SAP indirect access: the hidden licence liability.
When third-party systems, custom applications, or automated processes read or write SAP data, licence obligations can trigger even though no named user ever logs in. This note explains how SAP prices those documents, where the exposure hides, how to measure and cap it, and how to settle it into a renewal instead of an audit demand.
Almost every large SAP estate carries undisclosed indirect access liability — theoretical demands run from $20M to $100M. The 2018 Digital Access model reprices the risk per document rather than per named user, but does not remove it. The winning move is to measure your own document volumes first, cap the commercial terms, and fold resolution into a renewal or S/4HANA commitment. Structured that way, comparable exposure resolves at 15–40 cents on the dollar rather than list-price back-billing.
01 Key findings
The trigger is data access, not the human user. A licence obligation can arise whenever a third-party system reads or writes SAP data — a Salesforce CRM, an e-commerce catalogue, an EDI feed, a BI query, an RPA bot. The 2017 Diageo case, where SAP sought £54.6M over a Salesforce integration, put the risk on every board's radar.
Digital Access repriced the risk; it did not retire it. SAP's 2018 model licenses indirect use per document across five transaction types, at roughly $0.18–$0.45 each initially. It is cheaper than the named-user alternative, but it is a new cost line, and conversion is a negotiated agreement — not automatic.
Read-only and analytical access falls outside Digital Access. Document licensing covers only the five order/movement types. Master-data reads, portal navigation, and BI queries remain subject to the legacy named-user framework — the exposure most organisations miss.
SAP's opening volume estimate is systematically inflated. Initial Digital Access proposals typically assume 200–400% of commercially justified volume. Independent modelling from actual measurement data produces packages 40–65% smaller — worth $3M–$12M over a five-year commitment.
Measure before you answer. GLSA's pre-audit questionnaires are designed to elicit the data that quantifies your exposure. An independent assessment run first converts a reactive audit into a negotiated settlement.
02 How SAP prices documents
Under Digital Access, organisations buy a package of "documents." Each business transaction written into SAP through an indirect channel consumes one document from one of five tracked types. Benchmark pricing runs $0.18–$0.45 per document for initial purchases, falling to $0.08–$0.20 for renewals and large committed volumes.
| Document type | What consumes it | Common indirect source | Pricing basis |
|---|---|---|---|
| Sales Orders | Order created / written to SAP | CRM, e-commerce checkout | Per document, initial $0.18–$0.45 |
| Purchase Orders | PO written via integration | EDI, procurement platforms | Per document; volume-driven |
| Service Orders | Service record posted | Field-service apps, portals | Per document |
| Production Orders | Production order posted | MES, shop-floor systems | Per document |
| Materials Management | Inventory / goods movement | WMS, logistics integrations | Per document, renewal $0.08–$0.20 |
A mid-size manufacturer processing 2 million EDI purchase orders a year at $0.25 per document faces roughly $500,000 annually — far below the named-user equivalent, but a line item that did not exist under the legacy perpetual model.
03 Where exposure hides
The costly exposure is rarely the document flows SAP can meter cleanly — it is the read-only and analytical access Digital Access never covers. Map every integration against both frameworks before assuming you are protected.
| Indirect access scenario | Legacy exposure | Digital Access coverage | Residual risk |
|---|---|---|---|
| CRM writing sales orders to SAP | Named user per CRM user | Yes — Sales Order documents | Low if Digital Access in place |
| E-commerce reading SAP inventory | Named user per customer | No — read-only, no document | High — named user still applies |
| EDI purchase order processing | Named user per supplier flow | Yes — Purchase Order documents | Low if Digital Access in place |
| BI tool querying SAP tables | Named user per report viewer | No — analytical access not covered | High — named user still applies |
| RPA automating SAP transactions | Named user per bot | Partial — depends on document written | Medium — case-by-case review |
| Customer portal reading order status | Named user per portal user | No — read-only access | High — potentially massive population |
The read-only trap: a large enterprise of 50,000 employees may have 8,000–15,000 people touching SAP data through non-SAP interfaces with no SAP licence. At $1,500 per Professional User, that is a theoretical $12M–$22.5M for a single year — and converting only the document flows to Digital Access leaves the entire read-only population still exposed under the named-user framework.
04 Risk-assessment framework
Before any conversation with SAP, catalogue every RFC connection, BAPI call, web service, and database query touching SAP, and score each against these four factors to produce an exposure range.
Integration inventory
Enumerate every connection, its source system, and whether it reads, writes, or both. Most estates find this catalogue hard to produce — integrations accumulate over years and legacy documentation is incomplete.
Access nature
Separate document-writing flows (Digital Access candidates) from read-only and analytical access (named-user territory). The split determines which framework prices each connection.
Legacy vs ongoing
Historical unlicensed use is a back-billing risk; current operations are a prospective cost-normalisation exercise. They need different negotiation strategies and settle on different terms.
Volume modelling
Model document volumes from actual System Measurement Program data, not SAP estimates — accounting for seasonality, growth, and planned integration changes. This is where the 40–65% package reduction is won.
05 Audit defence
SAP's GLSA team uses the System Measurement Program to log every RFC, API call, and query, then reads the log for non-named-user patterns. When that engagement opens, sequence matters more than volume of correspondence.
Run an independent indirect access assessment before answering any GLSA questionnaire. Understand your own exposure fully so you negotiate from data, not from SAP's framing. See our SAP Audit Defence guide for the full response methodology.
SAP opens at full named-user value per year of non-compliant use — $20M–$100M for large estates. Reframe resolution as incremental licence plus a Digital Access conversion that removes ongoing enforcement risk. Achievable settlements land at 15–40% of the theoretical figure.
A genuine third-party maintenance evaluation, a parallel Oracle or Workday workstream, or a defined S/4HANA timeline all create commercial urgency SAP must resolve. Leverage evaporates once you concede the audit narrative.
06 Settling into a renewal
The cleanest resolution folds legacy exposure and ongoing compliance into a single commercial event — a renewal or, better, an S/4HANA migration — where favourable Digital Access pricing rides the larger deal.
Bundle, then protect. The S/4HANA migration is the optimal moment to negotiate a clean Digital Access framework covering all planned integrations. Insist on three protective terms: a capped overuse rate so modest volume exceedance is not penalised; a precise per-type document definition that blocks interpretive expansion by SAP's measurement tools; and an audit-exclusion clause for historical use predating conversion. Our S/4HANA Negotiation guide covers the migration commercial strategy in full.
For the complete SAP framework — user types, metrics, and audit rights — see the Complete SAP Licensing Guide and the SAP Audit Defence Playbook.
Price your indirect access risk before SAP does
Our SAP practice quantifies exposure from your own measurement data and structures resolution into a renewal — typically at 15 to 35 cents on the dollar.
The Licensing Edge
Weekly vendor and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.