The Four-Fold Cost: SAP Cloud Migration's Hidden Licensing Trap

LONDON – August 17, 2026 – The great enterprise migration to the cloud is well underway, a multi-trillion-dollar shift promising agility, innovation, and efficiency. For the tens of thousands of organizations running on SAP, this journey often leads to SAP Cloud ERP Private, a modern platform designed for the digital age. Yet, beneath this promise of progress lies a significant financial peril, a hidden trap sprung by a fundamental change in software licensing that can inflate costs exponentially for the unprepared.

The scale of this challenge is coming into sharp focus. Soterion, a specialist in SAP governance and licensing software, announced today it has completed 100 Full User Equivalent (FUE) assessments in the year since launching its SAP License Manager module. This milestone is more than a corporate achievement; it’s a barometer for a widespread and costly problem facing enterprises as they navigate one of the most significant technology transitions in a generation.

The FUE Trap: Paying for Access, Not Action

The source of this financial friction is SAP’s STAR (S/4HANA Trusted Authorization Review) licensing framework. As companies move from the predictable named-user licenses of the on-premise SAP ECC era to the subscription-based cloud, they enter a new world governed by FUEs. Unlike the old model, the STAR framework determines license consumption not by what employees actually do in the system, but by the full scope of permissions they are assigned.

Herein lies the trap. Most companies are migrating with SAP role designs that are a decade or more old, built for functionality and security with little regard for licensing cost. These roles are often bloated with authorizations that users rarely, if ever, use. Under the STAR model, even a single, unused high-level authorization can escalate a user’s classification to the most expensive tier. An analysis from one consulting firm found that self-service users are frequently misclassified as 'core' users, costing five times their actual weight.

Soterion’s findings from its first 100 assessments are stark: legacy SAP role designs typically overstated organizations' FUE requirements by approximately four times. This figure, while startling, is corroborated by wider industry analysis. One expert warns that companies could be “paying 2x or 3x more than necessary,” while another firm’s data suggests FUE counts are commonly inflated by 50% to 150% compared to actual usage. For a company with thousands of users, where licenses can constitute 30% to 60% of the total SAP software investment, this represents a multi-million-dollar vulnerability hidden in plain sight.

From Security Task to Financial Control

This shift fundamentally changes the nature of a once-technical IT function. SAP user authorization, traditionally the domain of security and GRC teams, has now become a critical financial control.

“SAP's STAR rule set is actually very fair. I would even argue that it is relatively lenient,” said Dudley Cartwright, CEO and co-founder of Soterion. “The real challenge is that most organisations have not had the time, or the tools, to redesign their SAP roles with FUE optimisation in mind. As a result, many are consuming more FUEs than necessary.”

This new reality has profound implications for corporate governance. Every change to a user role, every new permission granted, now carries a potential price tag. A seemingly innocuous update to a widely used role could inadvertently trigger a higher license classification for hundreds of employees, creating an unbudgeted and unwelcome surprise for the CFO.

Cartwright puts it succinctly: “SAP role design is no longer just a security consideration. It has become a financial control. Every role change now has the potential to affect both access risk and software licensing costs.”

This forces a necessary, if overdue, collaboration between the CIO, CISO, and CFO. The technical architecture of enterprise software access is now inextricably linked to the financial health and budgetary discipline of the organization. Managing it requires a holistic view that balances operational need, security posture, and fiscal responsibility.

A Market Responds to a Growing Pain Point

The urgency of this issue is amplified by the looming SAP ECC maintenance deadlines. With mainstream support ending in 2027, the push to migrate is intensifying. This deadline acts as a forcing function, compelling companies to confront the FUE model and its complexities. It’s this pressure that fuels the demand Soterion and others in the burgeoning license optimization market are seeing.

“Completing 100 assessments in our first year demonstrates how significant this challenge has become,” Cartwright noted. “As organisations work towards SAP ECC end of maintenance deadlines and migrate to SAP Cloud ERP Private, many are recognising that effective FUE management has become an essential part of a successful migration strategy.”

A new ecosystem of software providers and advisory firms has emerged to help businesses navigate this landscape. Their solutions typically focus on one core principle: creating visibility. By analyzing actual transaction usage data, these tools can contrast it with assigned authorizations, revealing the gap between what is provisioned and what is needed. This data provides organizations with three key metrics: their current license consumption based on their flawed role design, the potential savings achievable through remediation, and the optimized, best-case requirement based on genuine user activity.

Navigating the Migration Minefield

For leaders steering their organizations toward the cloud, the message is clear: proactive management is not optional. The most critical mistake a company can make is to sign a multi-year cloud subscription with SAP based on an FUE assessment of their un-optimized, legacy roles. Once that baseline is set, industry sources confirm it is exceedingly difficult to reduce the committed FUE count until the next renewal, locking in years of unnecessary expense.

The solution is to treat license optimization as a prerequisite for migration, not an afterthought. Before entering commercial negotiations, organizations must gain a clear, data-driven understanding of their true license requirements. This involves a thorough analysis of existing roles, the removal of unused authorizations, and a redesign that aligns access with actual business needs.

Soterion, for its part, offers a complimentary SAP FUE assessment to help organizations establish this informed baseline. This kind of preliminary analysis empowers companies to negotiate from a position of strength, armed with data on their actual needs rather than the inflated estimates produced by legacy bloat.

In the grand narrative of digital transformation, the mechanics of software licensing may seem like a trivial detail. But as countless enterprises are now discovering, overlooking this detail can turn a strategic imperative into a financial quagmire. True resilience in this new landscape is found not just in adopting new technology, but in mastering the economics that govern it.