The SAP dormant user purge

Dormant users are the largest hidden compliance issue in most SAP estates and, paradoxically, the largest free recovery opportunity. The pattern is consistent across our 500+ engagements: between six and twelve per cent of the active named-user records in a typical SAP estate belong to people who have not used the system in 180 days or more. They are counted in USMM. They feed the audit’s opening claim. They are also fully recoverable through a structured purge process that takes 30-45 days end to end and requires no negotiation with SAP. The discipline is unglamorous but the yield is large. On a 10,000-user estate with a blended Professional licence cost of $2,800, a six per cent dormant purge releases $1.68M of compliance headroom or, equivalently, removes $1.68M from the next audit’s opening claim.

What “dormant” means

A dormant user, for SAP audit purposes, is a user master record with an active licence-type classification whose last logon timestamp exceeds a defined inactivity window. The standard inactivity window in the SAP audit defence community is 180 days, which corresponds roughly to two full quarters of the buyer’s business cycle. Some estates use a shorter 90-day window for high-cost licence classes; others use a longer 365-day window for low-cost classes. The choice of window is a buyer decision; SAP’s audit clause does not prescribe one.

Dormancy is read from the USR02 table’s last-logon timestamp, consolidated across all SAP systems in the LAW landscape. A user dormant in one system but active in another is not dormant for the purge; only users dormant across the full landscape qualify. The consolidation discipline matters and is described in our SAP usage analytics article.

The 180-day rule

The 180-day rule is the community-standard inactivity window. It works because it is long enough to capture genuine business cycles — quarter-end users, seasonal workers, project-based contractors — without being so long that genuinely abandoned accounts remain in the count. We have tested shorter windows (90 days, 120 days) and found that they recover only slightly more capacity but generate materially more false-positive disputes that have to be unwound in re-activation. The 180-day window is the right balance.

The 180-day rule applies to first-tier purge candidates: users whose last logon exceeds 180 days and who are not otherwise flagged as exempt. A second tier — users whose last logon exceeds 365 days — is purged without re-validation. A third tier — users with no last-logon timestamp at all, indicating a creation event without subsequent use — is purged immediately with no defence.

What the purge actually does

The purge does not delete the user master. Deletion is an over-reach because it destroys the audit evidence trail and triggers a separate downstream issue with HR-data reconciliation. The right action is to set the user master to system-locked with a documented basis (“Dormant beyond 180 days, USMM cycle of {date}”) and to downgrade the licence class to the lowest applicable class, typically Employee or ESS.

The system-lock retains the user master but removes it from the active count in USMM. The licence-class downgrade releases the higher-cost classification. If the user later returns to active duty, the user master is unlocked and the licence is re-assigned with a documented basis. The pattern is the one described in the insurer named-user reclassification case file.

Evidence: what the purge log records

Every purge action generates an evidence record. The record contains the user identifier, the previous licence class, the new licence class (typically system-locked), the inactivity period at the time of the purge, the system(s) in which the action was taken, the approver, the date, and the basis statement. The record is filed in the SAM evidence pack alongside the underlying USR02 extract that established the dormancy.

The discipline matters because SAP’s audit team will challenge a bulk purge that happens close to a measurement window. A continuous-purge record with documented dormancy bases is treated as routine licence hygiene. An undocumented bulk purge in the week before USMM is treated as audit avoidance and re-introduces the purged users into the position paper’s dispute schedule. The pattern is described in the SAP Named User Classification Guide white paper.

The pre-audit freeze window

The pre-audit freeze window is the 60-day period before a scheduled USMM run during which no licence-class reclassifications are permitted. The freeze applies to all reclassifications, not only to purges. The purpose is to prevent the appearance of audit-avoidance and to keep the measurement’s evidence trail clean.

The freeze means that a buyer who wants to capture the dormant-purge yield in the next USMM run must complete the purge before the freeze begins. The implication is that purges should be planned 90-120 days ahead of USMM, with the action complete and the evidence pack closed before the 60-day freeze begins.

Categories of dormant user that are tricky

Three categories of dormant user require additional handling and recur in nearly every purge. The first is the executive user. Senior executives often have SAP credentials they never use, retained for occasional access or for symbolic permissions. They are technically dormant under the 180-day rule but cannot be system-locked without political cost. The right handling is to downgrade the licence class but retain the user master in active state, with a documented executive-exception flag.

The second is the project contractor. Project contractors often have multi-month gaps in usage that exceed 180 days. They are not genuinely dormant but require careful evidence. The right handling is a contractor-flag exemption with a documented project association. The third is the seasonal worker, particularly in retail and agriculture estates. Seasonal workers have predictable dormancy patterns that exceed 180 days. The right handling is a seasonal-flag exemption with a documented seasonal period.

The recovery mechanism after purge

The recovery mechanism is what makes the purge sustainable. If purged users can never re-activate, business owners will resist the purge. The recovery mechanism that works has three elements. A defined re-activation path, typically through the user self-service portal, that unlocks the user master and re-applies the prior licence class on documented business need. A short re-activation SLA, typically 24-48 hours, so business owners do not see the purge as a barrier to work. And a re-activation log that records every unlock event, the requester, the basis, and the new licence class.

The recovery log itself feeds back into the next purge cycle. Users who re-activate and then go dormant again are the highest-value purge candidates for the subsequent cycle. The cycle becomes self-reinforcing. The discipline is described in the licence harvesting article.

How the purge feeds the audit position paper

The purge is not only a recovery exercise; it is also an evidence exercise that supports the next audit’s position paper. The purge log demonstrates that the buyer runs continuous licence hygiene, which is the foundation of the position paper’s methodology section. A buyer with a documented purge cadence enters the next audit with a defensible licence count and a defensible methodology. A buyer without one starts the audit at a higher count and a weaker methodology. The pattern is the one described in our writing the SAP audit position paper article.

The purge log also contributes to the contract negotiation. A documented 8-12 per cent purge yield over the prior twelve months is a measurable case for reducing the renewal seat count, particularly in the SAP RISE conversion context where the contract seat count locks in for multiple years.

If you have not run a structured dormant-user purge in the past twelve months, the priority is to extract USR02 across the landscape and size the dormant pool. The first conversation is at no cost. Our SAP licence optimization service describes how we structure the engagement.