SAP IDM End of Life (2027): Your Options and How to Migrate to midPoint

SAP IDM end of life is fixed: SAP Identity Management 8.0 reaches end of mainstream maintenance on 31 December 2027, and there is no successor product. SAP points customers to SAP Cloud Identity Services and Microsoft Entra ID Governance — both cloud-only. For organisations that need identity governance on infrastructure they control, the practical replacement is midPoint, and the time to start is now: about 14 months remain.

Updated 8 October 2026. Originally published May 2025 as a joint SAP IDM / Microsoft Identity Manager article; MIM now has its own guide. This page focuses on SAP IDM.

What exactly ends in 2027 — and what does not

SAP IDM 8.0 is the last release of the product line. After 31 December 2027 SAP stops mainstream maintenance: no functional updates, no support for new browser or OS versions, no roadmap. Customers can buy extended maintenance until the end of 2030, but that is a holding pattern at a premium — it does not change the destination.

What you keep until then: a working provisioning engine for ABAP systems, the identity store, your workflows and custom scripts, and the people who know them. What erodes every quarter: compatibility with new SAP releases, the availability of SAP IDM skills on the market, and your ability to pass an audit that asks whether a critical ICT system is “supported by the vendor” — a question NIS2 and DORA auditors now ask explicitly.

The reason the deadline matters more than most end-of-life dates is that SAP IDM usually sits at the centre of an SAP landscape: it feeds user and role assignments into ECC or S/4HANA, often into SuccessFactors or GRC, and frequently into non-SAP targets that were bolted on over the years. Replacing it is not a product swap; it is replacing the identity backbone.

SAP’s recommended path and where it falls short

SAP’s guidance is to move authentication and provisioning to SAP Cloud Identity Services (Identity Authentication and Identity Provisioning) and to adopt Microsoft Entra ID Governance for identity governance, under the SAP–Microsoft partnership announced in 2023. For a cloud-first, SAP-plus-Microsoft estate with simple governance needs, that is a coherent answer.

It is a poor fit in four common situations:

• Hybrid and on-premises landscapes. Both services are cloud-only. If your ECC or S/4HANA systems, Active Directory and line-of-business applications stay on-premises, you add a permanent cloud-to-ground dependency for every identity change.
• Non-SAP, non-Microsoft targets. SAP IDM customers typically provision to a dozen or more systems outside the SAP and Microsoft worlds. Those integrations become your problem, usually via custom SCIM endpoints or a third IGA product.
• Governance depth. Role modelling across SAP and non-SAP systems, segregation-of-duties policies that span applications, organisational structures driving approvals — the things SAP IDM customers built over years — are not what Entra ID Governance was designed for.
• Sovereignty. Under NIS2, DORA and KRITIS, moving the system that decides who can access your core ERP into a US-headquartered cloud is a conversation with your regulator, your auditor and your works council. Many European organisations are choosing not to have it.

SAP IDM replacement options compared

Why midPoint is the natural successor for an SAP IDM landscape

midPoint is an open source identity governance and administration platform developed by Evolveum in Slovakia, recognised by Gartner in the IGA category and licensed under Apache 2.0 and the EUPL. It covers everything SAP IDM did and the governance layer SAP IDM never had:

• SAP connectivity. User and role provisioning into ABAP systems (ECC, S/4HANA) through the ConnId SAP connector, SuccessFactors as an HR source or target through its REST/SCIM APIs, and the same framework for the non-SAP systems around them. Connector coverage is validated in discovery, not assumed.
• HR-driven lifecycle. Joiner, mover, leaver processes driven by SuccessFactors or any HR system, with the edge cases — rehires, multiple contracts, long leave — handled in the data model rather than in scripts. See our HR lifecycle write-up.
• Roles and policy. Business roles that span SAP and non-SAP applications, segregation-of-duties rules enforced at assignment time, access certification campaigns, and organisational structures that drive approvals.
• Simulation. Every mapping, role and policy change can be run against production data read-only before it touches an SAP user. For a migration, this is the feature that turns a leap of faith into a reviewable diff.
• Deployment you control. On-premises, in your private cloud, or as a managed service on German infrastructure through IAM Factory. The current feature release is 4.10; the 4.8 LTS line is supported until October 2028.

Where midPoint is not the answer: if your requirement is only authentication for SAP cloud products, SAP Cloud Identity Services alone is simpler. And midPoint rewards design discipline — skipping the data-model phase costs more later. See how it compares with the other open source governance platforms in our open source IGA comparison.

A 14-month plan: from today to a decommissioned SAP IDM

Counting from October 2026, this is the calendar we would run for a typical enterprise SAP IDM estate (one or two ABAP systems, SuccessFactors or another HR source, Active Directory, 5–15 further targets). Smaller landscapes compress it; multi-entity groups stretch it.

The schedule assumes a decision by the end of November 2026. Every month of delay comes off the parallel-build phase, which is the phase that removes risk.

What to carry over, what to leave behind

• Carry over: the business role catalogue (after a clean-up pass — midPoint’s role mining helps), authoritative-source rules, approval responsibilities, the list of target systems and their owners, audit requirements.
• Re-design: workflows. SAP IDM workflows encode years of exceptions; midPoint’s policy-driven model usually replaces most of them with declarative rules, and simulation shows you which exceptions still matter.
• Leave behind: custom JavaScript and scripted attribute logic, manual reconciliation jobs, and anything nobody can explain. If it cannot be described as a mapping or a policy, it is probably technical debt.
• Add: access certification, segregation-of-duties enforcement and self-service requests — governance capabilities SAP IDM customers rarely had, and which NIS2 and DORA now expect.

Experience we bring

Inalogy has replaced legacy identity platforms across Central and Western Europe: DirX at Orange Slovakia (case study), home-grown systems at universities in Namur and Bratislava, and a midPoint programme at the University of Prešov where simulations cut deployment risk measurably (case study). We are one of seven midPoint Gold Partners worldwide, and our engineers present production patterns at the midPoint community meetup.

Frequently asked questions about SAP IDM end of life

When is SAP IDM end of life?

Mainstream maintenance for SAP Identity Management 8.0 ends on 31 December 2027. Extended maintenance can be purchased until 31 December 2030. SAP IDM 8.0 is the final release; there is no successor product.

What does SAP recommend as a replacement for SAP IDM?

SAP Cloud Identity Services for authentication and provisioning, and Microsoft Entra ID Governance for identity governance. Both are cloud-only services; neither runs on-premises.

Can midPoint replace SAP IDM for S/4HANA and SuccessFactors?

Yes. midPoint provisions users and roles into ABAP systems (ECC, S/4HANA) through its SAP connector, uses SuccessFactors as an HR source or target through REST/SCIM, and connects the non-SAP systems around them with the same framework. Connector coverage is confirmed system by system during discovery.

How long does an SAP IDM to midPoint migration take?

Six to fourteen months for a typical enterprise estate, plus procurement. Starting discovery by November 2026 leaves enough time to decommission SAP IDM before the 2027 deadline with a buffer.

What does replacing SAP IDM with midPoint cost?

There is no licence fee. The budget covers discovery, implementation (connectors, role model, migration), an optional Evolveum subscription, and operations — in-house, with a partner, or as a managed service. Unlike per-user cloud subscriptions, the cost does not grow with headcount. See midPoint implementation pricing for the cost drivers and components.

Should we just buy extended maintenance until 2030?

Only as a safety net. Extended maintenance delivers security fixes, not compatibility with new SAP releases or new governance features, and the pool of SAP IDM specialists keeps shrinking. Organisations that use the extra years do so to run the migration properly, not to postpone the decision.

SAP IDM end of life is a decision, not a deadline

The organisations that handle the SAP IDM end of life well treat it as the moment to build the identity governance they always needed — HR-driven lifecycle, a clean role model, certification and segregation of duties — on a platform they control. midPoint gives European organisations that platform without a licence bill and without moving the keys to their ERP into someone else’s cloud.

If you run SAP IDM and have not scoped the replacement yet, reach out. We will assess your landscape — repositories, scripts, targets, data quality — and give you a realistic blueprint and calendar within weeks, including an honest view of whether midPoint is the right fit. What the engagement covers, phase by phase, is on our SAP IDM migration service page.