Lesson 1 of 5
Capability overview
10 min
Listen to this lesson
SAP Access Control is SAP's on-premise product for access governance. SAP's training describes it as a solution that enables an organization to control access, identify risk and document compliance. Contoso runs version 12.0. It runs on its own ABAP system and connects to the business systems it governs, such as Contoso Motor Co.'s CMQ and CMP. Two dates shape its future: mainstream maintenance for Access Control 12.0 ends at the end of 2027, with optional extended maintenance to 2030, and SAP's successor release, SAP GRC for SAP HANA (GRC 2026), was released to customers in restricted shipment on 6 March 2026 and became generally available on 31 July 2026. It requires the GRC system to run on SAP HANA, so Nadia has put the GRC upgrade on the post-go-live roadmap. For cloud applications, SAP offers SAP Cloud Identity Access Governance (IAG), a cloud service that SAP positions as complementary to Access Control, not as its replacement; through the IAG Bridge the two share content and functions such as the risk library, mitigation and role simulation.
The previous course covered access risk analysis and the rule set. This course covers the processes built around it. Nadia, Contoso's security and GRC lead, is configuring them for go-live, because the auditors will test not only that roles are clean on day one but that access stays controlled every day afterwards.
Five capability areas
The areas share common parts. Risk analysis is called from requests, role management and reviews. The multi-stage, multi-path (MSMP) workflow drives approvals for requests, reviews and maintenance of risks, functions, controls and roles. BRFplus rules decide things such as which path a request takes and who the approvers are. Reports and dashboards cover risk violations, mitigation, role and action usage, and change logs, and alert monitoring can flag conflicting or critical access and controls not performed on time.
How it connects to the business systems
Access Control reads users, roles and authorizations from connected systems for analysis, and writes back when it provisions access or opens an emergency session. Each connected system is set up as a connector with an RFC destination, and data such as roles and users is synchronized by scheduled jobs. Access Control can also integrate with identity management and provisioning systems, so that account creation and HR-driven changes follow one path. If that system is SAP Identity Management, note that its mainstream maintenance also ends at the end of 2027 (extended maintenance to 2030); SAP has named no direct successor and points customers to SAP Cloud Identity Services (Identity Authentication and Identity Provisioning) and to partner identity platforms such as Microsoft Entra ID, so the provisioning path is itself a migration to plan and test. Contoso's own Access Control landscape has development, quality and production systems that connect to CMD, CMQ and CMP respectively, so that GRC configuration can be tested before it governs production.
| Capability | Main users at Contoso | What auditors look for |
|---|---|---|
| Access risk analysis | Nadia's GRC team, risk owners such as Dan | A maintained rule set and documented risk decisions |
| Access requests | Every employee, managers, role owners | Approval and risk check before access, timely removal |
| Role management | Nadia's team, role owners | Approved, risk-checked, tested role changes |
| Emergency access | Sam's Basis team, Kenji's developers, support | Every session logged, reviewed and justified |
| Access reviews | Managers, role owners, risk owners | Reviews completed on time, removals carried out |
Who uses each capability, and what an IT general controls audit expects from it.
- JoinerAn access request, risk-checked and approved, provisions roles.
- MoverA change request adds new roles and removes old ones, with a fresh risk check.
- ExceptionEmergency access covers urgent, unplanned work, logged and reviewed.
- Periodic checkAccess reviews confirm the access is still needed.
- LeaverA request or HR trigger locks and removes the access.
What would you do?
Grace asks Nadia why Contoso needs anything more than the risk analysis already running: "The roles are clean. Isn't that enough?" What is the best answer?
- SAP Access Control 12.0 covers risk analysis, access requests, role management, emergency access and access reviews; its mainstream maintenance ends in 2027, and SAP GRC for SAP HANA is the successor release.
- Risk analysis, MSMP workflow and BRFplus rules are shared across the capabilities.
- Connectors and synchronization jobs link Access Control to CMD, CMQ and CMP.
- Each capability governs a stage of the access lifecycle: joiner, mover, exception, periodic check, leaver.
Check your understanding · not graded
Lesson check
1. Which framework drives approvals for access requests and reviews in SAP Access Control?
2. What role do BRFplus rules play in Access Control?
3. Why does Contoso run separate development, quality and production Access Control systems?
4. Which SAP offering covers access governance for cloud applications?