Why a data residency constraint changes the SAP IdM replacement decision
If your SAP IdM renewal or the 2027 end of mainstream maintenance coincides with a requirement to keep identity data on-premises or under EU control, settle that requirement before comparing features. midPoint can run entirely inside your own infrastructure, on Linux in a virtual machine or from Docker images, with PostgreSQL as its repository database. Microsoft Entra ID Governance is a Microsoft cloud service, so its fit depends on a transfer and third-country access analysis that your legal and security teams must complete. The decision is about where identity data lives and who operates the platform afterwards, and feature coverage is only one input.
Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet the conditions in Chapter V. The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, even when staff only view data on a screen for support, and treat storage in a cloud outside the EEA as one too. An identity store holds personal data by definition, so support access, backups and telemetry all need mapping. For US providers, Commission Implementing Decision (EU) 2023/1795 covers only organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Separately, the US CLOUD Act provision at 18 U.S.C. 2713 reaches data in a provider's possession, custody or control wherever it is stored. Ask the vendor to document every storage location and access path in writing, and have your data protection officer assess them.
Operations and exit terms decide who carries the risk after go-live. midPoint has no license fee, so the recurring cost is the servers, PostgreSQL and the team or partner that runs the platform, plus any optional Evolveum Product Support or Platform Subscription, which the vendor sells with an 8x5 next-business-day or 24x7 SLA. With a cloud service, the contract sets the terms. The EU Data Act gives customers the right to switch from a data processing service to another provider or to on-premises ICT infrastructure, with a maximum two-month notice period and a 30-day transition, and it bans switching charges from 12 January 2027 (Articles 25, 29 and 50). Confirm in writing how the Entra terms and your own exit plan line up with those rules, and test a full export of identity data before you sign.
What EU residency and sovereignty rules require of an identity platform
For an identity platform, the question is less where the server sits and more who can reach the data, from where, and under which law. The cards below set out the transfer rules, the enforcement exposure and the legal developments that affect both midPoint self-hosted and Microsoft Entra ID Governance. This is a technical overview, not legal advice, and counsel must confirm the position for your organization.
Every third-country transfer needs a basis
Article 44 of the GDPR requires that every transfer of personal data to a third country, including onward transfers, meets the Chapter V conditions. For SAP IdM replacement, this covers HR feeds, directory copies, audit logs and backups that leave the EEA, not only the production identity store. Map every flow of identity attributes, including those sent to SaaS connectors, before choosing a platform. Confirm the scope with counsel.
Fines for Chapter V breaches
Infringements of Articles 44 to 49 fall in the higher fine tier of Article 83(5), which allows fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. These fines apply to the controller, so the choice of platform and hosting model is a governance decision for the board and the data protection officer, not only for IT. Ask counsel how the fine tier interacts with your contracts with the platform and integration partners.
Remote administrative access counts
EDPB Guidelines 05/2021 state that remote access from a third country is a transfer, even when data is only displayed on a screen for support or administration. A vendor support engineer in a third country who views identity records during an incident therefore triggers the same analysis as a data copy. Check where vendor and partner administrators connect from, how sessions are recorded, and whether support access is limited to approved processes.
Third-country disclosure orders
Article 48 of the GDPR allows a third-country court or administrative order requiring disclosure of personal data to be recognized only where it rests on an international agreement, such as a mutual legal assistance treaty. Combined with the US CLOUD Act provision in 18 U.S.C. 2713, which reaches data a provider controls regardless of location, this matters when a cloud identity service is operated by a provider under foreign jurisdiction. Ask each vendor for its disclosure policy and how it handles conflicting orders.
Schrems II and the Data Privacy Framework
The CJEU invalidated the EU-US Privacy Shield in Case C-311/18 (Schrems II) while upholding standard contractual clauses. Commission Implementing Decision (EU) 2023/1795 finds adequacy for US organizations only if they appear on the Data Privacy Framework List. An appeal in Case C-703/25 P against the General Court's upholding of that decision is pending, so the legal basis for a US-hosted identity service could change. Record the transfer basis you rely on today and the trigger for reassessing it.
Supplementary measures and their limits
EDPB Recommendations 01/2020 state that where a provider needs data in the clear and the destination's public authorities can reach it beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Encryption that the provider can break does not solve this for identity data, which must be processed in clear for authentication and provisioning. Self-hosting in your own EU infrastructure, with keys and administrators you control, removes this dependency. Ask the vendor which party holds encryption keys.
How midPoint and Entra ID Governance each handle SAP connectivity and operations
midPoint is self-hosted software, so the SAP question is also an operations question. The platform is written in Java and uses PostgreSQL as its native repository database, which should run on a separate database server. Every connection to a source or target system goes through the ConnId framework, where each connector is Java code that speaks the target's protocol. The documented connectors cover LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID through the Graph API, SCIM2 and SCIMv1. SAP connectivity is not in that documented list, so it depends on a community or custom ConnId connector that you must confirm before you commit.
- Runtime stack: midPoint recommends Java 25 for version 4.11 and later, with Java 21 supported, and Java 21 for 4.10 and older, with Java 17 supported. Your Java standard decides which release line your platform team can run cleanly.
- Database and nodes: PostgreSQL is the native repository. Multi-node deployments need a sticky HTTP load balancer, a shared central database, cache invalidation between nodes over HTTPS and Quartz for distributed task scheduling. Each of these is a component your team patches and monitors.
- SAP connector status: Confirm whether a maintained ConnId connector exists for the SAP systems in your landscape, who maintains it, which SAP releases it targets, and whether it has supported or community status. If none exists, plan for writing and testing a custom connector, which is an engineering effort with its own maintenance.
- Documented alternatives: Where SAP systems expose LDAP, a directory or a SCIM interface, the documented connectors may cover part of the work. Test each route against a non-production copy of the target before relying on it.
Ask for a demonstration of account create, change and delete against a test copy of your SAP system before you accept the connector plan.
Entra ID Governance is a Microsoft cloud service, so Microsoft operates the platform, including patching, scaling and availability of the governance service under its service terms. SAP and Microsoft both point customers from SAP IdM toward Microsoft Entra, which makes that the path each vendor describes for this migration. Your team's work moves toward configuration, role design, connector integration and identity data flows, and away from maintaining governance servers. Whether that path covers each SAP system you run is a question for Microsoft and SAP to answer in writing before it becomes a design assumption.
- Operations model: Microsoft runs the service, so infrastructure tasks sit with the vendor. Your team still owns policy, access reviews, role definitions and the integration with your HR source.
- SAP path: Ask which SAP products, releases and connector routes the Microsoft and SAP path covers, and whether each route is supported as delivered or needs services work.
- Data location: Confirm in writing where identity data, logs and backups are stored and processed, and what remote access by Microsoft or partner staff involves. Under GDPR, remote access from a third country, even only displaying data, and storage in a cloud outside the EEA count as transfers under the EDPB's guidance, so compare the answer with your residency requirements.
- Hybrid sources: If SAP systems run on premises, confirm which agents or gateways must sit in your network, who installs and operates them, and how they are patched.
Record the SAP connector coverage, data location and support responsibilities in the migration design, with Microsoft's written answers attached, before you select this route.
midPoint, Entra ID Governance and Apache Syncope compared on residency and operations
This table compares midPoint, Microsoft Entra ID Governance and Apache Syncope on residency, licensing, SAP connectors, support and operations. Read each cell as a starting point for questions to the vendor or partner, since several Entra and Syncope details still need confirmation. The main takeaway: midPoint and Syncope can run entirely in your own infrastructure, while Entra ID Governance places data in Microsoft's cloud, so transfer and third-country access questions must be settled before you choose it.
| Criterion | midPoint | Microsoft Entra ID Governance | Apache Syncope |
|---|---|---|---|
| On-premises deployment | Runs on Linux virtual machines or Docker images in your own data centers or air-gapped networks. | Cloud service. Confirm whether any on-premises component is needed for your sources. | Java application you deploy in your own infrastructure. Confirm runtime and database requirements. |
| Cloud hosting and transfer exposure | Stays in-region when self-hosted. Remote vendor access from a third country can still count as a transfer. | Data is stored in Microsoft's cloud. Confirm tenant region, support access locations and Data Privacy Framework status (Case C-703/25 P is pending). | Same position as midPoint when self-hosted. Confirm any vendor support access from outside the EEA. |
| License model | Dual-licensed under EUPL-1.2 and Apache 2.0 with no license fee. Support subscriptions are optional. | Microsoft licensing per tenant. Confirm which license covers governance features and your source systems. | Apache License 2.0. Confirm any commercial support terms with a provider. |
| SAP connector position | Connectors use the ConnId framework. Confirm current status of SAP and SuccessFactors connectors in the catalog. | Confirm which SAP systems connect natively and which need a bridge or custom connector. | Confirm SAP connector availability. SAP-specific integration work may be needed. |
| Support and SLAs | Product Support subscriptions offer 8x5 next-business-day or 24x7 SLAs for product bugs. No prices are listed on the vendor page. | Microsoft support plans apply. Confirm response terms in your agreement. | Community support through the Apache project. Commercial support depends on third parties. |
| Versions and support dates | 4.8 (Curie) LTS is supported until 17 October 2028. 4.10 (Braille) is supported until 26 November 2027. | Cloud service updated by Microsoft. Confirm change notices and release timing for your region. | Version 4.1.3 was released on September 11, 2026. |
| Who operates it afterwards | Your team or a partner runs it. Evolveum or DeployOpen can support it under a written scope. | Microsoft runs the service. Your team manages configuration, connectors and access policies. | Your team or a partner runs it. Confirm whether a vendor offers operational support. |
How to deploy midPoint inside your own infrastructure
This sequence takes midPoint from a residency decision to a tested multi-node platform in your own network, with each SAP connector proven in a non-production environment before any identity data moves. Each step closes with a check you can show to your security and compliance owners.
Confirm residency scope and data classification
Your security, privacy and identity owners list which identity data midPoint will hold, which regions and legal entities it covers, and where administrators and support engineers sit when they open a session. Record which personal data goes to SAP, Entra ID or other targets and whether any third-country access path exists, including remote viewing for support. The output is a signed data classification and residency statement that the deployment design must satisfy before any server is built. Confirm the position with your legal counsel and data protection officer, since DeployOpen prepares the evidence but does not determine your legal basis.
Size and place the PostgreSQL database
midPoint uses PostgreSQL as its native repository, and Evolveum recommends running it on a separate database server rather than on the application node. Your platform team sizes CPU, memory, storage and backup retention against the number of identities, accounts and reconciliation runs you expect, and asks Evolveum's documentation which PostgreSQL versions match the chosen midPoint release. The output is a database host inside your network with encrypted storage, a tested restore and a documented owner. Ask your database team to confirm patching and backup windows before any production data is loaded.
Choose Linux virtual machines or Docker images
Decide whether midPoint runs on Linux in a virtual machine or from the Docker images, based on your existing hypervisor, container platform and patching standards. Both options keep the workload in your infrastructure, so the choice depends on operational skills and change control rather than on identity features. Record the image source, the version pinning method and how configuration files and secrets are injected. The output is a build standard that your operations team can rebuild from scratch, with the Java runtime bundled or managed by a known process.
Validate the Java version for your release
Select the midPoint release first, then match the Java runtime to it. Evolveum recommends Java 25 for version 4.11 and later, with Java 21 supported, and Java 21 for 4.10 and older, with Java 17 supported. midPoint 4.8 (Curie) is a long-term support release supported until October 17, 2028, midPoint 4.10 (Braille) is supported until November 26, 2027, and midPoint 4.11 (Čapek) is a feature release planned for October 21, 2026. Because 4.9 support ends October 18, 2026, avoid it for a new build. The output is a written release decision that names the Java version, the support end date and the upgrade path your governance board has accepted.
Build the multi-node cluster behind a sticky load balancer
For more than one midPoint node, place a sticky HTTP load balancer in front of the nodes, connect all nodes to one shared central database, and confirm that cache invalidation between nodes works over HTTPS. Quartz handles distributed task scheduling, so verify that reconciliation and synchronization jobs run on exactly one node at a time. Test a node failure during a running task, then restart the node and check the job history. The output is a documented failover test with the session behavior, job behavior and recovery time recorded by your operations team.
Keep administration and support access inside the network
Restrict the midPoint administration interface, the database and the connector hosts to your controlled network, with access through your existing bastion, VPN or privileged access controls. Define who may view identity data remotely, which accounts can open support sessions, and how each session is recorded and approved. Evolveum support sessions and any vendor or partner access should follow the same written rule set, and an access path that displays personal data on a screen outside the EEA still counts as a transfer under EDPB guidance. The output is an access register naming each role, each remote viewer and each approval path.
Build and test each SAP connector in non-production
Using the ConnId framework, install the SAP connectors your scope requires in a non-production environment that mirrors the SAP systems, the HR source and the directory targets. Confirm which connector status applies to each SAP system, since integration catalog status ranges from supported to community and experimental, and test create, update, disable and delete operations, plus reconciliation results against sample identities. Compare results with your SAP IdM outputs for the same test population. The output is a signed connector test report listing each operation, each exception and the owner who accepted the residual gaps before production cutover.
Evidence a regulator or auditor will ask you to produce
Whichever successor you choose, the same questions come back during a data protection review or an audit: where personal data flows, who could access it from outside the EEA, and which software versions and connectors were running. DeployOpen prepares this evidence inside your environment, but independent auditors and regulators decide whether it is sufficient.
Records of processing and transfer assessments
Keep the Article 30 record of processing for the identity lifecycle, listing HR sources, target systems, retention and recipients. For each target or support location outside the EEA, record a transfer assessment that follows the Chapter V steps in the GDPR and the EDPB transfer guidelines. Confirm with your data protection officer which transfer tool applies before the cutover date, not after it.
Data flow map from the architecture diagram
Produce one diagram that shows every hop of identity data: HR system to midPoint, midPoint to Active Directory, Entra ID, SAP and other targets, plus database replicas and backups. Mark which hops leave the EEA, including remote support views and cloud storage. Auditors use this map to test whether the transfer register is complete, so it must match the running system, not the design document.
Configuration and version evidence
Record the midPoint release in use, its Java runtime, the PostgreSQL version and the deployment method, along with the configuration files under change control. The releases page lists support end dates per version, so an auditor can see whether a deployed release is still supported. Keep these records dated, because a version that is current today may be out of support at the review.
Administrator and remote support access logs
Retain logs of administrator logins to midPoint, privileged role changes, and every remote support session, including vendor engineers who view screens from a third country. The EDPB guidance treats remote viewing of personal data from a third country as a transfer, so a support log is also transfer evidence. Confirm that logs are protected from the administrators they record and that retention matches your policy.
Connector inventory
List every ConnId connector in use, its version, the target system it reaches, the service account it runs under and the data attributes it moves. Mark any connector that is community or experimental rather than supported, because that status affects who answers for its defects. Review the inventory each time a target system is added, since an unlisted connector is often the first finding in an audit.
Written decision on Entra ID transfer exposure
If Microsoft Entra ID Governance is in the shortlist, document a written decision on its exposure: data residency settings, where identity data is stored and processed, and whether Microsoft could be compelled to disclose it under third-country law. Record the Data Privacy Framework status you rely on and the pending appeal in Case C-703/25 P. Ask Microsoft for its contractual and technical commitments in writing and keep the answer with the decision.
Questions buyers ask before choosing midPoint or Entra ID Governance
What drives the cost of midPoint compared with Entra ID Governance?
midPoint has no license fee, so its cost is made up of the parts you pay for: servers or virtual machines, PostgreSQL, implementation services, connector work, an optional Evolveum support subscription, and the staff who run it. Entra ID Governance is licensed through Microsoft, so the recurring cost follows your Microsoft licensing and user count, while connector and integration work still applies. The one-time costs are design, migration and connector build on both paths. The recurring costs are licenses or subscriptions, infrastructure, support and operations. Ask each vendor or partner to split its quote into one-time and recurring lines, and confirm the current Entra ID Governance license terms directly with Microsoft.
Is there an open-source license cost for midPoint?
No. midPoint is published under the EUPL-1.2 with Apache 2.0 as a secondary license, and Evolveum states there is no enterprise edition with features held back. Evolveum funds development through subscriptions, training and professional services. Its Product Support subscriptions cover resolving product bugs with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions add feature development and roadmap influence. The subscription page lists no prices, so request a quote from Evolveum for the tier you need. Whether you buy a subscription is a risk decision: it depends on how much in-house support you have and how quickly you need fixes.
How long does a migration to midPoint or Entra ID Governance take?
No duration can be given without a scoped inventory, so treat any number from a vendor as unverified until you have one. The main drivers are the number of source and target systems, how many SAP IdM provisioning jobs and approval workflows exist, the quality of your role model, how many SAP-specific connectors must be built or confirmed, and whether both systems must run in parallel. Microsoft's cloud path also depends on tenant design and licensing decisions. Plan the timeline from your own inventory and agree it in writing in a fixed-scope statement of work before work starts.
Can an internal team run midPoint without an outside partner?
A team can run midPoint in-house if it has Java and PostgreSQL operations skills, Linux and container experience, identity domain knowledge and someone who can write or maintain ConnId connectors. midPoint runs on Linux in a virtual machine or from Docker images, and multi-node deployments need a sticky HTTP load balancer, a shared database and distributed task scheduling. The harder questions are who applies release upgrades (midPoint 4.8 is long-term support, 4.10 is a feature release, and 4.9 support ends 18 October 2026), who handles incidents, and who owns the role model after go-live. Many organizations split the work: internal staff run daily operations while an external partner handles build, hardening, upgrades and support on retainer.
What does the client need to provide for the migration?
The work depends on client inputs that only you can supply. Expect to provide a complete inventory of accounts, entitlements, target systems and SAP IdM jobs, the authoritative HR source and its data quality, documented approval rules, and access to test environments that match production closely enough to test deprovisioning. You also need named owners who can decide on role definitions, certification scope and cutover timing. Without these, connector and workflow design stalls. Ask any provider to list these inputs in the written scope so responsibilities are clear before the statement of work is signed.
Are SAP connectors a gap that must be confirmed before choosing midPoint?
Yes. midPoint's documented connectors include LDAP, Active Directory, CSV, DatabaseTable, ScriptedSQL, Microsoft Entra ID through the Graph API, SCIM2 and SCIMv1, and an integration catalog whose connectors range from supported to community and experimental. Do not assume an SAP R/3, S/4HANA or SuccessFactors connector exists at the status you need. Confirm each SAP target and source in the current connector catalog, check its support status and version compatibility with your SAP release, and test it against a non-production system. On the Entra side, confirm which SAP connectors Microsoft supports for Entra ID Governance and whether they cover your SAP landscape. Where a connector is missing, the choice is usually custom ConnId development, an intermediate SCIM or CSV feed, or a different target path.
What should I ask a provider for in a fixed-scope quote?
Ask for a written scope that names each system in and out of scope, each deliverable, the connectors to be built or confirmed, the approval and certification workflows to port, the role model work, the parallel-run and cutover plan, and the decommissioning steps for SAP IdM. Ask for one-time and recurring costs separately, the assumptions behind effort, and what is excluded, such as licenses, infrastructure and Evolveum subscriptions. Ask how the provider handles upgrades after go-live, what support is available as a retainer, and what documentation and evidence you receive. DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted platforms in your own infrastructure, and it works from a written scope with a quote that follows from that scope. It does not issue audit reports or certifications.
Does on-premises or EU hosting change which option fits?
It can. A self-hosted midPoint runs in your own data center, cloud account or air-gapped network, so identity data stays under your control. Entra ID Governance is a Microsoft cloud service, so personal data processed in it may involve transfers to third countries, depending on where data is stored and who can access it. Under GDPR Article 44, every transfer to a third country must meet Chapter V conditions, and remote access from a third country counts as a transfer under EDPB Guidelines 05/2021. Involve your legal and compliance team early, and confirm current data residency and access terms with Microsoft in writing.
Who runs the platform after go-live
The core difference after go-live is who carries the operating work. With midPoint, the customer or a partner runs the platform in the customer's own infrastructure, and Evolveum support is an option rather than a requirement. Evolveum's Product Support subscriptions cover resolving product bugs under an 8x5 next-business-day or 24x7 SLA, while Platform Subscriptions add feature development and roadmap influence. Because midPoint has no license fee, the recurring cost is the staff, servers, PostgreSQL and any subscription you choose. With Microsoft Entra ID Governance, Microsoft operates the service, but your organization still owns configuration, role and policy decisions, and the data those decisions touch. Before choosing, confirm in writing which operational duties each option leaves with your team, including patching, backups, monitoring and incident response.
Upgrade cadence is the first operating decision to plan. midPoint 4.8 (Curie) is a long-term support release supported until 17 October 2028, and midPoint 4.10 (Braille) is a feature release supported until 26 November 2027. midPoint 4.9 support ends 18 October 2026, and midPoint 4.11 is planned for 21 October 2026. Your team, or the partner you engage, must schedule upgrades, retest connectors and align the Java runtime, which midPoint recommends at Java 25 for 4.11 and later. Ask a partner whether a retainer covers upgrades, continuous testing and out-of-hours support, and what it excludes. Entra ID Governance changes arrive on Microsoft's schedule, so the work shifts to reviewing change notices and regression-testing your own workflows and access reviews.
Residency requirements can tighten after go-live, and the platform model determines how much you must change. On midPoint, you control where the servers, database and backups sit, so a stricter rule usually means relocating or re-hosting components in your own environment, plus reviewing any SaaS connectors that send identity data out. On Entra ID Governance, a tighter rule may require assessing whether the service and its data flows still satisfy your obligations, and whether any third-country access or support path conflicts with them. Under GDPR Article 44, any transfer to a third country, including remote viewing for support, must meet Chapter V conditions. Record these exposures now, agree a contractual exit or switching path with your provider, and confirm your legal team's position on the EU Data Act switching rights before signing the next renewal.
How DeployOpen deploys midPoint under a residency constraint
DeployOpen plans, implements, integrates, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, including the cloud accounts, data centers or air-gapped networks where the identity data must stay. For an SAP IdM successor, that means scoping the residency and connector questions first, then building midPoint in the environment the organization controls.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope lists the SAP and non-SAP target systems, HR sources and connector types that midPoint must cover.
- Residency decisions, including where the database, logs and backups sit, are recorded in the scope before any build begins.
How we build
- We install midPoint in the client's own environment on Linux virtual machines or Docker images, with PostgreSQL on a separate database server.
- Connectors are configured and tested against each target system using the ConnId framework, with the connector status confirmed in advance.
- Multi-node deployments, sticky load balancing, scheduling and cache behavior are configured and tested before any source of truth changes.
How we hand over
- Deliverables include configuration, runbooks, connector inventory, role model documentation and the evidence needed for compliance assessments.
- We document parallel-run results and the switchover steps, so the client's team can repeat or audit them.
- Operators are trained on daily provisioning tasks, failure handling and backup restoration in the client's environment.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Upgrades follow the midPoint release schedule, so the client can plan around support end dates for each release line.
- Clients who want an Evolveum support subscription can use it alongside DeployOpen support, and we will confirm which party covers which issue.
