New SAP licensing model, old challenges

The SAP licensing world is facing major changes: New measurement methods and pricing models for indirect usage, the upcoming S/4 migration, the introduction of numerous new SAP cloud products, and the uncertainties between usage-based and entitlement-based user licensing catapulted SAP customers into the middle of a licensing maze.

Clear definition missing

"I know that I know nothing." - SAP on the subject of indirect use, 2018. Of course, this quote does not exist in this form. However, the fact is: SAP does not provide a clear definition of what exactly indirect use actually is, neither in the GTC nor in the price and conditions list.

It simply states that every user who uses the SAP software - whether directly or indirectly - requires a corresponding license.

How exactly "use" is defined is described in the excerpt from PKL 2018/2 (April 2018), page 13:

"'Use' means the execution of the process functions of the Software, loading, executing, accessing, using the Software, or displaying data resulting from those functions.

Use may be through an interface provided with or as part of the Software, through an interface provided by Customer or a third party vendor, or through another intermediary system."

What does this tell us about indirect usage? Indirect usage cannot be determined with SAP's measurement tools (USMM/LAW). Therefore, SAP requires its customers to determine the need (number and license type) for named user licenses themselves.

The mere fact that there is no clear definition regarding indirect use violates GTC law, which requires clear and understandable wording.

Due to numerous exceptions (e.g., for "static read"), it is also not always one hundred percent comprehensible for which interfaces indirect use might or might not exist.

The number of users and the named-user license types required, depending on usage, cannot be determined manually given the large number of interfaces and third-party applications.

With every analysis, the question inevitably arises as to whether this is not "intended use" after all. After all, a lot of money was spent on the SAP software in the company.

SAP offers the possibility to connect other applications via interfaces as standard. So why should you have to pay extra to use the standard functions?

After all, according to the Software Directive 2009/24/EC, the function of a computer program is precisely to "interact and operate with the other components of a computer system and the users".

So let's assume that in the case of indirect use, acts of use subject to copyright consent take place at all, are these very acts of use then not to be qualified as "intended use" of ERP software within the meaning of the Software Directive 2009/24/EC?

According to this interpretation, they would already be fully compensated with the license fees for the "direct" use of the SAP software.

Always check receivables

In principle, SAP's demand for additional license fees for indirect use should be reviewed and, if necessary, rejected.

Clarify the facts with SAP and record the agreements in writing in your contract. The exception is obvious attempts at misuse, where customers place a non-SAP application next to the SAP systems via which users indirectly access the software functions one-to-one.

For such cases, the number of users and the corresponding license types must be determined. Since the current usage is constantly changing and underlicensing should be avoided at all times, the only remaining option is an automated check of the interfaces and the non-SAP application.

SAP does not provide tools for this, so customers should use an external solution such as LicenseControl for SAP Software. This non-SAP application not only determines the daily requirements for direct and indirect access, but also assigns and manages the corresponding license types automatically and in accordance with the contract.

A Case for the Cartel Office?

With the introduction of the new pricing model for "Digital Access" (April 2018), the additional license requirement for indirect use has not changed. However, the calculation basis has become different.

In the new model, SAP counts the generation of documents triggered by indirect users. Direct access is now referred to by SAP as "Direct Human Access" and indirect access as "Indirect/Digital Access".

The license obligation applies to third-party applications, partner solutions or other devices, but not to SAP's own products. Third-party applications are clearly placed in a worse position than SAP's own applications, such as SAP SuccessFactors or SAP Hybris.

Indirect use of the "Digital Core" is compensated by SAP's own applications with the license fees for direct use of the "Digital Core". Such a distinction could be a case for the Cartel Office.

Indirect use becomes measurable

The following document types must be licensed: Sales Document, Invoice Document, Purchase Document, Material Document, Manufacturing Document, Financial Document, Service & Maintenance Document, Time Management Document, Quality Management Document.

Each document type has an allocation factor. For Financial and Material Documents this is 0.2 and for all others 1.0. Only the initial generation should be cost effective.

Changes, updates or further processing of existing documents will not be charged.

SAP will provide new measurement tools in the future, making indirect usage measurable. In the process, the separation between the counted documents in direct access and in indirect access must be ensured. Otherwise, SAP customers will pay twice.

Example: If a person directly creates documents (e.g. Sales Orders) in SAP and needs an "SAP Professional User" license to do so, will the document be counted? Probably not.

If the same person creates documents through an indirect access via a technical interface (Third Party Applications), are these documents additionally counted? Probably yes, because SAP's measurement tools do not know this person. They only see a newly created document and count it. In the old model, the named user license was sufficient for this.

Existing customers can choose between the old and new pricing models. But how should they proceed? There are many interfaces and applications that indirectly access SAP systems.

For each application, it must be decided whether there is indirect use according to the old or the new model. Then the number (persons and documents) must be determined.

For Named Users, the list prices of the licenses range from €60 (SAP Employee Self-Service Core) to €1300 (SAP Platform User) per user. For SAP Digital Access, the prices per document vary between €0.15 and €0.50 depending on the discount scale.

A mixture of the two models would make sense from the customer's point of view, because some applications are used by many users, while others create many new documents. The decision per application would therefore be welcome.

Use of SAP ERP and Types of Access, Source: SAP.

SAP's new empathy?

Is the new pricing model perhaps to your advantage after all? When presenting the new pricing model, SAP described it as "unique". Both the concerns and the wishes of customers were said to have been taken into account. "Empathy" and transparency were two very big buzzwords here.

SAP has only created transparency for itself, because it can finally measure indirect usage. In addition, there is finally a pricing model to charge for IoT and to secure future sales in the digital age. Not a trace of "empathy".

SAP's measurement tools cannot create transparency. Here, only what has been used is billed, whether authorized or not.

To check this, an external solution is again needed that creates transparency for the customer and can simulate different scenarios. Only in this way can a comparison of the license models be mapped and a strategic decision be made.

Whether the new pricing model should be selected cannot therefore be answered in a blanket manner. However, checking the legality is always recommended.

Attack surface named user

SAP changed the basis for user licensing years ago. Previously, user licenses were to be based on the actual transactions executed.

However, the current GTC and PKL talk about authorizations and "being authorized". If you ask SAP directly on which basis the customers should assign the user licenses, you will get the answer: "Of course according to existing authorizations".

However, this only applies to new SAP customers or companies that introduced SAP for the first time around ten years ago. The situation may be different for older existing customers.

From a legal point of view, it is not clear whether the old usage-based contracts apply without restriction despite subsequent purchases under the new conditions.

In case of doubt, a legal review is required here. This could determine that the latest GTC and PKL valid for the customer at the time of subsequent purchase always apply. Accordingly, all existing customers would also have to assign their user licenses according to authorizations.

However, another possibility is that all contracts apply with both license metrics. However, this would mean that part of the user licenses would have to be licensed according to permissions and the other part according to usage. However, as a customer, being able to distinguish between the two is practically questionable and in any case technically difficult.

The fact is: This year, long-standing existing SAP customers have already been asked to allocate their user licenses based on existing authorizations during the next SAP system survey.

Trust was yesterday

SAP used to leave it up to its customers to decide how to allocate the user licenses they purchased. SAP trusted its customers. The measurement tools only counted the number of user licenses issued.

In the USMM there was the so-called classification help. This was based on which tables the user accessed with his account. If these were - in SAP's opinion - expensive or important tables, the customers should assign the "SAP Professional User" license and not the "SAP Employee User" or "SAP Employee Self-Service User" license.

The USMM is currently being renewed by SAP. In the process, the classification help is also being revised. When this will reach customers depends on the respective SAP release version.

SAP will check which authorizations the SAP account has and then make the statement whether the "SAP Professional User" license should be issued.

However, whether or not the legal review shows that existing customers should be allocated according to usage or authorizations will be settled with the introduction of S/4 Hana at the latest.

Here, the authorizations are clearly defined as the basis for user licensing. The additional level of the so-called solution functions nevertheless complicates the allocation for the customers.

Before migrating to S/4 Hana, SAP roles may need to be adjusted to fit the new S/4 authorization model. The new EU General Data Protection Regulation (GDPR) requires the minimum principle when assigning authorizations.

To protect the integrity and confidentiality of information and data, personal or otherwise, data access should always be limited to as few employees as necessary.

This means that SAP authorizations must only match the activities and tasks that an employee really needs. In practice, however, it has been shown that employees often have many more authorizations than they need for their actual work.

This is not only questionable from a legal point of view, but also from a licensing point of view.

Usage-based or permission-based?

Which basis ultimately applies for the allocation of user licenses should be examined individually by everyone and determined together with SAP. A mixture of usage-based and authorization-based is not recommended in any case and cannot be measured by the SAP system measurement.

If you want to know which of the two models is more favorable for your company, you can consult an external tool such as LicenseControl for SAP.

This simulates licensing according to both models. It also shows the optimization potential for both processes. There are also tool and consulting providers for preparing for the new S/4 world, such as Xiting, which prepare the SAP roles and authorizations for the S/4 migration and implement the required new authorization concepts.

New cloud products and licenses

"SAP brings integrated enterprise to cloud", Bill McDermott, 2014: With this statement, the CEO of SAP already described the clear direction for SAP at the World Economic Forum in February 2014. The effects of the focus on "cloud first" can now be felt more than clearly.

SAP's acquisitions and integrations of cloud-based providers such as Concur, Fieldglass, Hybris, Ariba, and SuccessFactors have contributed significantly to this. For the customer, this results in increased complexity in the design of their system landscape and applied license metrics.

Let's take a look at the current PKL: It turns out that SAP clearly favors the rental and consumption model in the new license models and does not shy away from complexity here. In SAP Ariba alone, for example, there are four different users and 26 consumption-specific metrics.

The combination of existing usage rights such as "SAP Process Orchestration" and new ones such as "SAP Cloud Platform Integration Option" raises further questions, as there are usually several options which the customer can implement technically and map in terms of licensing.

Once the changeover or integration into the cloud has been achieved, things get even more complicated. Maintaining an overview of the various consumption models during operation and identifying optimization potential at the same time is an almost impossible undertaking.

In the end, this means an uncontrolled increase in costs. Sure, what else?

Money from the cloud

SAP wants to make more money with the cloud: Here's how to make sure it's not yours. The ultimate goal for the customer should be complete and end-to-end transparency of current costs, license volume and actual usage.

This is essential for an optimized cost structure and one of the future core tasks in SAP license management. SAP only provides limited support to its customers in this regard, which makes the use of an independent solution imperative.

What does this mean for the use of a tool-based SAM solution for SAP licenses? It must be able to integrate the classic licensing models of the on-premise world on the one hand and cover the increasingly dynamic market of cloud scenarios and the consumption models that exist there on the other.

Make sure that the solution not only provides the current actual status of license consumption, but above all knows the various options for usage rights from the PKL and proactively points out potential savings to the customer.

Conclusion

One thing is certain: The complexity of SAP license management has clearly increased with indirect use, S/4 Hana and the new SAP cloud products. SAP also wants to earn money in the digitized world and with its new products.

As a listed company, of course and understandably, also more money. SAP is trying to create the basis for this with the new pricing model and indirect use.

In doing so, it has also solved the problem that it was previously unable to measure indirect usage. Now it can, if customers opt for the new pricing model. Without this model, the exchange of data between machines and computer programs could not be billed.

However, this is probably not compatible with the existing Software Directive 2009/24/EC. As long as this has not been adapted, it should be thoroughly examined whether SAP's requirements are appropriate.

In the meantime, it is advisable for SAP customers to seek support from experienced IT lawyers and SAP consultants in matters of license management. Existing knowledge of the old SAP licensing world and contracts is no longer sufficient to obtain an affordable SAP contract in the future that is appropriate to usage and legally secure.