SAP ConsultingData and control
SAP GRC - Access Control
SAP GRC Access Control manages who can do what in your SAP systems by looking at business risk. Conflicts such as one person changing a supplier record and also paying that supplier are caught before a role is assigned; the ones you cannot avoid are tied to a mitigating control.
Process
From rule set to access review in SAP GRC
Risk is defined once; access requests, emergency access and the yearly review all check against the same rule set.
- 01Rule setGRAC_RA_RULESET_S4HANA_ALL
Narrowed to your company
- 02Risk analysisRisk Simulation
Simulated before changes
- 03Business rolesBRM · PFCG
PFCG role after approval
- 04Access requestMSMP
Risk check before approval
- 05Emergency accessGRAC_EAM · /GRCPI/GRIA_EAM
Every action is logged
- 06Access reviewUAR · SoD review
Rejected access removed
Decision point
SoD check on a request
The new role is tested against the rule set together with the user's existing access; the result sets the approval path.
- Requested rolenew actions and permissions
- Current accessroles the user already has
- Rule setconflicting function pairs
SoD risk analysisuser and role level
- No conflict, approval continuesProvisioned automatically after approval
- SoD risk, sent to risk ownerRequest narrowed or rejected
- Unavoidable: mitigating controlControl and its owner are recorded
In S/4HANA, without [FAPP] and [SVC] actions in the rule set, Fiori conflicts go unseen.
Scope
What we take on in SAP GRC projects
SoD rule set
From the S/4HANA starter set to company-specific risks, including Fiori app [FAPP] and OData service [SVC] actions.
Risk triage and mitigation
Criticality agreed with process owners, a control catalog for unavoidable risks, and an owner for every control.
Access requests and roles
Roles designed in business terms and generated in PFCG; requests pass a risk check in MSMP workflow before approval.
Emergency access (firefighter)
Firefighter IDs, owner and controller assignments, reason codes and a log review step.
Periodic access reviews
UAR and SoD reviews at role level, with unused access filtered out beforehand using usage data.
Move to GRC for SAP HANA
HANA database and S/4HANA Foundation prerequisites, license conversion, and the hub or embedded decision.
Current state
What changes with S/4HANA and GRC 2026
- In S/4HANA, access also comes through Fiori apps and OData services, and the permissions sit on the service. SAP's GRAC_RA_RULESET_S4HANA_ALL set adds both to the rule set.
- Customer and supplier maintenance moved to the Business Partner, so SoD risks built on XK01, FK01 or XD01 have to be rewritten with BP transactions.
- Access Control, Process Control, Risk Management 12.0: mainstream maintenance to 31 Dec 2027. Successor SAP GRC for SAP HANA reached early adopters 6 Mar 2026; maintenance planned to 2040.
- A "for S/4HANA" license upgrades at no extra fee; a "classic" one is converted first. SAP Identity Management also leaves mainstream maintenance in 2027, so IdM provisioning is rebuilt.
Localization
Turkish regulators: SPK and BDDK
SPK Communiqué VII-128.10
Also covers listed companies: segregation of duties, role-based access, approved account creation and a review of all access at least once a year.
The listed-company exemption
Emergency access (Art. 16(9)) and MFA on privileged accounts (Art. 15(7)) do not apply; separate privileged accounts with an audit trail (Art. 16(7)) still do.
BDDK rules for banks
No critical transaction may be started, approved and completed by one person (Art. 11(5)), and developers may not move their own code to production (Art. 22(1)).
From the field
What we often find in SAP GRC projects
- Fiori users look free of risk. If the rule set only knows transactions, people who work in Fiori never show up in the risk report. Add [FAPP] and [SVC] actions and take GRAC_RA_RULESET_S4HANA_ALL as the starting point.
- Nobody reads the firefighter log. Sessions are logged, but the controller review is not tied to a workflow or a deadline. Define the review step and a target time; BDDK Art. 11(8) for banks and SPK Art. 16(7) for listed companies give the basis.
- Access reviews turn into a signing exercise. When managers get lists hundreds of lines long, they approve out of habit. Move the review to role level and filter out unused access with action usage data first.
- License conversion is missing from the budget. The no-fee upgrade to GRC for SAP HANA applies only to "for S/4HANA" licenses; "classic" customers convert first. Leave that step out of the plan and the run-up to 2027 gets tight.
FAQ
Common questions about SAP GRC
What is SAP GRC, and what does Access Control do?
SAP GRC is SAP's governance, risk and compliance product family. Access Control covers the authorization side: segregation of duties (SoD) risk analysis, access requests, business role management, emergency access and periodic access reviews.
When does SAP GRC Access Control 12.0 leave maintenance?
Mainstream maintenance for Access Control 12.0, Process Control 12.0 and Risk Management 12.0 ends on 31 December 2027. The successor, SAP GRC for SAP HANA (2026 release), needs an SAP HANA database and S/4HANA Foundation; its mainstream maintenance is planned until 2040.
How does firefighter emergency access work?
A user enters a reason and temporarily checks out a privileged firefighter ID. Every action in the session is logged, and the log goes to the firefighter controller for review. The ID owner decides who may use it.
Is our SoD rule set enough after moving to S/4HANA?
Usually not. In S/4HANA, access is also granted through Fiori apps and OData services, and customer and supplier maintenance moves to the Business Partner. A rule set without these actions misses Fiori users in the risk analysis.
SAP GRC or SAP Cloud IAG?
Access Control, from 2026 SAP GRC for SAP HANA, is software deployed on premise or in the cloud. SAP Cloud Identity Access Governance (IAG) offers similar functions as a service and covers on-premise and cloud systems. Through the IAG bridge, Access Control sends the global user ID to IAG, which uses it to provision cloud apps such as S/4HANA Cloud.
What does the SPK communiqué require from listed companies?
Communiqué VII-128.10 also covers listed companies. It asks for segregation of duties, role-based access, approval before accounts are created and a review of all access by the asset owner at least once a year. Article 16(9) on emergency access does not apply to listed companies. For most provisions the compliance deadline was 31.12.2025.
Sources12 sourcesSAP Community, SAP Help Portal, SAP Learning +2
SAP Community
- GRC Tuesdays: Why Move to SAP GRC for SAP HANA community.sap.com (opens in a new tab)
- SAP GRC for HANA 2026-Unified Successor for SAP Access Control 12.0, SAP Process Control 12 & More community.sap.com (opens in a new tab)
- How to incorporate SAP Fiori APP[FAPP] and Service[SVC] in the ruleset community.sap.com (opens in a new tab)
- Preparing for SAP Identity Management's End-of-Maintenance in 2027 community.sap.com (opens in a new tab)
SAP Help Portal
- SAP Access Control with Fiori Apps for SAP S/4HANA On-Premise help.sap.com (opens in a new tab)
- Using the Emergency Access Management Launchpad - SAP Access Control 12.0 help.sap.com (opens in a new tab)
- Global User ID Support - SAP GRC Access Control for SAP HANA help.sap.com (opens in a new tab)
- Simplification List for SAP S/4HANA 2025 - Feature Pack Stack 1 help.sap.com (opens in a new tab)
SAP Learning
Resmî Gazete
Mevzuat Bilgi Sistemi
Sources checked as of October 2026.
SAP Consulting
Plan your SAP GRC move before 2027
In a first assessment, we'd agree how far to narrow the rule set and in what order to migrate.