Lesson 1 of 5
Assessing the legacy role landscape
11 min
Listen to this lesson
A system conversion carries everything across, including twenty years of authorization decisions. Roles that were built for one project and never retired, users who collected access with every job change, conflicts that were mitigated once and forgotten: all of it arrives in SAP S/4HANA unless someone decides otherwise. The first job of a security architect on a transformation is to see that landscape clearly, measure it and decide how much of it deserves to survive.
This course follows Contoso Motor Co.'s conversion from SAP ECC 6.0 EHP 8 to SAP S/4HANA Cloud Private Edition. Its security and GRC lead, Nadia, owns access design for the program; Contoso runs SAP Access Control 12.0, connected to the ECC systems and the new CMD, CMQ and CMP. The patterns apply equally to programs without a governance product, where the same analysis is done with reports and spreadsheets.
Why a conversion forces the question
A conversion technically keeps roles, but it changes what they mean. Many classic transactions are replaced or simplified in SAP S/4HANA; for example, customer and supplier master data are maintained through the business partner. SAP Fiori apps add new start authorizations and OData services that legacy roles never contained. The SAP Fiori launchpad itself moved on: SAP deprecated launchpad groups as of SAP S/4HANA 2021 in favor of spaces and pages; groups still work but get no new features. A role that "converted cleanly" can therefore leave users unable to start the apps they need, or let them start things nobody intended.
What to measure
| Measure | Source | Contoso EP1 baseline |
|---|---|---|
| Active dialog users | User master data and logon dates | About 1,350 |
| Roles in the system | Role list from the User Information System | About 2,900 single and composite roles |
| Roles never assigned or unused for 12 months | Assignments and usage data | About 1,100 |
| Users with more than 15 roles | Assignment analysis | About 40% of active users |
| Open SoD conflicts at user level | Access risk analysis against the rule set | 310, of which 180 mitigated |
| Users with broad technical profiles | User Information System, critical authorizations | A handful, mostly legacy support users |
| Custom transactions in roles | Role menus and authorization data | About 260 |
| Emergency access sessions per month | Emergency access logs | About 45 |
Contoso's legacy access baseline. Figures are rounded and illustrative.
Each figure answers a design question. Unused roles show how much can simply be dropped. Users with many roles show where jobs were never modeled. Open conflicts and frequent emergency access show where the current design does not match how people really work. Custom transactions show where the role design depends on code that the conversion may retire.
- InventoryExtract roles, users, assignments and role menus from EP1
- UsageAdd usage data: which transactions and apps each user actually ran over 12 months
- RiskRun access risk analysis at role and user level against the current rule set
- Simplification impactFlag transactions replaced or removed in SAP S/4HANA and the custom code being retired
- ClassifyKeep, redesign or retire for every role; record the reason
- Decide approachConvert as-is, redesign, or a hybrid; agree it with Grace and the process owners
Three approaches and when they fit
| Approach | What it means | Fits when | Risk |
|---|---|---|---|
| Convert as-is | Keep legacy roles; add Fiori content and fix what breaks | Roles are well designed, conflicts are low and time is short | Carries debt forward; Fiori access bolted on |
| Full redesign | Build new roles from SAP business role templates and processes | Legacy roles are sprawling and conflict-heavy | Effort and user disruption at go-live |
| Hybrid | Redesign high-risk and Fiori-heavy areas; adapt the rest | Mixed quality; some areas clean, others not | Two design styles must coexist and be governed |
Contoso chose a hybrid. Finance and procure to pay, where most conflicts and emergency access sat, are redesigned from SAP business role templates; plant maintenance and warehouse roles, which were clean and transaction-heavy, are adapted. Order to cash is redesigned because Maria's team moves mostly to Fiori apps. The decision record lists the measures above as the reason, so the steering committee could see why security needed the budget.
Do not forget non-dialog users
Assessments often stop at dialog users, but the riskiest access in an ECC system frequently sits elsewhere: RFC and interface users with broad authorizations because "the interface needed it once", batch users that run jobs for the whole company, and support users created for a long-finished project. Nadia's inventory includes every user type, with an owner and a purpose for each technical user. In SAP S/4HANA, interfaces will change (some move to released APIs and SAP Integration Suite), so each technical user is redesigned with the interface it serves rather than converted with broad access intact.
What would you do?
Grace asks whether the program can save time by converting all 2,900 roles as-is and "cleaning up after go-live". Nadia has the baseline above. What is her best answer?
- A conversion keeps legacy roles but changes what they mean: simplified transactions, Fiori apps, spaces and pages.
- Measure users, roles, usage, conflicts, broad access, custom transactions and emergency access.
- Classify each role by usage and risk: retire, adapt or redesign.
- Choose convert as-is, redesign or hybrid with evidence, and record why.
Check your understanding · not graded
Lesson check
1. Why can a role that "converted cleanly" still fail users in SAP S/4HANA?
2. What replaces SAP Fiori launchpad groups, deprecated as of SAP S/4HANA 2021?
3. How should an unused but high-risk legacy role be treated?
4. Which baseline figure most directly shows where jobs were never modeled?