirect usage means using SAP’s functionality or data via a third-party system or external user, rather than through direct SAP logins. It’s a big deal because SAP requires licenses for this usage, just as for direct users. CIOs should care because unmanaged indirect use can lead to compliance audits and hefty unexpected fees. Essentially, if your Salesforce, e-commerce site, or supplier portal talks to SAP, those interactions must be licensed appropriately, or you risk a nasty surprise in an audit.

Q2: How do SAP S/4HANA and ECC handle indirect access licensing?
A: In both SAP ECC and S/4HANA, the issue is similar: any external access needs to be licensed. Historically, ECC contracts used the named user model (license every user, even external). Now, SAP promotes the Digital Access model in S/4HANA, where you license document outputs instead. S/4HANA contracts (especially cloud subscriptions like RISE) often bundle digital access, but you should confirm what is included. The key difference is that S/4HANA introduced a clearer framework (Digital Access with 9 document types) to tackle indirect use. In contrast, ECC customers had to manage their systems mainly through named users or additional SAP engines. Today, SAP allows you to choose the model (or a mix of both) that best fits your situation, regardless of whether you use ECC or S/4HANA – but you may need to update your contract to take advantage of the newer approach.

Q3: Will using SAP-certified interfaces or middleware eliminate my indirect license requirements?
A: No – “SAP-certified” integrations make compliance easier, but they don’t waive license needs. Using SAP’s own middleware (like SAP Process Orchestration or Integration Suite) or certified third-party connectors (ones officially approved for SAP) is smart because they use standard SAP APIs and are easier to monitor. This can reduce the number of connections and help consolidate licensing (e.g., one technical user handling all API calls). However, any business document created in SAP by those interfaces still counts. The benefit of certified tools is better control and auditability – you’re less likely to unknowingly violate terms. Think of them as helping you reduce and track indirect usage, rather than a free pass. You still must account for the usage they channel, albeit more efficiently.

Q4: What is the best way to determine whether we should stick with named user licensing or move to Digital Access?
A: Do a cost and risk analysis of both models for your environment. Start by measuring your current indirect usage: how many external users or systems are there, and how many SAP documents do they create? SAP offers a Digital Access evaluation service that can count your documents. Next, model the costs: e.g., “If we license all these users traditionally, it costs $X; if we license documents instead, it costs $Y.” Include growth projections (if your integrations or transactions will double in a couple of years, account for that). Additionally, assess the risk: the named user model may be cheaper on paper but carries more audit risk if some users are overlooked; the document model may be straightforward but could become expensive if transaction volumes increase significantly. Many enterprises find a hybrid works: license predictable, low-volume interactions with named users (or existing licenses) and use Digital Access for high-volume flows. The decision will depend on the numbers, so gather data and involve both the IT and finance teams to select the most cost-effective and compliant route.

Q5: We’re planning to move to S/4HANA (or RISE with SAP). How can we address indirect access during this transition?
A: Moving to S/4HANA is an ideal time to resolve any indirect access issues. First, take stock of all your third-party integrations in the ECC system. Then, when negotiating the S/4HANA contract (or RISE subscription), bring up indirect usage early. Ask SAP to include either a sufficient number of Digital Access documents or some alternative licensing to cover your known integrations. Often, SAP is motivated to facilitate your transition to S/4HANA so that they can provide incentives, such as discounted document packs or even free usage for certain connectors, for a specified period. Additionally, use the migration as an opportunity to modernize your integration architecture: consider replacing some custom interfaces with SAP’s newer APIs or BTP services, which may offer different licensing options. Finally, ensure that any agreements reached are documented in writing in the new contract, including any grandfathered terms from ECC that you wish to carry over (for example, if you had an agreed exception for a specific interface, don’t lose that). By tackling it during the transition, you set a clean baseline in S/4HANA and avoid dragging old compliance risks into your new environment.

Read more about our SAP Advisory Services.

Would you like to discuss our SAP services with us?

Please enable JavaScript in your browser to complete this form.

Name *

First

Last

Email *

Company

Message *

Submit