Section I · The Brief
The service-account drag
The client, a global logistics operator with operations in forty-two countries, ran an SAP ECC estate integrated to EWM (warehouse management), TM (transportation management), and PI (integration platform) across 18,000 productive named users. The estate had accumulated 2,400 workflow service accounts over the prior decade, primarily for cross-system integrations between EWM and TM, between TM and the carrier-portal integrations, and between PI and the third-party logistics applications.
The LAW report run for the upcoming renewal had counted every one of the 2,400 service accounts as a Professional-tier named user, contributing two point one million dollars to the renewal forecast on top of the 18,000-user productive population. The internal SAP basis team had repeatedly flagged that the service accounts were not human-user accounts and should not be in the named-user population, but the LAW report had been accepted without modification by procurement on the basis that it was the SAP-supplied measurement.
The brief from the procurement leadership was to test the service-account population against the SAP named-user definition, identify which accounts could be removed from the chargeable population, and present a defensible cleanup before the renewal proposal deadline.
Section II · The Opening Claim
The LAW count
The opening position was inherited from the LAW report and reflected an over-inclusive interpretation of the named-user definition. The named-user count of 20,400 included the 18,000 productive users and the 2,400 service accounts treated as Professional-tier users at full Professional pricing.
The service-account population broke down by integration pattern as follows.
- 900 SAP-PUSER accounts associated with EWM-to-TM bidirectional integrations, contributing $0.8M.
- 600 SAP-CUSER accounts for the inbound carrier-portal interfaces, contributing $0.5M.
- 400 SAP-WFUSER accounts for the workflow-engine background processing, contributing $0.4M.
- 300 SAP-COMMTECH accounts for the PI integration platform technical processing, contributing $0.3M.
- 200 SAP-INT_RFC accounts for outbound third-party RFCs to logistics partners, contributing $0.1M.
Section III · The Defence
The account-type cleanup
We took the engagement on a pre-renewal optimisation footing with no SAP audit in flight. The evidence brief was a per-account inventory across all 2,400 service accounts covering the account type (SU01 user type), the activity pattern (logon mode), the authentication mechanism (certificate, password, or service-token), and the operational owner (human team or automated integration).
The analysis tested every account against the SAP named-user definition, which distinguishes between named users (individuals with authenticated access to the SAP estate) and technical accounts (system-to-system integration accounts that are not associated with a named individual). The methodology applied the SAP-published guidance on the SAP-COMMTECH, SAP-CPIC, and SAP-WFBATCH account types as well as the framework-agreement language on service-account exclusions.
The cleanup recommendations broke down as follows: 900 EWM-to-TM SAP-PUSER accounts were converted to SAP-COMMTECH (technical integration accounts) under the framework agreement exclusion; 600 carrier-portal SAP-CUSER accounts were redirected to a single shared SAP-CPIC technical user with multiple authentication paths; 400 SAP-WFUSER workflow accounts were retired and replaced with two SAP-WFBATCH service accounts under the workflow-engine framework exclusion; 300 PI SAP-COMMTECH accounts were already non-chargeable but had been misclassified in the LAW report; 200 SAP-INT_RFC accounts were converted to SAP-COMMTECH under the third-party RFC framework exclusion.
The output was a chargeable named-user population of 18,000 against the prior LAW count of 20,400, with the 2,400-account technical-integration population entirely outside the chargeable scope and properly classified under the SAP-published account-type framework.
- Per-account inventory across 2,400 service accounts with type, activity, authentication, and ownership
- 900 EWM-to-TM accounts converted to SAP-COMMTECH technical-integration type
- 600 carrier-portal accounts consolidated to a single SAP-CPIC technical user
- 400 workflow-engine accounts retired and replaced with 2 SAP-WFBATCH service accounts
- 300 PI accounts reclassified in the LAW report under the existing SAP-COMMTECH framework
Section IV · The Settlement
The renewal outcome
The service-account exposure was revised from two point one million dollars to zero point three million dollars — an eighty-six percent reduction. The remaining zero point three million dollar commitment covered the residual SAP-WFBATCH and SAP-CPIC service accounts that remained in the chargeable population under the framework-agreement language.
The contract language was updated to reference the SAP account-type framework as the agreed measurement standard for future LAW runs, with the SAP-COMMTECH, SAP-CPIC, and SAP-WFBATCH carve-outs explicitly documented. The 2,400 reclassifications were rolled into the SAP estate over two release windows, and the basis team was briefed on the maintenance methodology for new service accounts created in the contract term.
Total elapsed time from engagement to completed cleanup was twelve weeks. The renewal closed on the corrected 18,000-user named-user baseline.
Section V · Lessons Applicable
What others can use
Five takeaways from the matter that apply to any organisation with a heavy integration footprint.
- The LAW report is the SAP-supplied measurement, not the contractual measurement. Test every named-user count against the framework agreement account-type definitions before accepting it as the renewal baseline.
- Service-account types are a documented framework. SAP-COMMTECH, SAP-CPIC, SAP-WFBATCH, and SAP-INT_RFC are SAP-published account types with specific framework-agreement carve-outs.
- Workflow engine service accounts are reducible. A 400-account workflow population typically consolidates to two or three SAP-WFBATCH accounts with no operational impact.
- Carrier-portal and third-party RFC accounts are technical-integration accounts. The framework-agreement language excludes these from the named-user population in most contracts.
- Run the service-account cleanup before LAW, not after. Reclassifications applied before the LAW run go into the SAP-supplied measurement; reclassifications applied after require a LAW rerun and a contractual evidence trail.
