SAP Identity Management (SAP IdM) is SAP's on-premises identity lifecycle product, with end of mainstream maintenance in 2027. Pages here cover replacing it with self-hosted midPoint or Apache Syncope.
Comparing SAP IdM with midPoint for organizations whose identity landscape spans SAP and non-SAP systems: provisioning model, SAP R/3 and SuccessFactors connector status, approvals and certification, the open source license and support subscriptions, and long-term maintenance.
For SAP IdM customers who mostly provision accounts and run self-service: Apache Syncope's ConnId connectors, REST API, admin and end-user UIs and SSO component compared with SAP IdM, and the SAP-specific integration work Syncope would need.
Moving SAP IdM to midPoint scenario by scenario: HR source integration, SAP and non-SAP target systems, replacing SPML provisioning with SCIM or connectors, porting approval workflows and role models, running both systems in parallel and decommissioning SAP IdM before maintenance ends.
SAP ends mainstream maintenance for SAP IdM in 2027 and points customers to Microsoft Entra. This page sets out the timeline, the inventory to take now, the options (Entra ID Governance, midPoint or another IGA product) and how to stage the migration so provisioning never stops.
Choosing a successor for SAP IdM between the cloud path SAP and Microsoft recommend and a self-hosted open-source IGA: on-premises and sovereignty requirements, SAP connectors on each side, licensing model, and who operates the platform afterwards.
Cost components for replacing SAP IdM: SAP extended maintenance or a new license, migration services, connectors for SAP and non-SAP systems, against midPoint with no license fee, an optional Evolveum subscription, servers, PostgreSQL and the team that runs it.
For organizations that used SAP IdM to bring employees in from SAP SuccessFactors: how midPoint takes over HR-driven joiner, mover and leaver processing with the community SuccessFactors connector or a CSV or SCIM feed, and what to test before switching the source of truth.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.