Maintenance for SAP Access Control expires in 2027: What comes next?

SAP has set the end of maintenance for SAP GRC for December 31, 2027 – at least according to the current status. As a software suite for governance, risk management and compliance, SAP GRC comprises the solutions SAP Access Control, SAP Process Control and SAP Risk Management. In view of the imminent end of maintenance, existing and potential new customers are asking themselves how they can cover the topics of governance, risk management and compliance in the SAP cosmos in future. In answering this question, we focus on SAP Access Control. The most important news up front: there will still be ways to map authorization management with SAP solutions after 2027.

How to distribute, manage and validate roles and users in the cloud

SAP IAG as a cloud variant

SAP Cloud Identity Access Governance (IAG) is already available as the cloud counterpart to SAP Access Control – and will remain so. SAP IAG offers existing and new SAP customers who already rely on a cloud strategy a very sophisticated solution. A look at the roadmap reveals that additional functionalities will be implemented in the future.

For companies currently using SAP Access Control, there is also the option of switching to the version of SAP Access Control embedded in SAP S/4HANA. SAP Access Control for SAP S/4HANA ensures tight integration with the core ERP system and enables seamless data flows, real-time risk management and a consistent user experience.

Is on-premise still an option?

And what about the on-premise world? Many companies operate quite large and complex implementations that should continue to exist wherever possible. SAP has announced that there will be an SAP Access Control Edition for HANA from the first half of 2026. From this version onwards, SAP Access Control will use SAP HANA as a standardized database.

This means that a version of SAP Access Control will be available for on-premise and the private cloud from 2026 – independently of SAP S/4HANA. This version is likely to have a very similar range of functions to the current SAP Access Control 12. Nevertheless, companies must prepare for a migration, as they will need SAP HANA as a uniform database.

Prepare for the end of maintenance in the best possible way

This leaves the question of how to assess the time factor. The new edition of SAP Access Control is due in 2026, and the end of maintenance for the previous release is December 31, 2027. This may seem tight, but on the one hand the announced end of maintenance will not mean an immediate end to all support and on the other hand the early announcement gives time to prepare. Companies are now faced with the task of planning their budget and time accordingly and discussing and approving possible process optimizations. At IBsolution, we will look into the possibilities of SAP Access Control Edition for HANA at an early stage and provide customers and interested parties with expert advice.