The deadline is 2027. The security work is 2026.
SAP mainstream maintenance for ECC ends on 31 December 2027. Authorizations are the workstream most often scheduled last and most often blamed at go-live. There are four reasons it does not fit at the end.
Four reasons it cannot wait
The object model changed
S/4HANA is not ECC with a new database. Transactions were merged, retired or replaced by apps. Authorization objects moved and new ones appeared. A role copied forward may still activate cleanly and still grant the wrong thing, because the check now happens somewhere else. Roles that pass a technical check are not the same as roles that pass an audit.
Fiori doubles the surface
Classic security was one layer: the backend. Fiori adds catalogues, groups, spaces, pages, tiles and the OData services behind them. A user needs backend authorization and launchpad content, and the two are maintained in different places by different people. Designed together they are coherent. Designed separately, users either see tiles that fail or hold access nobody intended.
Controls need rewriting
SoD rulesets written for ECC reference transaction codes that no longer carry the risk. Mitigating controls written against those transactions stop being evidence of anything. Both need rebuilding against the S/4HANA object model, and that is a business conversation about who may do what, not a technical mapping exercise.
BTP adds a second estate
The moment a programme extends onto BTP there is another identity model to govern: identity providers, role collections, subaccount boundaries, destinations, API access. These decisions are cheap at the start of a programme and expensive to unwind after three teams have each solved them differently.
What delay costs
None of these are hypothetical. They are the pattern in programmes that schedule security late.
Defects surface in integration testing
When there is no float left in the plan
Cutover access is granted wide
To keep the business moving, and it stays wide
The first audit finds it
The exposure you already knew about
Remediation happens in production
On a live business, at the worst rate
Questions we get asked first
The four objections that come up in almost every first conversation.
Doesn't SAP Readiness Check cover this?
Readiness Check tells you about simplification items and technical conversion effort. It does not tell you whether your role model is fit for the target system, where your SoD exposure sits, or how your Fiori content should be structured.
Our SI says security is in scope
Often it is, as a line item. Ask who is named against it, how many days are allocated, and which phase those days sit in. The answer usually explains why the workstream slips.
Can't we just copy the roles?
You can copy them. What you cannot do is assume they still mean what they meant, and copying carries every design compromise made in ECC into a system you will run for the next decade.
We haven't chosen a migration path yet
Then this is the right time. Brownfield and greenfield produce very different security work, and knowing the difference in cost is useful input to that decision.
Start with Phase 01.
A fixed-price baseline assessment tells you where you actually stand before you commit budget to a workstream.