Skip to content
ERP Preflight

IAM Cost Optimizer

Role catalog over-licensing, license tier escalation driver pinpointing, redundant catalog detection, unused authorization minimizer, read-only alternatives, alternative role composition and role-risk comparison with labelled cost assumptions.

Content reviewed September 26, 2026

Engine
IAM_COST_OPTIMIZER
Domain
Operations
Version
1.2.0
Target releases
S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Accepted formats
JSON, CSV

Input contract

Role composition and assignments: JSON {'roles': [{role_name, catalogs, authorizations, assigned_users}], 'users': [...], 'catalogs': [...], 'price_categories': {...}, 'usage_records': [...], 'read_only_alternatives': {app_id: read_only_app_id}} or CSV exports AGR_USERS (UNAME, AGR_NAME), AGR_1251 (AGR_NAME, OBJECT, FIELD, LOW), catalog/app, ST03N usage and read-only alternatives (APP_ID, READ_ONLY_APP_ID).

Required input

  • business roles or user role assignments
  • Cost figures are modeled estimates from price categories (customer-supplied, else a curated seed); every response carries them under metrics.costAssumptions with an explicit disclaimer - they are not a licensing or contract interpretation.

Finding codes

Finding codes (7)

  • IAM_PERMANENT_EMERGENCY_ROLEDefault severity: CriticalCategory: EMERGENCY_ACCESS_GOVERNANCE

    Emergency role assigned without end date

    Remediation: Delimit the emergency / firefighter role assignment (SU01 / Identity Provisioning) and route access through an approved emergency access process with logging.

  • IAM_LICENSE_TIER_INFLATION_DRIVERDefault severity: MajorCategory: LICENSE_OPTIMIZATION

    Single app raises the role's license tier

    Remediation: Move the tier-raising app into a separate, narrowly assigned role so the remaining users stay on the lower (Core / Self-Service) tier.

  • IAM_REDUNDANT_CATALOG_DETECTEDDefault severity: MajorCategory: ROLE_COMPOSITION_GOVERNANCE

    Catalog fully contained in another catalog of the role

    Remediation: Remove the redundant business catalog from the role (PFCG / 'Maintain Business Roles'); its apps are already granted by the superset catalog.

  • IAM_ROLE_RISK_ELEVATEDDefault severity: MajorCategory: LEAST_PRIVILEGE_COMPLIANCE

    Role carries more risk than an equivalent role granting the same apps

    Remediation: Assign the lower-risk equivalent role instead, or remove the additional critical authorizations / emergency flag from this role - both roles grant the same apps.

  • IAM_UNUSED_CRITICAL_AUTHORIZATIONDefault severity: MajorCategory: LEAST_PRIVILEGE_COMPLIANCE

    Critical authorization never used

    Remediation: Revoke the unused critical authorization object from the role or provide it via firefighter / PAM access only.

  • IAM_ALTERNATIVE_ROLE_COMPOSITIONDefault severity: MinorCategory: ROLE_COMPOSITION_GOVERNANCE

    Smaller catalog composition covers all used apps

    Remediation: Rebuild the role from the proposed catalogs (the dropped catalogs contribute no app the assigned users executed); validate the proposal with the role owner over a full business cycle before removing catalogs.

  • IAM_READ_ONLY_ALTERNATIVE_AVAILABLEDefault severity: MinorCategory: LEAST_PRIVILEGE_COMPLIANCE

    Change app never used although a read-only alternative exists

    Remediation: Replace the change app by its read-only alternative in the role (or move it into a narrowly assigned role) - the assigned users only need display access according to the usage data. Re-check after a full business cycle of usage data.

Input validation codes (5)

  • IAM_ARCHIVE_REJECTEDDefault severity: MajorCategory: INPUT_VALIDATION

    Archive rejected by ingestion safety limits

    Remediation: The archive exceeded the 100:1 expansion ratio, 500 MB total size, entry-count or 2-level nesting limit, or contained path traversal / encrypted members. Upload a flat, unencrypted archive of the export files. No verdict was produced. Re-export the artifact in one of the formats accepted by IAM Cost Optimizer (JSON, CSV) and re-run the analysis.

  • IAM_INVALID_INPUTDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact does not match the engine input contract

    Remediation: Provide the artifact type documented for this engine; unrelated or structurally invalid documents are rejected. No verdict was produced. Re-export the artifact in one of the formats accepted by IAM Cost Optimizer (JSON, CSV) and re-run the analysis.

  • IAM_PARSE_ERRORDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact could not be parsed

    Remediation: Fix the syntax error at the reported line/column (or re-export the file unmodified from SAP). No verdict was produced. Re-export the artifact in one of the formats accepted by IAM Cost Optimizer (JSON, CSV) and re-run the analysis.

  • IAM_PAYLOAD_TOO_LARGEDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact exceeds the size limit

    Remediation: Split the export (e.g. per package, company code or date range) so each upload stays under the service payload limit. No verdict was produced. Re-export the artifact in one of the formats accepted by IAM Cost Optimizer (JSON, CSV) and re-run the analysis.

  • IAM_INSUFFICIENT_INPUTDefault severity: InfoCategory: INPUT_VALIDATION

    Required input missing

    Remediation: Supply every input the engine's contract marks as required (see the engine catalog entry). No verdict was produced. Re-export the artifact in one of the formats accepted by IAM Cost Optimizer (JSON, CSV) and re-run the analysis.

Back to the documentation
IAM Cost Optimizer — ERP Preflight Docs