ABAP system license verification program

SAP has a bit of a hidden program to verify licenses on an ABAP system: RSUVM080. You can use this program yourself as well to prepare for license measurement and discussion on licenses.

Questions that will be answered in this blog are:

  • How to set up the User Type validation program RSUVM080?
  • How to use it for validation of your licenses?

Installation of program RSUVM080

In very new versions program RSUVM080 is present already. For older versions implement it by applying OSS note 2339166 – Validation of the user classification.

Also check bug fixes notes:

Use of program RSUVM080

If you start program RSUVM080 you see that a file is required for the validation rules:

The file has a specific format. The picture below is an example we use here:

In XLS format:

The actual definition of the file content, you have to do yourself by using common sense! When having discussions with SAP, they might provide the file and ask you to run it. 

Now run the tool in productive system. Output looks like this:

Explanation of the checks

In the details of the input you can see we have provided several checks:

  1. Authorization checks: first 4 lines (check for * in users management, or change or create. 4th line is check for development rights)
  2. Transaction code checks: check for VA01, SE38 and SE11

The checks are shown in the columns on top.

You can see that transaction codes VA01, SE38 and SE11 were executed by the users. When you click on the green icon in the AC check column you can see the details for the AC (anti cheating) checks (more on the AC checks in this blog):

You can see that the user did not only execute VA01, but also did updates to VBAK table. So the user did execute the transaction and created records. Therefore for this user the right license type should be assigned. If the user has rights for VA01, and started it, but never made a posting, this is off course different.

If a user has a DEVACCESS entry, it is marked in the SSCR column. If the user was involved in transports, the transport column is marked.

In the #steps column you can see what other transactions were performed by the user:

Selection of users

It is important to realize that the program only selects the user as Green if one or more of the criteria was met. This can help you focus on the discussion points you are having with SAP (for example around use of VA01 for sales order creation).

You can start with a limited set of rules, and then expand.

First you can give all users the lowest classification. Then you start. For example: start with only the rule for transaction VA01. Assign the users the correct license type. On the selection screen, don’t select the users you already classified, by excluding them in the selection. Then focus on the AC checks: learn from them and see which transactions lead to them. Add this to the rules, and again classify the users correctly. In the next run the classified users are excluded again. This you can do until no AC check box is there. Then randomly validate that the actions left, which are executed by the other users, are indeed part of the lowest license type.

Licenses for SAP solution manager

SAP solution manager licenses have been renewed last few years by SAP.

Questions that will be answered in this blog are:

  • Do I need a user license for solution manager users?
  • If I run solution manager on HANA, do I need to pay HANA database licenses?
  • How can I get Focused Build and Focused Insights?
  • What about Focused Run licenses?

User licenses for SAP solution manager

Since 1.1.2018 the requirement of having named users was dropped by SAP.

HANA database licenses

If you want to run HANA database below SAP solution manager as database, you need to procure the infrastructure. The HANA database rights are included in SAP solution manager. This is the only exception SAP has. For all other use case you need to pay for HANA as database as well.

Using SAP solution manager for non-SAP components

You can use SAP solution manager to manage non-SAP components as well. Especially the ITSM service desk component can be used for this. When you use this function for non-SAP components, you will need SAP enterprise support rights for SAP solution manager in stead of the SAP standard support.

Focused Insights and Focused Build

SAP offers Focused Insights and Focused Build as extra options on top of SAP solution manager. Both are installed as add-on. Focused Insights brings extra dashboard building capabilities. With Focused Build you can get an extra grip on your solution build process.

As of 01.01.2020 both solutions are part of standard maintenance contract. See also OSS note 2361567 – ST-OST Usage Rights and Support.

If you want to try out these solutions, you can use the available free SAP demo system. Read more about this in the following blog.

SAP Focused run now also covers the functionality of Focused Insights, but in a far superior and more performing way. Read more in this blog.

Focused Run

Focused Run is separate solution with separate license to optimize the running of large SAP landscapes. Focused run does NOT run on SAP solution manager. It runs on a separate environment and only runs on SAP HANA. You cannot combine a Focused Run and SAP solution manager on one single installation. More information on Focused Run can be found on the SAP site. And on the specialised SAP Focused Run Guru site.

For licenses of Focused Run, read this dedicated blog.

Despite the fact that Focused Run is a paid solution, it offers by far the most sophisticated and added value product.

More background information

More information can be found on the SAP solution manager usage rights website.


License measurement tips & tricks

This blog will give you tips & tricks for the SAP license measurement.

Questions that will be answered are:

  • How to deal with license classification for background users?
  • How to deal with license classification for standard SAP users?
  • How to deal with license classification for SAP support and fire-call users?
  • How to deal with multiple logon?
  • How to deal with developer licenses?
  • What does Confusopoly mean?

Background users

According to OSS note 32326 – System measurement : Technical users all background users are free of charge. Classify them as type 91 Test users. This rule is valid for:

  • Batch users to run background jobs
  • SAP to SAP system connection users
  • Interface batch users
Be careful with the interface users. If an external system posts data into SAP system with a single background user, but it is clear that in the source system multiple real users doing the actions, SAP might want to charge you for 'indirect use'.

System dialog users

SAP standard dialog users are excluded from system license measurement. See OSS note 1402837 – Info USMM/LAW: Excluded SAP users in the measurement for a full list.

SAP support users and fire-call users

For live support of an SAP system you typically will have 2 types of support users:

  1. Users for SAP themselves to logon to your system and provide support to you
  2. Fire-call users with elevated authorizations to solve time critical incidents

Both type of users have no direct business goal, but have only support usage. You can mark them as type 91 Test user, as long as you have a clear naming convention for these users and a general rule that they are locked unless they are needed.

User deletion as regular activity

The user measurement program (both USMM and USMM2) checks for deletion of users in the last three months. To avoid discussions on user deletion it is best practice to delete monthly, or bi-monthly, all persons which have left your company.

End validity date

Users who don’t have a current validity date are not counted in the user measurement program. You might want to schedule program RSUSR_LOCK_USERS in a regular batch job to end the validity of users that did not log on for long time automatically. See this blog for more details.

Multiple logon

SAP does measure how many times a user has a double, triple, etc logon. The results are stored in table USR41_MLD. SAP might argue that the same user is used by multiple persons. You can use the contents of table USR41_MLD to prove if this was a mistake only. If the are too many multiple logons you might need to go back to the business to change their behavior.

You can also forbid the multiple logons at system level. SAP system parameter login/disable_multi_gui_login can be set in RZ11 to forbid multiple logons. For some users (like DDIC) you do want to keep multiple logons. These users must be set into system parameter login/multi_login_users=username1,username2,username3,etc.

Proper consolidation

Use the SLAW or SLAW2 tool to execute a proper consolidation of your measured users. This process will de-duplicate your counted users.

License validation program

Read this dedicated blog to know more about license vailidation program RSUVM080.

LUI License utilization information

The LUI (license utilization information) tool is an online SAP tool that has all the information on your on premise and cloud licenses information combined. For cloud the usage is automatically visible. For on premise systems you can upload the usage via the SLAW files. This can give you insights into under-consumption and over-consumption of licenses. Read more in this blog.

Check for bug fix notes in your advantage

SAP might give you a list of OSS notes to apply in your system before the measurement. These notes normally benefit SAP. You can also check for OSS notes that benefit you.

Example:

3017067 – USMM2: Korrektur Klassifizierungshilfe Anwender Prof/Ltd.Prof.

FIORI gateway usage

For FIORI gateway usage, read this dedicated blog.

Developer licenses

SAP has made the developer license measurement messy with the move to S4HANA by removing the simple DEVACCESS measurement. Read more in this blog.

Confusopoly

If you think you know all about SAP licenses, SAP will change everything again. Dilbert has a nice word for it: confusopoly:

Confusopoly

Sometime people on sales/buying SAP joke about the SAP abbreviation being Shut-up And Pay.

EHP switches and licenses

EHP switches can deliver great new functionality. But not all of them are for free. This blog will explain, how you will know which ones are included in the standard license, and which ones not.

Questions that will be answered are:

  • How to know which switch has license impact?
  • What are best practices for EHP switches?

Relationship between EHP switches and licenses

The relationship between EHP switch activation and licenses is explained in OSS note 1524246 – Relationship of licenses and business functions.

Attached to this OSS note is the most recent version of the PDF listing which switches are part of the standard license, and which switches require an extra license.

How to read the document?

The document is sorted per business area. Best way is simply use the find button in the PDF and search for your switch.

Example of 2 switches that don’t have license impact:

EHP no license

The pricing comment and License (material number) column are empty. These switches are part of standard license.

Example of switch with license impact:

EHP with license

For this switch your company should be in possession, or acquire the license mentioned in the last column.

EHP switches best practices

Since EHP switch can have license impact the following best practices is suggested:

  • Restrict SFW5 EHP switch activation access to basis team only (display for all is ok)
  • Explain basis team the fundamentals of the licenses and EHP switches
  • Determine in your company who must approve EHP switch on and make clear to basis team only to execute the activation after this approval

If you have switched on a switch with licenses and don’t want to use it, check if it is a reversible switch. Then simply undo this. If it is not reversible, don’t use the corresponding functionality. The latter is much harder since you need to restrict authorizations to that function very carefully.

SAP new license model for indirect access

This blog will explain about the new SAP license model for indirect access, also known as Digital Access license.

Questions that will be answered in this blog are:

  • Where to find reference material on the new SAP license model?
  • How does the new SAP license model look like?
  • What are the exact definitions inside the documents for digital access?
IMPORTANT:
The explanation in this blog is to help you understand. This is not a replacement of the official SAP site. Please always check the latest official SAP site on the latest status of licensing. The document to search for in the SAP site is called SAP licensing guide (a guide for buyers).

For measurement of digital access in your system read this blog.

References

Before starting the explanation these are important and useful references:

The new model

The new model consist of 3 components:

New indirect access model

  1. Direct human access
  2. SAP applications (engines)
  3. Indirect access / digital access
Formal definition:

Digital Access to SAP ERP (“ERP”)

This Package grants (a) humans a license to Use ERP through Non-SAP Application(s) that is/are directly integrated to ERP without the need to be licensed as a “Named User” of ERP and (b) non-humans (e.g. bots, sensors, chips, devices, etc.) a license to Use ERP directly or through Non-SAP Application(s) that is/are directly integrated to ERP and without the need to be licensed as a “Named User” of ERP (collectively, “Digital Access of ERP”).
All Digital Access of ERP will be licensed based exclusively upon the number of Documents created annually by such Digital Access of ERP.  Documents are unique records (i.e. unique digital line-items/objects) as defined in the “Document Definitions” column of the below table.  Each Document shall count as one (1) Document, except for Material Documents and Financial Documents which shall each count as two tenths (0.2) of a Document.  However, where the automated processing in ERP of a Document from one Document Type results in the subsequent creation in ERP of one or more additional Documents of different Document Type(s), such additional Documents shall not be counted.
Where a Non-SAP Application is connected to ERP via a Connectivity App, such Non-SAP Application is still deemed directly integrated to ERP for purposes of this provision.  Any humans and/or non-humans using ERP through application(s) (e.g. Ariba, Concur, Successfactors, Hybris) that is/are integrated to a Non-SAP Application that is directly integrated to ERP do not need to be licensed as a “Named User” of ERP.

In practice this should means documents posted via generic interface user, IOT device, 3rd party application, cloud application posting data in SAP system, etc.

By simply counting documents and agreeing on a price per document, this will simplify the ever ongoing discussion on indirect access.

Digital access based on output

Document definitions

SAP starts with 9 documents. You can find the list and definition in the table below.

Digital access based on documents

Document TypesDocument Definitions
Sales DocumentA Sales Document is (i) a line item record that represents the material and/or service being sold or quoted and/or (ii) a record that represents an individual order/release against a scheduling agreement which indicates the material and/or service being sold.
Purchase DocumentA Purchase Document is (i) a line item record that represents the material and/or service being ordered or requested and/or (ii) a record that represents the release against a scheduling agreement which indicates the material and/or service being procured.
Invoice DocumentAn Invoice Document is a line item record that represents the material and/or service being billed.
Manufacturing DocumentA Manufacturing Document is (i) a record which represents the production-related details associated with manufacturing a material, including: the type, quantity and color of what to produce, when to produce it, where to produce it and/or other distinguishing characteristics, and/or (ii) a record that represents a confirmation which indicates the status of the processing activities associated with manufacturing orders.
Material DocumentA Material Document is a line item record that represents a specific material being received, issued or transferred to, from or within a storage location or plant.
Quality Management DocumentA Quality Management Document is (i) a record that represents the details of a nonconformance being reported including the information required for problem solving and/or (ii) a record that represents results of an inspection.
Service & Maintenance DocumentA Service & Maintenance Document is (i) a record that represents the details of work to be performed including the information needed to plan, execute and bill for a service or maintenance request , and/or (ii) a record that represents the details of a problem being reported including the information required for problem solving and/or (iii) a record that represents the status of the processing associated with service orders and maintenance orders  and/or (iv) a record that represents a claim by a customer for repair or replacement or compensation for under-performance, pursuant to terms in a warranty document.
Financial DocumentA Financial Document is a record that represents accounting information in a financial journal.
Time Management DocumentA Time Management Document is (i) a record that represents an employee’s time worked and assigned to business related objects and/or (ii) a record that represents a confirmation (e.g., a progress update) which indicates the status of the processing activities associated with manufacturing orders.