Your SAP system already holds most of the data an Effective Licence Position needs. The difficulty is extraction, normalisation and two specific traps — duplicate accounts across systems, and users who never log in but still consume a licence.
Your SAP system already records a large proportion of the data needed to produce an Effective Licence Position. That is the good news, and it is genuinely good news — you are not starting from nothing.
What it holds includes details of all your:
The difficulty is that this information has to be extracted, normalised — put into a format that removes duplication and is actually readable — and collated before it is usable at the next stage of building an ELP. That work is where SAP licensing gets hard, and it is where most of the money is lost.
There are three basic user licence types underpinning SAP applications.
Professional User. A named user able to perform operational tasks — system administration, system management and similar roles — within the agreed licence metrics. The user also holds the rights specified for the Limited Professional user. This is the default type, assigned automatically if no other type is specified when the user is set up, and it is one of the most expensive.
Limited Professional User. A named user who can perform the limited operational roles defined by the software licence.
Employee User. A named user able to perform tasks purely for their own use and not on behalf of anyone else, again as set out by the licence.
The default is the thing to notice. Every user created without a deliberate licence assignment lands on the most expensive type available. Nobody has to make a bad decision for the cost to appear.
Editor’s note, July 2026. This post describes the licence type structure as it stood in 2016. SAP’s named user catalogue has been revised since, and indirect use — which the named user model handled badly — is now addressed by the document-based Digital Access model SAP introduced in 2018. Treat the three types above as the shape of the problem rather than a current price list. Check your own agreement: the definitions that bind you are the ones in it, not the ones in the general catalogue.
Two things during normalisation have a disproportionate effect on your final position.
A single user can hold accounts on several different systems. SAP licences on a per named user basis, so that one person should consume one licence — not four.
If duplicate identities survive into your final inventory, you are counting the same human being multiple times and paying for the privilege. De-duplicating across systems is not a tidy-up task; it is one of the largest single corrections most organisations make.
These are users who have not accessed your SAP system for a specified number of days, or who have never accessed it at all.
It is common practice to create a new user ID when someone joins. It is far less common for anyone to review those IDs afterwards. They accumulate. And although the account is inactive, it is still consuming a licence — a licence that could be freed and reassigned to somebody who needs it.
Identifying these accounts is straightforward once you are measuring actual usage rather than reading allocation. Doing something about them is where the saving is.
The whole task can, in principle, be completed manually. In practice it cannot.
Most SAP landscapes run to many thousands of users across multiple packages, frequently spread across countries or worldwide. A manual reconciliation of that scale is out of date before it is finished — you are producing a snapshot of a position that has already moved.
The work also has to be repeatable. An ELP produced once, heroically, does not protect you eighteen months later when the true-up arrives.
CerteroX SAM includes a dedicated SAP licence engine — one of six publisher engines, alongside Microsoft, Oracle, IBM, Adobe and Salesforce. It exists to turn the two problems above into a routine.
It reads SAP without touching production. A non-invasive ABAP connector pulls named users de-duplicated across systems, together with roles, role groups, engines and authorisation definitions. The de-duplication is done at read time, so the multiple-accounts problem is solved before it reaches your position rather than after.
It transposes your agreement into rules. Priority-ordered Analysis Rules encode the licence definitions you have actually agreed to, then apply them against what each user’s roles and authorisations permit. The output is your current position, a suggested position and an optimal position, side by side. That comparison is the point — knowing you are compliant is worth much less than knowing what compliant could cost instead.
It measures usage rather than allocation. AppsMonitor records first-used and last-used dates and reports a utilisation figure over a rolling 90-day window, which is how dormant and never-used accounts become a specific list rather than a general worry.
It produces the position continuously. Purchased, used, available, required, variance and exposure, with overspend and additional-licence-required calculated alongside — recalculated as the data changes rather than assembled when someone asks.
SAP licensing is difficult because the data is spread across systems, the default assignment is the expensive one, and nobody reviews accounts once they are created. None of those are exotic problems. They are just tedious ones, and tedium at scale is what tooling is for.
Extract, de-duplicate, measure the usage, apply your agreement’s rules, and compare current against optimal. Then negotiate from the second number.
Book a demo, or read more about CerteroX SAM.
Other posts covering the same ground.
An Oracle Unlimited Licence Agreement is only unlimited within its clauses. What certification actually asks of you, where toxic consumption creeps in, and why the measurement work has to start at the beginning of the term rather than the last six months.
Microsoft's August 2025 Product Terms changes: Extended Term standardised across programmes, Exchange and Skype for Business Server Subscription Editions, the Exchange and Windows 10 ESU programmes, and the Dynamics 365 F&O enforcement dates.
Renew, rescope or exit — an Oracle ULA gives you three routes and a narrow window to choose between them. The questions to settle first, and a six-point health check to see how ready you actually are.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.