14 Dec

SAP Indirect Access Licensing As It Is Today

The SAP Indirect Access landscape has changed. Over the past two years, we have seen high profile court cases, the emergence of big disputes through the media, and landmark announcements from SAP on pricing models.

With the Diageo and ABInbev cases allegedly exceeding a combined $675 million it is plausible that since the Diageo case emerged in February 2017 that claims could have topped the $1 billion mark.

In this article, we give our view on all the current market factors with a view to bringing together a balanced view of where SAP customers stand. This is our ultimate guide to SAP indirect access licensing today.

Why listen to JNC? Some of the biggest global SAP users, law firms, and consultancies that we have worked with willingly and consistently testify that JNC is the leading experts in SAP licensing and more specifically SAP Indirect Access.

Indirect Access as it is today

Indirect Access is a bit of an overused phrase. In reality, you have licensed the use of third-party applications interfaced to SAP, and you have unlicensed usage. There is no magic license type for indirect usage, where in fact the SAP price list contains package and named-user license types adequate for the purpose. The challenge is knowing what licensing is and isn’t applicable in each case.

The question normally asked of us is: “do we have any indirect access”. The concern is that if the answer is yes that it’s going to cost you big, which isn’t necessarily the case. It’s highly likely that most medium to large scale enterprise will have third-party systems interfaced to SAP. The question should be “do we have the adequate licensing entitlement for the third-party systems we have interfaced to SAP ERP, and how they are being used”. Guess what, you may already have adequate entitlements or maybe just require more of an existing entitlement.

Practical Example

(Hypothetical)- “Web-Order-Central” enters 250,000 externally created sales orders into SAP in addition to the 250,000 entered directly by named-users. The client has the S&SOP package license (applicable if already on your exhibit) and has an entitlement of 300,000 orders. To many, this is a concern due to the shortfall of 200,000. Whereas in fact it could be adequately licensed usage. Where named-users have the right to enter orders into SAP, a unit of S&SOP is typically only required for externally created orders. So the 250,000 orders created by “Web-Order-Central” are covered by the 300,000 entitlement. This issue can be exacerbated by the fact that standard SAP audit tools typically don’t distinguish internally and externally created orders, measuring 500k orders versus an entitlement of 300k, making it look like a risk when the customer’s contracts and entitlements prove that not to be the case. As this is the Order-Cash-Process, apparently SAP’s new policy is not to charge named-users in this case, only the order processing package licensing is required.

Resolving Claims

JNC resolve most proactive indirect access reviews by establishing either a term of use in the contract that supports the usage in question or a package license or surplus of named-user licenses that are adequate to cover the as of yet unaccounted for indirect usage. In some cases, a customer has the right licenses just not the right quantity and the issue can be resolved without any fuss by simply by buying extra licenses in a smart way, for example as part of another purchase for another purpose. There is no need for concern unless unlicensed usage exposure is identified and to what extent. So the bottom line is don’t accept a proposal for indirect usage licensing unless you have read your contracts and checked existing entitlements.

We have successfully defended numerous indirect access licensing claims by identifying terms of use exist in the contract that caters for the usage in question, that somehow had previously remained undiscovered by SAP and the customer. It isn’t always that simple and sometimes we are required to re-frame SAP’s interpretation of the usage in question by clarifying technical and functionally what’s actually going on and why that doesn’t qualify as unlicensed usage under the terms of the contract. Remember, your contract is King.

So indirect access is a contractual issue first, and an entitlement issue second. If it’s still an issue after that and technical changes aren’t feasible then license fees might then be owed to license the usage compliantly in accordance with your contract. Furthermore, if you honour the trust model (disclosure versus discovery) you can avail of the licensing you require whilst retaining discount privileges. Whereas discovery of unlicensed usage by SAP typically results in list prices taking precedence, which could cost significantly more.

Why does Indirect Access even exist?

I have read a lot of SAP bashing around Indirect Access but I have two important points to make that are fundamentally important. The terms and conditions SAP typically rely on to pursue additional licensing fees for the use of third-party systems interfaced to SAP were introduced into contracts to combat license fee evasion. This is where a firm avoids paying licensing fees to SAP by putting third-party application between a group of users and SAP. The same transactions occur in SAP via an interface, only the users don’t have direct access or an SAP login and so “don’t require a license”. SAP is entitled to protect themselves against such practices. Secondly, SAP is entitled to pursue customers for unlicensed use of their software. There is nothing fundamentally wrong with this so long it is done fairly and proportionately. The issue, in our opinion, is this has not always been the case.

The Duke Memorandum, published by a prominent American IP lawyer sets out a legal argument against indirect access licensing policies as anti-trust and illegal: https://www.corevist.com/duke-law-professor-says-sap-indirect-access-license-fees-illegal/. It remains to be seen how this will apply practically and when and if we will see a case effectively argued on this principle.

It appears, apparently, in my opinion, (disclaimer!) that Indirect Access may have been used as an under-hand revenue-generating opportunity and as a beating stick to influence customers to buy into their SAP HANA and Cloud strategies. What do I mean? Well, it is feasible, potentially, (disclaimer!) that SAP could excuse discovered “non-compliant” use of third-party systems in exchange for investment in SAP HANA and Cloud product licensing in order to achieve broader customer alignment to these strategies. We have seen plenty of customers with unused HANA and Cloud license assets that appeared to be tied to a licensing dispute settlement, sometimes as a result of an indirect access audit.

Haven’t SAP become more “Empathetic”?

If you are familiar with the announcement made by Bill McDermott at SAPPHIRE 2017, you will be aware they changed their rhetoric to being more empathetic whilst also balancing the need to protect IP. They also announced that named-user licensing would not be applicable in order-to-cash and procure-to-pay scenarios. There were also some strange caveats in that announcement like “so long as the customer is otherwise correctly licensed” (Hala Zain’s blog). So what if they aren’t? Back to a free for all? I have also been privileged to a document, allegedly leaked from SAP, upon which this announcement was based. The document uses wording such as “commercialisation” and “strategic pricing”. My view of the announcement and the new “modernised pricing”, is that now they have done so, and satisfied the communities calls for transparent pricing, they will expect all customer to come forward and disclose their potentially unlicensed indirect usage and pay up if indeed additional license fees are required.

Indirect Access is an issue primarily where justifiable claims are not proportionate to the business benefit achieved. Where SAP has gone wrong is that in many cases this has not been the case. Namely Diageo, where the claim totalled £54.5m versus a total enterprise-wide investment of in excess of £60m over a 10-year period. Proportionate? Secondly, indirect access is an issue where claims are made beyond the purpose for which the relevant terms and conditions were designed, which results in anti-competition.

Isn’t it OK now that named-user licensing isn’t applicable?

Not if they build the lost named-user licensing costs into the new package license pricing! Remember only a limited number of business processes have been covered so ask yourself, what of all the other scenarios in which third-party applications can be interfaced to SAP? Furthermore, as I currently understand it, the licensing metric now applicable for O2C indirect usage is Sales and Service Order Execution, i.e not Sales and Service Order Processing, and guess what, the S&SOE license is more expensive!

Rather than IP protection, Indirect Access has become anti-competitive and a commercialisation of digital transformation and innovation. Where companies are legitimately seeking to integrate best-of-breed leading-edge technologies because they are more fit-for-purpose than SAP’s own alternative, SAP is in essence double-charging customers. Where licensing fees for these software products are paid, SAP is expecting additional licensing fees due to them as well.

In our opinion, where a tender process is followed with the objective selection of a suitable software vendor, and SAP lose out, they should, in view of fair competition, accept that and move on. The customer pays the chosen vendor the licensing fees due for use of that software and they should be allowed to interface this system to SAP. End of story.

Sadly, it appears, the threat of Indirect Access is still being used to scare customers away from choosing other vendors. Take Salesforce vs SAP C4C CRM, or Workday vs SAP SuccessFactors, or IBM WebSphere vs SAP Hybris. Mentioning no names, I have been informed by a number of software vendors offering competing products to SAP, that SAP sales people are actively using the Indirect Access threat to scare customers away from competing products. How do the vendors know this? Because their customers are constantly voicing their concerns. Personally, I can’t validate this to be true but generally, there is no smoke without fire.

Top Tips:

  1. Do you need a software tool to deal with Indirect Access? No! But they can be useful for interface discovery. Most of our clients themselves opt for a no-tool approach even though we present the options available.
  2. Don’t make rash architectural changes before 1. checking your SAP contracts to be sure it qualifies, and 2. If it qualifies check entitlements to determine if you have adequate coverage.
  3. Don’t be lured into a false sense of security. We may be witnessing the risk of the mass commercialisation of indirect access so there is, in fact, no better time to take action and understand where you stand.
  4. If you have the S&SOP package license already, don’t be fooled into being lured onto the more expensive S&SOE license! Although if you have S&SOP to cover existing processes be sure to examine the use rights when considering what entitlement you need for any new processes.

In my opinion, terms and conditions and license models have been interpreted in a way that allows for large value under licensing claims to be presented, and then aggressively pursued in order to force quick settlements, which themselves are excessive. Customers are complaining about Indirect Access as being unpredictable and unreasonable. With great power comes great responsibility. In SAP’s case, it’s their responsibility to treat customers fairly. Only time will tell if SAP decides to change their stance on the subject and finally put customers fears to rest.

Get Ahead in 2018

JNC is doing a webinar – “Addressing SAP Indirect Access Licensing Risk”, in partnership with the UK & Ireland SAP User Group on Thursday 25th January 2018, from 10:00-11:00 am. As well as other topics we discuss how SAP customers can run Indirect Access Licensing Risk Assessments internally with minimal external support.

If you are a UK&I SAP User Group member click here to sign-up on the user group website.

JNC UKI SAP User Group Webinar

James Cochlin on EmailJames Cochlin on Linkedin
James Cochlin
Principal Consultant - SAP Licensing and Compliancy at JNC Consultancy
James Cochlin is Principle Consultant and Head of Audit & Compliancy Services at JNC, A company which has been providing SAP License Management services since 2009. In total James possesses over 12 years’ experience in SAP License Management and Auditing with significant knowledge and experience in SAP security, Authorisations and GRC. In the past, James was an SAP License Auditor for Deloitte. As Global Technical Lead James audited clients around the world on behalf of SAP, and was involved in the development of SAP’s License Audit Methodology. Now James works with customers helping reduce their risk of non-compliance, identify cost savings and avoid the pit-falls of licensing SAP estates. Throughout his consulting career, James has worked at some of the largest clients of SAP helping them solve complex licensing problems whilst helping them regain control of SAP Licensing and Compliancy. James continues to train SAP Consultants on SAP licensing to the highest standards, he was the lead architect of a well know SAP Software Asset Management tool, and is held in high esteem internationally as a leading SME and authority on SAP License Management.
Share this