1. Introduction: Why Named User Types Are a CIO Liability
SAP Named User Type Comparison at a Glance
| User Type | ECC Name | S/4HANA Name | Access Scope | Relative Cost | Typical Role |
|---|---|---|---|---|---|
| Professional | Professional User | Professional Use | Unrestricted — all modules | 100% (highest) | Finance controller, SAP admin, power user |
| Limited Professional | Limited Professional | Functional Use | Single functional domain | ~50% of Professional | AP clerk, purchasing agent, warehouse supervisor |
| Employee | Employee Self-Service | Productivity Use | Self-service only | ~15% of Professional | Timesheet entry, expense reports, leave requests |
| Developer | Developer | Developer | Build & configure only | Separate pricing | ABAP developer, Basis admin |
| Test | Test User | Test User | Non-production only | Lowest tier | QA tester, UAT participant |
Named user licence fees represent the single largest controllable cost in most SAP estates. For a typical 1,000-user enterprise, named user spending often exceeds €3–5 million annually, rising to €3.6–6.1 million when annual support (22% of net licence value) is factored in.
The problem is structural: SAP's user type hierarchy — Professional User, Limited Professional User, Employee Self-Service, Developer User, and Test User — creates a cost cliff. Misclassify a user upward and you pay for access rights they may never exercise. A single user misclassified at the Professional tier costs an additional €2,000–€3,500 per year in licence fees, plus €440–€770 in annual support.
Misclassification is the number-one SAP audit finding. Our audit defence experience shows that 70–80% of large enterprises have audit findings related to named user type assignment. The consequences are severe: SAP escalates misclassified users to the appropriate tier, back-charges three years of maintenance at the difference, and often uses the audit to reset your entire licensing position at a higher cost level.
The second critical liability: S/4HANA migration. SAP's cloud-native strategy involves renaming and restructuring user types entirely. Professional User becomes Professional Use; Limited Professional becomes Functional Use; Employee Self-Service becomes Productivity Use. During migration, SAP re-baselines your entire user estate — often upgrading users to justify higher pricing.
This guide provides CIOs with comprehensive knowledge of SAP's user type hierarchy, cost structure, audit risk, and the steps required to establish and maintain a defensible, cost-accurate licensing position.
2. The Complete SAP Named User Type Hierarchy
Professional User (SAP ECC and On-Premise Systems)
Professional User is the highest-cost tier. It grants unrestricted access across all SAP modules and all business functions. There are no restrictions on transaction codes, module access, or functional area.
Appropriate for: Finance controllers, SAP system administrators, business process owners, power users who span multiple functional areas, executive dashboarding and analytics roles, anyone requiring real-time transaction capability across the enterprise.
Cost: List price typically €3,000–€5,000 per user per year. Enterprise contracts typically discount this 40–60%, resulting in net cost of €1,200–€3,000 per user per year. Support is calculated at 22% of net licence value.
Misclassification risk: This is the most common over-classification. Many enterprises default users to Professional type out of caution, fearing that restriction to a lower tier will create workflow friction. The result: 20–35% of Professional User assignments are not justified by actual transaction usage.
Limited Professional User (SAP ECC and On-Premise Systems)
Limited Professional User is the mid-tier option. It restricts users to one or two functional areas (modules). A Limited Professional User can access all transactions within their assigned modules but cannot access transactions outside those modules.
Appropriate for: Accounts Payable clerks (restricted to FI/AP modules), purchasing agents (restricted to MM/PR modules), warehouse supervisors (restricted to MM/WM modules), payroll specialists (restricted to HR/PA modules), functional controllers working in a single module.
Cost: List price typically €1,500–€2,500 per user per year (approximately 50% of Professional User). After enterprise discounts (40–60%), net cost is €600–€1,500 per user per year.
Module restrictions: SAP maintains a master list of which transaction codes are available to Limited Professional Users in each module. This list is updated quarterly with new SAP releases. A user assigned Limited Professional but executing transactions outside their permitted modules triggers an audit finding.
Employee Self-Service User (SAP ECC and On-Premise Systems)
Employee Self-Service is a restricted tier intended for personal, non-operational transactions. Users are limited to transactions related to their own data and personal requests: timesheet entry, expense report submission, leave request entry, pay slip viewing, personal information updates.
Appropriate for: Employees entering their own timesheets and expense reports, any non-supervisory user with no operational workflow responsibilities, general workforce accessing personal data only.
Cost: List price €300–€600 per user per year (approximately 10–15% of Professional User cost). After discounts, net cost is typically €120–€360 per user per year.
Transaction restrictions: Employee Self-Service users cannot execute operational transactions (create purchase orders, post invoices, approve payments, manage master data). Attempting these transactions triggers an access violation and an audit flag.
Developer User
Developer User is a technical tier for SAP consultants, ABAP developers, functional configuration specialists, and system administrators who build and configure SAP systems in development and test environments.
Appropriate for: ABAP development, system configuration, custom report development, process design and implementation, testing new functionality.
Cost: Developer User licences are typically not included in standard named user contract caps. They are often separately negotiated or purchased as add-on modules. List pricing varies widely (€2,000–€4,000 per user per year) depending on the contract structure.
Environment restriction: Developer User access should be limited to development and test systems. Running a Developer User in production is an audit violation and indicates mismanagement of system access controls.
Test User
Test User is a low-cost tier for non-production testing and training environments. Test Users have similar access to Professional Users but are restricted to non-production systems.
Appropriate for: User acceptance testing (UAT), training and enablement programs, system demos and proof-of-concept activities.
Cost: Test User licences are heavily discounted (often 50–70% off Professional User cost) because they are restricted to non-production. Some contracts include Test User access at a flat fee per system rather than per user.
Critical caveat: Many enterprises over-license test environments. A common mistake: creating a full copy of the production user base in the test system. This inflates Test User costs unnecessarily. Best practice: use only the users required for the specific testing activity, then deactivate them when testing concludes.
3. S/4HANA User Type Changes: What CIOs Must Know
S/4HANA represents a fundamental restructuring of SAP's licensing model. SAP has renamed user types and changed how they are measured, effective for all new S/4HANA contracts and migrations.
The Name Changes
- Professional User (ECC) → Professional Use (S/4HANA): The highest tier in S/4HANA. Functionality similar to Professional User, but measured under S/4HANA's new cost structure.
- Limited Professional User (ECC) → Functional Use (S/4HANA): The mid-tier in S/4HANA. Restricted to specific functional areas, but with expanded capabilities compared to ECC Limited Professional.
- Employee Self-Service (ECC) → Productivity Use (S/4HANA): The self-service tier in S/4HANA. Covers personal transactions plus some task-based access.
The Re-Baseline: Your Biggest Migration Risk
When you migrate to S/4HANA, SAP re-baselines your entire user estate. This is not automatic. SAP's negotiating position is that all users must be re-measured against S/4HANA's user type definitions, and many users will be upgraded due to functional changes in S/4HANA's module structure.
Here is what typically happens: You have 500 Limited Professional Users in ECC. During migration, SAP claims that S/4HANA's expanded module integration means these users now require Professional Use access. They upgrade 30–50% of your Limited Professional users to Professional Use and add the incremental cost to your migration contract.
The consequence: your post-migration licence cost increases by 15–25%, and SAP's negotiating position prevents you from challenging the re-baseline because "the contract requires re-measurement."
Pre-Migration User Audit Is Mandatory
Any enterprise planning S/4HANA migration must conduct a detailed user audit before migration. The steps:
- Extract your current ECC user list with transaction-level usage data (ST03N analysis).
- Map each user's actual transactions to S/4HANA's functional equivalents.
- Identify downgrade candidates before migration (users over-classified in ECC).
- Lock in a contractual user type baseline as part of your migration agreement — do not allow SAP to unilaterally re-baseline after migration begins.
The timing is critical: complete the user audit 6–12 months before migration go-live. Use the audit results to negotiate a locked baseline in the migration statement of work. This prevents SAP from escalating users post-migration.
FUE (Full-Use Equivalent) — The New S/4HANA Cloud Metric
For S/4HANA Cloud (SAP's newest cloud ERP offering), SAP has introduced FUE (Full-Use Equivalent), a weighted metric that combines multiple user types into a single normalized unit. One FUE might equal 1.0 Professional Use + 0.6 Functional Use + 0.1 Productivity Use.
FUE pricing is typically €4,500–€6,000 per FUE per year. For cloud-only deployments, this can be more cost-effective than traditional user-by-user pricing. However, FUE terms vary significantly by contract, so detailed analysis is required before committing to cloud.
4. DDLC and Named Users: Understanding the Two Separate Dimensions
A critical point of confusion in SAP licensing: the relationship between named user licensing and DDLC (Digital Document Licence Compliance).
Named user licensing: Covers humans logging into SAP directly and executing transactions in the SAP application. Each named user is assigned one of five types, each with specific access rights.
DDLC (Digital Document Licence Compliance): Covers non-SAP systems, automated interfaces, and external applications that access SAP data indirectly. DDLC is document-based pricing: you are charged based on the number of documents (sales orders, purchase orders, invoices, goods receipts) processed through indirect interfaces.
These are completely independent licence dimensions. Reducing your named user count does not reduce DDLC exposure. Optimising named user types does not reduce DDLC liability. Both must be audited and managed separately.
The Five DDLC Document Types
DDLC measurement is tied to five specific document types that flow through indirect access interfaces:
- Sales Orders: Created by e-commerce systems, EDI feeds, or third-party order management platforms.
- Purchase Orders: Created by procurement platforms or supplier networks integrated with SAP.
- Supplier Invoices: Received through EDI, AP automation platforms, or vendor portals.
- Goods Receipts: Generated by warehouse management systems or logistics partners.
- Customer Invoices: Created by billing systems or e-commerce platforms that generate SAP invoices.
If your e-commerce system creates 500,000 sales orders annually in SAP via API, that is 500,000 DDLC document exposure. If your supply chain automation platform posts 300,000 goods receipts annually, that is 300,000 additional DDLC exposure. The total DDLC liability is 800,000 documents per year, independent of how many named users you have.
How DDLC Affects Your Total SAP Cost
DDLC pricing varies by contract but typically follows a tiered model:
- 0–100,000 documents per year: typically included in base contract.
- 100,000–500,000 documents: incrementally priced at €0.05–€0.20 per document.
- 500,000+ documents: negotiated volume rates, typically €0.02–€0.10 per document.
For a 1-million-document DDLC estate, costs can exceed €50,000–€100,000 per year, depending on contract terms. Add 22% annual support, and DDLC becomes a material cost driver alongside named user licensing.
Named users and DDLC are independent cost dimensions. Comprehensive licence audits must address both to establish true cost exposure.
Learn how Redress Compliance audits both dimensions across 500+ engagements.5. Audit Risk: How SAP Measures Named Users
USMM: User and System Measurement
USMM (User and System Measurement) is the tool SAP uses during contract audits to count and classify active named users. USMM runs in your SAP system and extracts a snapshot of the user estate on a specific date (typically December 31, SAP's fiscal year-end).
The audit process: SAP's audit team runs USMM in your system, compares the output to your current licence contract, and identifies any discrepancies. If USMM shows users executing transactions above their assigned licence type, SAP escalates them to the correct tier and back-charges three years of maintenance fees at the difference.
Example audit scenario: You have 50 users assigned as Limited Professional User in your licence contract. USMM shows that 15 of these users have executed FI/CO transactions (which require Professional User access). SAP upgrades these 15 users to Professional User retroactively, and back-charges three years of the cost difference (typically €15,000–€30,000 for 15 users at €1,000–€2,000 per year per user for three years).
How SAP Identifies Misclassification
USMM extracts two data points per user: (1) the assigned licence type from your contract, and (2) the top-20 transactions executed by that user over the measurement period. SAP's audit team maps each transaction to the minimum licence type required to execute it.
If a user's actual transaction profile exceeds their assigned licence type, SAP flags the user as misclassified. Common scenarios:
- Limited Professional assigned, but executed FI/CO transactions: FI/CO access requires Professional User. User is escalated.
- Employee Self-Service assigned, but created purchase requisitions: PR entry requires at least Limited Professional. User is escalated.
- Developer User in production system: Developer User should only be active in development/test. Production Developer User activity is flagged as misclassification.
Audit Preparation: Run USMM Quarterly
The single best defence against audit findings is to run USMM internally at least quarterly. This gives you the audit view before SAP does.
When you run USMM internally, you see exactly which users are executing transactions above their assigned type. You can then:
- Reassign the user to the correct licence type before SAP's audit.
- Document business justification for the current assignment.
- Prepare audit defences with audit evidence (transaction logs, manager sign-off, functional justification).
The second-order benefit: you can use internal USMM data to negotiate with SAP during renewal discussions. Accurate user count data eliminates SAP's ability to escalate during the audit window, which removes their leverage in renewal negotiations.
6. Cost Structure: What Each User Type Actually Costs
List Pricing vs. Net Pricing vs. Total Cost of Ownership
SAP publishes list pricing for each user type, but actual cost depends on enterprise discounts, which typically range from 40–60% off list. Additionally, annual support costs must be factored in: 22% of net licence value per year.
Professional User:
- List price: €3,000–€5,000 per year
- Net price (after 50% discount): €1,500–€2,500 per year
- Annual support (22% of net): €330–€550 per year
- Total cost of ownership (five-year contract): €9,150–€15,250 per user
Limited Professional User:
- List price: €1,500–€2,500 per year
- Net price (after 50% discount): €750–€1,250 per year
- Annual support (22% of net): €165–€275 per year
- Total cost of ownership (five-year contract): €4,575–€7,625 per user
Employee Self-Service User:
- List price: €300–€600 per year
- Net price (after 50% discount): €150–€300 per year
- Annual support (22% of net): €33–€66 per year
- Total cost of ownership (five-year contract): €915–€1,830 per user
The Compounding Effect of Misclassification
A practical example: 500-user enterprise with 300 users assigned Professional instead of Limited Professional User.
- Net overspend: 300 users × €750–€1,250 (difference between Professional and Limited Professional) = €225,000–€375,000 per year
- Support overspend: 300 users × €165–€275 (22% of difference) = €49,500–€82,500 per year
- Total annual overspend: €274,500–€457,500
- Five-year contract cost: €1,372,500–€2,287,500
This is not theoretical. This scenario describes the typical state of large SAP enterprises before optimisation.
7. The Named User Optimisation Playbook
Step 1: Extract User List and Current Type Assignments
Pull a complete user list from SAP that includes: (1) user ID, (2) full name, (3) assigned licence type, (4) department/cost center, (5) last login date, (6) manager/cost center owner.
Tools: Use SAP's User Information System (transaction SU01D) or pull data via ABAP query. Request output in CSV format for analysis.
Step 2: Run ST03N Transaction Analysis
ST03N is SAP's workload analysis tool. It extracts transaction history for each user over a rolling 12-month window. Output includes: (1) transaction code, (2) execution frequency, (3) module, (4) time of execution.
Filter the ST03N data to identify each user's top-10 most-executed transactions. This shows their primary functional area.
Step 3: Map Transactions to Licence Classification Matrix
Cross-reference each user's top-10 transactions against SAP's authorisation matrix (available from SAP Support or Redress Compliance's licensing library). Determine the minimum licence type required to execute those transactions.
Example mapping:
- User executes: FI02 (FI/GL general ledger posting), FI00 (FI/GL analysis), PA30 (HR master data viewing) → Limited Professional User (FI module) is sufficient
- User executes: SAPGUI (all modules), SE16N (custom analytics), FB50 (GL posting across all cost centers) → Professional User is required
Step 4: Identify Downgrade Candidates and Get Business Sign-Off
Three cohorts typically over-classified:
- Display-only users: Execute only SE11, SE12, SM51 (read-only transactions). Can be downgraded to Employee Self-Service or deactivated.
- Single-module users: Work in one functional area only (e.g., AP only, Payroll only). Can be downgraded to Limited Professional User.
- Inactive users: No login activity for 90+ days. Should be deactivated entirely.
Before downgrading or deactivating, secure written approval from the user's business owner. Document the approval. This prevents disputes and provides an audit defence if SAP questions the reassignment.
Step 5: Execute USMM to Validate the New Baseline
After reassigning users, run USMM internally to verify the new count matches your target optimisation. USMM will show any users still executing transactions above their new assigned type — these require additional review before finalising the reassignment.
The validated USMM output becomes your audit-ready baseline. You now have the exact data SAP will see during the next audit, which eliminates surprises.
8. Negotiation Levers: Using Named User Data at the Table
Accurate User Count = Negotiating Power
When you approach SAP renewal negotiations with a clean, ST03N-validated, USMM-confirmed user count, SAP's traditional negotiating lever (claiming your audit will reveal significant misclassification) is neutralized. They cannot negotiate price increases based on audit risk if you have already resolved the audit risk.
Additionally, if you present evidence that you have downgraded users since the last contract term, you can claim cost reductions as a negotiating position for better pricing.
S/4HANA Migration as a Forcing Event
If S/4HANA migration is planned, use it as a forcing event to negotiate. Demand in the migration statement of work that your user baseline be locked in at the ECC user count, adjusted only for documented changes (new hires, departures, role changes). This prevents SAP from re-baseline escalation.
Contract language: "The parties agree that the S/4HANA user baseline shall be locked at [X] Professional Use, [Y] Functional Use, and [Z] Productivity Use, adjusted only for documented headcount changes and approved functional role changes, with all adjustments subject to mutual written agreement."
Q4 Timing: SAP's Window of Flexibility
SAP's fiscal year ends December 31. Renewals typically close by October 31 (Q4) to take effect January 1. SAP has maximum flexibility to negotiate in Q4 because they are managing annual quota close. Timing your renewal discussion for September–October (before their quarter ends) gives you maximum negotiating leverage.
Volume Commitments: Pre-Negotiate Pricing for User Growth
If you anticipate user growth during the contract term, pre-negotiate pricing for user blocks. For example: "Base contract: 1,000 Professional Use at €X per user. Additional users 1,001–1,200 at 90% of base price. Users 1,201+ at 85% of base price."
This prevents SAP from using mid-contract user additions as justification for renegotiating rates upward.
9. Common Mistakes CIOs Make with Named User Licensing
Mistake 1: Assigning Professional User "To Be Safe"
Many CIOs assign all users to Professional User to avoid audit risk. This is an expensive insurance policy. A 1,000-user enterprise assigning all users to Professional costs €1.2–€3 million per year more than a right-sized mix of user types. The audit risk is not worth the cost.
Mistake 2: Not Running USMM Before Audits
Running USMM internally allows you to see audit findings before SAP does. Not running it means you lose the first-mover advantage and must negotiate defences reactively during the audit. This costs time, resources, and negotiating leverage.
Mistake 3: Assuming S/4HANA Migration Is a Like-For-Like Licence Transfer
It is not. S/4HANA migration triggers a re-baseline, which SAP will use as an opportunity to upgrade users and increase cost. You must conduct a pre-migration user audit and lock in a contractual baseline before migration begins.
Mistake 4: Ignoring Inactive Users
Every inactive Professional User costs €1,200–€3,000 per year in licence fees, plus support. A 1,000-user estate with 30 inactive Professional Users is wasting €36,000–€90,000 annually. Deactivate inactive users immediately.
Mistake 5: Not Distinguishing Named Users from DDLC in Budget Planning
Many CIOs treat "SAP licensing costs" as a single bucket and fail to distinguish between named user costs and DDLC costs. This prevents targeted optimisation. A high-volume DDLC estate can be optimised independently of named user licensing, and vice versa. Separate tracking enables better cost control.
Comprehensive SAP licence audits integrate named user optimisation with DDLC analysis, S/4HANA migration strategy, and contract negotiation.
Redress Compliance has defended 80+ indirect access disputes and guided 500+ engagements.10. Conclusion and Next Steps
Named user licensing is not set-and-forget. User populations change quarterly; new hires, departures, and role changes continuously alter your licence exposure. Annual user reviews (aligned to SAP's fiscal year-end in December) ensure your licence estate stays right-sized and audit-ready.
The compounding cost of misclassification — licence fees plus 22% annual support — makes accurate user assignment a material financial control. For any CIO managing SAP, the core actions are:
- Run ST03N analysis quarterly to understand actual user transaction profiles.
- Run USMM quarterly to see the audit view before SAP does.
- Downgrade over-classified users and deactivate inactive users before the next contract measurement date.
- If S/4HANA migration is planned, conduct a pre-migration user audit and lock in a contractual baseline.
- Use clean, validated user data to negotiate better pricing at renewal.
SAP's audit teams are expert in finding and escalating misclassification. Buyers need equivalent expertise to defend their position. Redress Compliance has guided 500+ engagements and defended 80+ audit disputes. Expert support in this area is not optional—it is essential to protecting your SAP investment and controlling your largest controllable cost.