SAP Licence Baseline Benchmarking: A Practical Guide for Enterprise Teams

Understanding SAP Licence Baseline Benchmarking in Practice

SAP licence baseline benchmarking is not a theoretical exercise. It's the operational foundation that separates enterprises that control their SAP footprint from those that blindly pay SAP's audit demands. When a fortune 500 technology company recently engaged us for baseline assessment, their internal team had never extracted a single user report from Solution Manager. They were paying for 8,500 Professional users. Within two weeks of systematic benchmarking, we identified that 3,200 of those users were either dormant accounts, temporary contractors, or misclassified Limited Professional candidates. That's 40% of their user base operating at the wrong licence level.

Baseline benchmarking works because SAP built the right tools to extract this data—they just never intended you to see the full picture. Your job is to assemble these fragments into a coherent view of your actual usage, classify it correctly against SAP's licensing rules, and negotiate from a position of evidence rather than fear.

Why Your Current User Count Is Likely Wrong

Most enterprises maintain a user count in their financial records that bears no relationship to their actual licence obligation. This happens because:

• User creation is loose: Once a user is created in SAP, they typically persist indefinitely. Employee turnover means accounts sit dormant for months or years.
• User type assignment is inconsistent: Users are often created as Professional by default, then never reviewed. A data analyst accessing query tools and mobile dashboards is classified Professional when Limited Professional is correct.
• Contractor and temporary access is unchecked: Contract workers and temporary system access often get permanent user accounts and remain in the system after engagement ends.
• System integration and batch processes are over-provisioned: Each automated interface, ETL tool, or API connection might have dedicated user accounts that never appear in active user reports.

The baseline benchmarking methodology exposes each of these patterns by cross-referencing multiple data sources and applying systematic classification rules.

The Data Sources: What You Need to Extract

1. Solution Manager USMM (User Master Data Maintenance)

USMM is your primary data source for active SAP user accounts. When you extract the full USMM report from Solution Manager, you get:

• User ID and user type (Professional, Limited Professional, etc.)
• Last login date and last activity timestamp
• User creation date
• License information associated with each user
• User group assignments and role mappings

The critical insight: a user's assigned type in USMM frequently diverges from their actual system usage. A user marked as "Professional" who hasn't logged in for 18 months is a cost reduction candidate. A user marked Professional who exclusively accesses employee self-service portals via mobile is a reclassification candidate.

2. LAW (Licence Agreement Workbench)

LAW is SAP's official licence tracking system. It shows your license entitlements per contract, including:

• Licence quantity and type per named agreement
• Effective dates and expiration dates
• Maintenance and support contracts tied to each licence
• RISE with SAP allocations and cloud licence quantities

LAW is where SAP tracks what you paid for versus what you're actually using. The gap between LAW entitlement and your actual USMM footprint is your benchmark. When LAW shows 6,000 Professional licences and USMM shows 4,200 active Professional users, you have over-provisioning to quantify and potentially reclaim.

3. SLAW (Simplified Licence Agreement Workbench)

For enterprises on RISE with SAP or newer cloud subscriptions, SLAW replaces traditional LAW. SLAW tracks named user consumption in cloud environments and is increasingly the source of truth for hybrid deployments. Many enterprises operate with both LAW (for on-premise) and SLAW (for cloud) running in parallel, requiring reconciliation between both systems.

4. Login Activity Reports

Extracting login activity from SAP security audit logs provides the temporal view that USMM alone cannot. Users who appear in USMM but show no login activity in the past 90 days are candidates for deactivation, not licensing. Login reports should span 12 months minimum to account for seasonal business patterns.

Extracting Data: Step-by-Step Process

The extraction process requires coordination between your SAP team and (often) SAP support:

1. Schedule USMM extraction: Request a full export from Solution Manager. This typically requires SAP_BASIS security and should include all user master fields plus last login date. The export format should be CSV or TSV for easy analysis.
2. Obtain LAW report: Your SAP Licence Administrator can export LAW directly. Request both the licence summary (total quantities per type) and the detailed position statement showing your current contract obligations.
3. Reconcile across systems: If you operate both on-premise and cloud, extract SLAW alongside LAW. Cloud environments may have separate entitlements that don't appear in traditional LAW.
4. Extract login/activity data: Request a 12-month activity report from SAP Security Audit Log (SAL) covering user logins and transaction activity. This identifies genuinely dormant accounts.
5. Document indirect access: Parallel this with a technical inventory of all Fiori applications, mobile access points, and API consumers connected to your SAP system.

This entire extraction process typically takes 2-4 weeks when coordinating with SAP support or your internal team, depending on system complexity and data cleanliness.

User Classification Review: The Core of Benchmarking

Once you have extracted user data, the next phase is systematic reclassification. SAP's user types each carry different licensing implications:

• Professional: Full system access, all transactions, highest cost. Often used as the default, leading to over-licensing.
• Limited Professional: Restricted transaction set, lower cost. Appropriate for role-based users who don't need full ERP scope.
• Developer: Development system access only. Should never appear in production systems in volume.
• Employee: ESS portal access only. Massive cost savings available by reclassifying users who only access self-service, leave requests, and expense reporting.
• FUE (Full Use Equivalent): Not a user type, but an allocation model for RISE with SAP contracts. One FUE entitles you to allocate access across multiple named users.

A typical benchmarking exercise uncovers 15-25% of the user estate as misclassified. The finance team requested the Professional license. The system administrator created a Professional user. Nobody ever asked whether that user actually needed Professional access.

Classification Criteria

Reclassify Professional to Limited Professional when: The user accesses fewer than 200 distinct transactions over a 12-month period; primary functions are recurring transactions (e.g., purchase order entry, invoice processing, material planning); user has no customization or configuration responsibilities.

Reclassify to Employee when: User accesses only ESS portal (leave requests, expense reporting, profile updates, learning modules); no direct ERP transaction access; no reporting requirements beyond personal data.

Deactivate when: Zero logins in the past 12 months; account created for a contractor or temporary project no longer active; user separated from the company but account never disabled.

The classification review is where independent advisors create the most value. SAP's own benchmarking tools show the same data your team has seen, but they don't reframe usage patterns as reclassification opportunities. An external advisor reviews your transaction logs and says "this user is 95% Employee portal access—why does he hold a Professional license?" Your internal team sees the same data but doesn't challenge the status quo.

Indirect Access Assessment

Indirect access—users connecting to SAP without named user accounts—has become SAP's most aggressive audit vector. During baseline benchmarking, you must inventory:

• Fiori applications: How many unique end users access Fiori apps without direct SAP login credentials?
• Mobile applications: Fiori mobile, custom apps, third-party mobile portals connecting to SAP APIs?
• Web services and APIs: Third-party systems integrating with SAP through web services, SAP Cloud Integration, or data APIs?
• Business Intelligence access: BW/Analytics Cloud, Analytics Designer, or embedded BI consumers?
• Electronic Data Interchange: EDI systems and partner portals exchanging documents via SAP without named user interaction?

SAP's position on indirect access is that each unique person or system accessing SAP—even read-only—requires a named user license. In practice, this interpretation would require licensing every employee touching an employee portal, every supplier accessing an invoice portal, and every customer viewing an order status page. The baseline benchmarking process documents your indirect access exposure and creates the foundation for a defensible position if this becomes an audit issue.

Use the SAP indirect access advisory service to systematically map and defend your indirect access position.

Tools and Methodology: SAP vs. Independent Review

What SAP's Benchmarking Tools Tell You

SAP offers integrated benchmarking tools within Solution Manager and SAP for Me. These tools correctly extract and visualize your user data. You can see your Professional user count, distribution of user types, and comparison against industry benchmarks for your company size and industry. This is valuable, accurate data.

However, SAP's benchmarking stops at data visualization. It doesn't reframe the data to expose reclassification opportunities. It doesn't challenge your current licence configuration as suboptimal. It doesn't model the cost impact of reclassifying 200 users from Professional to Limited Professional. And critically, it positions the output as a confirmation of your current position, not an opportunity for negotiation.

What Independent Benchmarking Adds

When we conduct baseline benchmarking for enterprise clients, we add layers that SAP's tools cannot:

• Transaction analysis: We don't just count users. We analyze the specific transactions each user runs, the frequency of access, and the role alignment. This transforms a user list into a classification roadmap.
• Cost modeling: We quantify the financial impact of each reclassification scenario. "If we reclassify 300 misclassified Professional users to Limited Professional, we save $X annually."
• Contract interpretation: We review your specific licence agreement and identify opportunities within your existing contract language that SAP's tools don't surface.
• Audit positioning: We build a defensible audit narrative. If SAP challenges your reclassifications, you have documented methodology, not just data export.
• Negotiation strategy: We position baseline findings as the foundation for contract renegotiation with SAP. "Here's your over-licensing cost. Here's what we're adjusting. Here's our ask for rectification."

The distinction is this: SAP's tools confirm what you already have. Independent benchmarking reveals what you should have.

Interpreting Your Results

Once you have extracted and classified your baseline, the results typically answer these questions:

• How many users do we actually have vs. how many are we licensed for? This gap is your over-provisioning, expressed in licences and cost.
• What percentage of our user estate is misclassified? Typical range: 15-35%. This is your primary reclassification target.
• How many accounts are genuinely dormant? Typical range: 8-20%. These are immediate candidates for deactivation.
• What is our indirect access exposure? Quantified as "X users access SAP indirectly without named accounts." This becomes your risk assessment.
• What is our annual cost opportunity from reclassification and deactivation? Typical ranges vary widely, but enterprises frequently identify 20-35% potential cost reduction.

These metrics form your negotiating baseline when you next interact with SAP—whether that's a licensing review, audit defense, or contract renewal.

From Benchmark to Action

A baseline is only valuable if it drives action. After benchmarking, the next steps typically include:

1. Board-level communication: Present baseline findings to IT leadership and CFO. Quantify the cost opportunity and establish sponsor commitment to implementation.
2. User classification project: Work systematically through misclassified users, applying the classification criteria you developed. Update licence assignments in USMM and LAW.
3. Account deactivation: Schedule deactivation of dormant accounts in phases, coordinating with business stakeholders to ensure no active accounts are disabled.
4. Contract adjustment: Formally notify SAP of your adjustments and file for contract amendment. This is where baseline data becomes your negotiating leverage.
5. Ongoing compliance monitoring: Establish quarterly baseline reviews to prevent licence drift and catch new over-licensing before the next audit.

Organizations that execute against baseline findings typically realize cost reductions within 90 days. Those that generate the baseline but don't act realize nothing—except the certainty that SAP's next audit will find the same over-licensing gaps.

Related Resources

Explore more on SAP licence baseline benchmarking and enterprise optimization:

• The Complete SAP Licence Baseline Benchmarking Guide for 2026 — Comprehensive pillar resource covering strategy, execution, and outcomes.
• SAP Licence Baseline Benchmarking: Key Risks and How to Mitigate — Understanding the audit and data risks of baseline assessment.
• SAP Licence Baseline Benchmarking: Cost Reduction Strategies — Translating baseline findings into measurable cost savings.
• SAP License Optimization Service — End-to-end optimization from baseline through contract renegotiation.
• SAP Licensing Basics — Foundation knowledge on user types, licensing models, and audit mechanics.
• Case Studies — Real-world examples of baseline assessment outcomes and cost recovery.