Forum Discussion
Entra ID Governance vs Saviynt for SAP IGA Use Cases
Hi,
I would be careful positioning Microsoft Entra ID Governance as a full one-to-one replacement for Saviynt in SAP-heavy IGA scenarios.
Entra ID Governance is strong for identity lifecycle, access packages, access reviews, lifecycle workflows, HR-driven joiner/mover/leaver processes, and governance of access through Microsoft Entra groups and enterprise applications.
For birthright access, yes, you can model a business role as an access package and use HR-driven logic or auto-assignment to grant bundled access. That can work well if your SAP access model can be represented through Entra groups, app roles, or provisioning into SAP Cloud Identity Services.
Where I would be more cautious is SAP-specific SoD and deep SAP authorization analysis.
Entra can support separation of duties at the access package level, but it is not the same as SAP-native SoD analysis. I would not expect Entra Governance to evaluate SAP authorization objects, field-level values, transaction-level conflicts, or SAP GRC-style risk rules natively.
For SAP Private Cloud / S/4HANA scenarios, I would normally expect SAP GRC, SAP IAG, or a specialized IGA platform like Saviynt to remain part of the architecture if you need preventative SoD checks, SAP role mining, detailed entitlement hierarchy, and deep SAP authorization analysis.
So my view would be:
- Entra ID Governance can be very good as the central identity governance layer.
- It can handle JML, access packages, reviews, approvals, and group/application-based provisioning.
- It can integrate with SAP scenarios, especially through SAP Cloud Identity Services.
- But for deep SAP SoD and granular SAP authorization analysis, I would still validate against SAP GRC/IAG or a specialized IGA solution before replacing Saviynt.
In short: Entra Governance can cover a lot of the identity governance layer, but I would not treat it as a full SAP IGA replacement unless your SAP requirements are relatively simple and mostly group/role assignment based.
Useful Microsoft documentation:
https://learn.microsoft.com/en-us/entra/id-governance/sap
https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-organizational-roles
https://learn.microsoft.com/en-us/entra/identity/saas-apps/sap-s4hana-provisioning-tutorial
Lucaraheller thank you so much for the detailed reponses. A key follow-up based on SOD considering a hybrid IAM solution where Entra does IGA (birthright provisioning to CIS + access request) and Saviynt does SOD for its depth capabilities:
- Can Entra invoke or poll a third-party IAM platform (e.g., Saviynt) during the access request process to perform a preventative SoD check before provisioning?
- If Saviynt performs the deep SoD analysis, does that imply the request catalog/ruleset in Entra would also need to differ, given Entra is primarily requesting CIS groups rather than application entitlements?
Yes, Entra can integrate with Saviynt through custom extensions/Logic Apps, but Saviynt should remain the authoritative SoD decision point for deep SAP risk analysis. And yes, the Entra request catalog should be intentionally modeled around the same business roles or risk-relevant bundles that Saviynt evaluates, rather than using broad CIS groups that hide the underlying SAP entitlement risk.
Follow-up: Hybrid Entra IGA + Saviynt SoD Integration
Thanks Lucaraheller for the responses so far they’ve been very helpful.
The strategy is to move forward with a hybrid architecture, where Entra ID Governance serves as the IGA platform (JML, access requests, provisioning) and Saviynt remains responsible for deep SAP SoD analysis.
Since Saviynt requires direct integration with each SAP application for SoD, our in-scope applications are:
- SAP S/4HANA Private Cloud
- SAP Cloud Identity Services (CIS)
- SAP SuccessFactors
- SAP Ariba
We’re now evaluating the provisioning model from Entra’s perspective. Is there a recommended approach to provision access:
- via SAP Cloud Identity Services (CIS) as the centralized layer, or
- Directly to each individual SAP application?
During a POC last year, we found that the SAP CIS connector did not support importing/reading groups into Entra. As a result, groups had to be manually created in Entra with matching names before provisioning could occur.
If this manual group management is still required across SAP application connectors, it seems more practical to standardize on CIS as the provisioning endpoint.
What are the SAP application connectors and could you kindly share their current capabilities, particularly around group import, provisioning, and synchronization? Any recommendations or lessons learned would be greatly appreciated.