India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
SAP Security and Identity on Cloud: SSO, Privileged Access, Encryption
SAP security and identity on cloud covers how people and systems authenticate to SAP, who can reach SAP hosts with privileged OS and database accounts, how HANA data and backups are encrypted, and how SAP security events reach a SIEM. NTSPL implements SSO, privileged access, key management, segmentation and audit-log pipelines for S/4HANA landscapes on AWS, Azure and Google Cloud.
Delivered on
In scope
Where Cloud Security and SAP Authorization Leave Gaps Between Them
SAP on cloud inherits two security models that rarely meet. The cloud team secures accounts, networks and keys; the SAP team manages users, roles and SoD inside the application. Between them sit the gaps attackers use: shared sidadm passwords known to three vendors, SAP GUI passwords that never expire, HANA SYSTEM accounts still enabled, security audit logs that stay on the application server, and backup keys stored on the same host as the database they protect.
NTSPL closes those gaps layer by layer. Users authenticate through the corporate identity provider with SAML for Fiori and Kerberos or X.509-based SNC for SAP GUI. Privileged OS and HANA access goes through just-in-time elevation with recorded sessions. HANA data volumes, logs and backups are encrypted with keys rooted in the cloud key service. SAP security audit log, HANA audit and OS events flow to the SIEM with SAP-specific detections and 180-day retention in India.
Findings That Call for SAP-Specific Security Work on Cloud
Signals you need SAP Security & Identity
- SAP GUI users still log on with SAP passwords and more than 20 percent have not changed them in a year.
- sidadm, root or HANA SYSTEM credentials are shared among Basis staff and outside vendors.
- SAP security audit log is either not enabled or not forwarded beyond the application server.
- An auditor, parent company or defence or pharma customer has asked for evidence of SAP privileged access control.
- HR, payroll or customer personal data in SAP must be mapped and protected under the DPDP Act 2023.
When to choose something else
- The need is a full SoD redesign of business roles; that is a GRC role-design project, though NTSPL can connect it to identity.
- The concern is general cloud posture across many workloads; a cloud security posture assessment of the estate fits first.
- SAP runs under RISE with SAP, where OS and database privileged access is SAP's responsibility; NTSPL then covers identity integration and application-level logging.
SAP Identity and Security Controls NTSPL Implements
User authentication and SSO
SAML 2.0 SSO for Fiori and web apps and SNC with Kerberos or certificates for SAP GUI, integrated with Microsoft Entra ID or another corporate identity provider, plus MFA rules.
User lifecycle
Joiner, mover and leaver provisioning from HR to SAP users, using SAP Cloud Identity Services or identity governance tools, with SAP Identity Management replacement plans.
Privileged OS and HANA access
Just-in-time elevation to root, sidadm and HANA administrative users with session recording, and deactivation of the HANA SYSTEM user for daily use.
Encryption and keys
HANA data volume, redo log and backup encryption, root key backups, cloud disk encryption with customer-managed keys and separation of backup keys.
Logging and detection
SAP security audit log, HANA audit trail, gateway and message server logs and OS logs into the SIEM with SAP-specific detection rules.
How SAP Security & Identity Works, Step by Step
Layered SAP Control Stack from Identity Provider to HANA Keys
Users authenticate at the corporate identity provider and reach SAP through SSO, while administrators reach hosts only through a privileged access path. HANA encryption keys are rooted in the cloud key service, and SAP and OS security events stream to the SIEM.
Select any component
Layered SAP Control Stack from Identity Provider to HANA Keys: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Identity, Key and Detection Services for SAP per Cloud
On AWS, administrators reach SAP hosts through Session Manager with logged sessions and no open SSH, keys live in KMS, and SAP logs are forwarded to the chosen SIEM from CloudWatch Logs.
On Azure, Entra ID provides SSO and PIM for just-in-time admin roles, Bastion removes public SSH, and the Sentinel solution for SAP applications brings SAP audit log detections.
On Google Cloud, IAP TCP forwarding replaces bastion SSH for SAP hosts, Cloud KMS holds disk and backup keys, and SAP logs are routed to Google Security Operations or another SIEM.
Security Design Choices Specific to SAP Landscapes
SSO method for SAP GUI
Use Kerberos-based SNC where users are on domain-joined Windows devices; it is invisible to users and encrypts traffic. Use X.509 certificates via SAP Secure Login Service or similar where devices are not domain-joined or MFA must be enforced at logon. Disable password logon for dialog users only after 95 percent of users have used SSO for two weeks.
Privileged access model
Remove standing root and sidadm access. Grant time-boxed elevation of 1 to 8 hours through PIM or a PAM tool with ticket reference and recorded sessions. Vendors get the same path with tighter windows. Keep a break-glass account sealed and tested quarterly. Deactivate the HANA SYSTEM user after creating named admin users with limited privileges.
Key ownership and separation
Use customer-managed keys for production disks and backups. Keep HANA root key backups in a vault separate from the HANA host. Place backup vault keys in a different account or subscription from production so a single compromised admin cannot both delete data and destroy keys. Rotate HANA root keys yearly or after an incident.
Which SAP events go to the SIEM
Forward the security audit log with at least logon failures, user and role changes, debug-and-replace, RFC calls and transaction starts for critical transactions. Add HANA audit for privilege changes and gateway logs for unknown RFC registrations. Expect 2 to 10 GB a day for a mid-size landscape; filter routine dialog events to control SIEM cost.
SAP Security Hardening Programme in Six Weeks
Control baseline review
Review users, privileged accounts, encryption status, audit log settings and network exposure across SAP SIDs.
Privileged access and host hardening
Implement just-in-time admin access, remove public SSH and RDP, rotate shared passwords and deactivate HANA SYSTEM.
Encryption and keys
Enable HANA encryption where missing, set customer-managed keys and back up root keys with dual control.
SSO rollout
Configure SAML for Fiori and SNC for SAP GUI, pilot with key users, then roll out by location.
Logging and detections
Enable audit policies, forward logs to SIEM, deploy SAP detections and test them with simulated events.
What you receive
Control Coverage Measures for SAP on Cloud
| KPI | Typical target |
|---|---|
| SAP dialog users authenticating through SSO | At least 95 percent within 8 weeks |
| Standing privileged OS and HANA accounts for named people | Zero |
| Production SAP and HANA tenants with encryption at rest | 100 percent |
| SAP critical events reaching SIEM | Within 5 minutes, 180-day retention |
SAP Security Gaps Common After Cloud Migration
| Risk | How NTSPL prevents it |
|---|---|
| SSO rollout locks out users at remote plants | Rollout by location with a fallback password logon kept for a defined window, and helpdesk scripts prepared in local languages. |
| HANA root keys lost after a rebuild, making backups unreadable | Root key backups are stored in a separate vault with dual control, and restore tests include key import on a fresh host. |
| SIEM costs surge from verbose SAP logs | Audit log filters are tuned per event class, and routine events stay in lower-cost storage for retention while critical events go to detection. |
Microsoft Entra ID or SAP Cloud Identity Services for SAP authentication?
They usually work together rather than compete. Entra ID, or your corporate identity provider, should stay the authoritative source for who users are and how they authenticate, including MFA and conditional access. SAP Cloud Identity Services act as a proxy and provisioning hub for SAP BTP, SuccessFactors, Ariba and S/4HANA cloud scenarios, translating identities into what SAP applications expect. For S/4HANA on IaaS, Fiori can trust Entra ID directly through SAML, and SAP GUI uses Kerberos SNC with Active Directory. Add SAP Cloud Identity Services when SAP SaaS or BTP apps are in scope.
Key facts: SAP Security & Identity
SAP Security & Identity in Practice
2 SAP Security & Identity scenarios, from Defence electronics supplier and Pharma formulations, plus related platform case studies.
Defence electronics supplier removes all standing SAP admin access for vendor audit
Pharma formulations maker gets HANA encryption and key separation before USFDA inspection
Three directories become one: identity consolidation after two acquisitions
Health-tech SaaS moves patient data behind KMS and Identity Center ahead of DPDP
SAP Security & Identity: Frequently Asked Questions
What does SAP security hardening on cloud cost?
For a landscape of three to five production SIDs, effort is typically 30 to 45 consultant-days over six weeks. Licence costs for PAM, SIEM ingestion or SSO tools depend on what you already own; NTSPL designs around existing Entra ID or SIEM investments where possible.
How does this support the DPDP Act 2023?
We map personal data in SAP HR, payroll, customer and vendor masters, restrict access by role, encrypt data at rest and in transit, and log access to sensitive tables. These are evidence of reasonable security safeguards and support breach notification if an incident occurs.
Can SAP security events support a CERT-In report within 6 hours?
Yes, if they reach the SIEM in minutes. NTSPL forwards SAP audit log, HANA audit and OS logs to an Indian-region store retained for at least 180 days, with detections that raise incidents fast enough for the 6-hour reporting window.
What replaces SAP Identity Management?
SAP has announced the end of mainstream maintenance for SAP Identity Management at the end of 2027 and points customers to Microsoft Entra ID and SAP Cloud Identity Services. NTSPL plans the move of provisioning rules and approval workflows as part of SAP identity work.
Do vendors still get access to our SAP systems?
Yes, but through the same just-in-time path as staff, with named accounts, ticket references, time limits and recorded sessions. Shared vendor accounts and permanent VPN tunnels are removed.
Is HANA encryption a performance problem?
Data volume and log encryption have little measurable impact on modern cloud instances for most S/4HANA workloads. NTSPL enables it on quality first and compares batch and dialog timings before production.