How to reduce your SAP FUE License Count before modifying a single role
“Most companies start their license optimization by diving into roles and SoD. But the biggest wins actually happen before that—just by filtering your user population properly.”
— Cyril Hauppert, Founder of Access Informer
You are probably counting too many users
SAP’s new FUE model is built on access—not usage. And the moment you extract your user list for analysis, you’re likely already inflating your license cost.
That’s because most companies hand over their entire user population—including:
- Locked/Disabled users
- Inactive accounts
- Background and system accounts
- Emergency access accounts
Addressing the FUE classification will not have any or much impact on the FUE Licensing.
For example, prior to evaluating FUE licensing, disabled and inactive accounts should simply be stripped out of their assigned roles which will remove their accounts from the FUE calculation.
Under the SAP Digital Access Adoption Program (DAAP), the cost for indirect access from third-party solutions is calculated separately from the FUE and based on the creation of specific documents, including sales orders, invoices, and purchase orders.
“We’ve seen clients hand over 5,000 users for analysis—only to realize 40% of them don’t belong in the licensing model at all.”
— Mark Stanley, SAP Consultant, Pumpkin Consulting
The first Step is to filter your population
At Access Informer, the first thing we do in a license optimization project is to filter out the out-of-scope accounts.
Cyril explains it like this:
“We apply three filters before we even begin any license logic: unlocked users, dialog type users only, and removal of background/system accounts. That simple cleanup drops your FUE exposure immediately.”
These aren’t complex changes. They’re common sense filters:
- Type = dialog accounts
- Status = active/unlocked
- With transaction usage of the last X months (to avoid inactive accounts)
By applying just these filters in a recent client engagement, the eligible user count dropped from 2,900 to 1,080.
That’s a 62% reduction of the scope which will make it much easier to perform the analysis and perform changes that will truly impact the FUE count.
Why most teams miss this
The biggest reason? Most organizations don’t perform the license analysis internally.
License classification is often handled by SAP BASIS or procurement teams—who pull raw user exports and send them directly to licensing partners or upload them to SAP’s license measurement tool.
No risk filtering. No context. No exclusions. No validation.
This leads to inflated numbers and unnecessary licensing recommendations, which then snowball into budget conversations the CISO now has to defend.
“If you start with bad data, everything downstream gets more expensive. Filtering your population is the lowest-effort, highest-return fix you can make.”
— Cyril Hauppert
How to do it the right way
Here’s what Cyril and Mark recommend:
1. Extract a Clean User List
Use snapshot tools or export data that includes user type, status, and activity information. Ignore general tables unless they’re complete.
2. Apply Intelligent Filters
Remove:
- System/background users
- Locked and deactivated
- Technical and service accounts not tied to business process
3. Cross-Check Against Usage
If you want to go a step further, include usage data to identify accounts that haven’t performed any activity in the last 90 days. These may be eligible for deactivation.
You could even perform a more in-depth usage analysis by checking if the accounts have recently created/updated specific documents, such as sales orders, invoices, and purchase orders.
License optimization starts earlier than you think
Most teams jump into rule design, SoD cleanup, or role optimization to reduce their FUE footprint. That work is important—but it comes second.
The real savings start before the first role is modified.
“Think of it like remodeling a house. You don’t start by painting the walls. You start by cleaning the place out.”
— Mark Stanley
