Excessive Access: CIO Guide to SAP, Salesforce, ServiceNow

Excessive access in SAP, Salesforce, and ServiceNow is a security and compliance problem where users hold more permissions than their job requires, and fixing it requires a continuous process of discovery, certification, and remediation rather than a one-time cleanup. This guide explains the core causes of excessive access, the practical steps to reduce it in each platform, and the governance controls that keep it from returning.

Why Excessive Access Happens

Excessive access typically accumulates over time. Employees change roles, take on temporary duties, or receive additional permissions for a project and never have them removed. In SAP, access is often granted through composite roles and profiles that bundle many transactions together, making it hard to see exactly what a user can do. In Salesforce, permission sets, profiles, and sharing rules interact in complex ways, so a user might have object-level access through one setting and field-level access through another. ServiceNow uses a role-based access control model where roles grant modules and scripts, and administrators often assign broad roles like admin or itil for convenience.

Another common cause is the lack of a clear owner for access reviews. IT manages the technical setup, but business managers know what their team members should do. When no one is accountable, permissions stay unchanged for years. Additionally, many organizations rely on manual processes for onboarding and offboarding, so when someone leaves or transfers, their accounts remain active with all their old access.

The Risks of Excessive Access

Excessive access creates two main categories of risk. First, security risk: an account with more privileges than needed can be compromised and used to steal data, modify records, or disrupt operations. In SAP, a user with access to sensitive transactions like SE16 (table display) or SU01 (user maintenance) could view payroll data or create new accounts. In Salesforce, excessive access to the View All or Modify All permissions on objects could expose customer records. In ServiceNow, a user with the admin role can change any record, run scripts, and alter system configuration.

Second, compliance risk: regulations like SOX, GDPR, and industry standards require segregation of duties (SoD) and periodic access reviews. If an auditor finds that a user can both create a vendor and approve an invoice in SAP, that is a SoD conflict that could lead to fraud. In Salesforce and ServiceNow, the same principle applies—a user should not be able to both request a change and approve it, or both create a user and assign roles.

How to Detect Excessive Access

Before you can fix excessive access, you need to find it. Start by building an inventory of all users and their permissions in each system. In SAP, use transaction SUIM (User Information System) to run reports on users by roles, profiles, or direct assignments. In Salesforce, use the Permission Analyzer or run a Permission Set Assignment report to see which users have which permission sets. In ServiceNow, use the Role Report or the User Role module to list all role assignments.

Next, compare each user’s access to their current job function. You can use a role-based access control (RBAC) matrix: define what roles are required for each position, then flag any user whose permissions exceed that baseline. For large organizations, this is best done with automated tools that can pull data from the systems and compare against a policy. Many governance, risk, and compliance (GRC) tools exist for SAP, and Salesforce and ServiceNow have their own security review features or third-party apps that can help.

How to Fix Excessive Access in SAP

In SAP, the most direct way to remove excessive access is to remove the roles or profiles that grant it. Follow these steps:

• Identify the roles that are no longer needed using SUIM reports.
• Use transaction SU01 to edit the user and remove the role assignments.
• For mass changes, use transaction SU10 to modify multiple users at once.
• If a role itself contains too many transactions, edit the role in PFCG and remove the unnecessary menu items and authorization objects.
• Consider using SU53 to check authorization errors, which can help identify where a user lacks access (but that is the opposite problem—excessive access is found via reports).

For segregation of duties conflicts, you need to identify critical combinations. For example, a user should not have both FB60 (post invoice) and F-53 (post payment). Use the SAP GRC Access Control tool or a custom ABAP report to detect such conflicts. Once identified, you can either remove one of the roles or implement a mitigation control like a secondary approval workflow.

How to Fix Excessive Access in Salesforce

Salesforce permissions are layered: profiles, permission sets, and sharing rules. To fix excessive access, you need to review each layer.

1. Start with profiles: go to Setup > Users > Profiles and review the object permissions, field permissions, and app settings. Remove any checkboxes for objects the user does not need.
2. Check permission sets: Setup > Users > Permission Sets. Look for permission sets that grant View All or Modify All on objects, or that grant system permissions like Manage Users. Remove those assignments from users who do not need them.
3. Review sharing rules: Setup > Security > Sharing Settings. Sharing rules can give users access to records they should not see. Remove or modify rules that are too broad.
4. Use the Permission Analyzer to see exactly what a user can do and compare it to their job role.

For a clean approach, consider implementing a minimum privilege strategy: create a baseline profile with the least access needed, then add permission sets for specific functions. This way, you can easily revoke access by removing a permission set instead of editing a profile.

How to Fix Excessive Access in ServiceNow

ServiceNow access is controlled by roles. Users can have multiple roles, and roles can be assigned directly or through groups. To fix excessive access:

• Go to User Administration > Users, open the user record, and look at the Roles list.
• Remove any roles that are not required for the user’s job. For example, if a user only needs to view incidents, they should not have the itil role (which allows editing) or admin.
• Check group memberships: users often get roles because they are in a group. Go to User Administration > Groups, and review the group’s roles. If a group has a broad role, consider creating a more restrictive group.
• Use the Access Control List (ACL) to restrict what a role can do. For example, you can create a new role that has read-only access to incident records, and assign that role instead of itil.

ServiceNow also has a Security Operations module that can run access reports and identify high-risk roles. You can also use the Role Hierarchy to see which roles include others, which can help you understand the full scope of a user’s access.

Preventing Excessive Access from Returning

Fixing the current state is only half the battle. To prevent excessive access from accumulating again, implement a continuous access governance program.

• Define a role-based access control matrix for every job function in your organization. This should be a living document that is updated when roles change.
• Require access requests to go through an approval workflow. In SAP, use the GRC tool or a custom workflow; in Salesforce, use the Approval Processes for permission set assignments; in ServiceNow, use the Access Request module.
• Schedule periodic access reviews. At least quarterly, have business managers review the access of their team members and attest that it is appropriate. Many GRC tools can automate this with email reminders and audit trails.
• Automate offboarding: when an employee leaves, automatically deactivate their account and remove all roles and permission assignments. This can be done with integration between your HR system and the three platforms.
• Monitor for SoD conflicts on an ongoing basis. Set up alerts for when a user is granted a combination of roles that violates policy.

Also consider using a single identity governance platform that can manage access across SAP, Salesforce, ServiceNow, and other systems from one place. This gives you a unified view of a user’s access and makes it easier to enforce policies.

Common Mistakes and Pitfalls

One common mistake is trying to fix excessive access by deleting roles without understanding dependencies. In SAP, a role may contain authorizations that are needed for a different transaction than the one you are trying to block. In Salesforce, removing a permission set might break a flow or an integration that relies on that permission. Always test in a sandbox first.

Another mistake is ignoring the indirect access. In Salesforce, users can gain access through public groups, queues, or delegated administration. In ServiceNow, roles can be inherited from groups or from the role hierarchy. Make sure your review covers all paths, not just direct assignments.

Finally, don’t forget about field-level and record-level security. A user might have object-level access but not field-level, or vice versa. In Salesforce, use Field Accessibility to check what fields a user can see. In ServiceNow, use UI Policies and ACLs to restrict fields. In SAP, field-level access is controlled by authorization objects like F_FBNKA or K_KA01.

Frequently Asked Questions

How often should I run access reviews?

At minimum, run access reviews quarterly. For high-risk systems like SAP, some compliance frameworks require monthly or even continuous monitoring. The key is to align with your audit requirements and the actual risk level of the data. If you have a large number of users, consider risk-based reviews: focus on users with the most access or access to sensitive data more frequently.

Can I use automated tools to fix excessive access?

Yes, there are many GRC tools that can automate the detection and remediation of excessive access. For SAP, SAP GRC Access Control is the native solution. For Salesforce and ServiceNow, there are third-party apps on their marketplaces. These tools can run reports, flag SoD conflicts, and even trigger approval workflows for role changes. However, you still need human oversight to make final decisions on complex cases.

What is the difference between a role and a profile in Salesforce?

A profile is a collection of settings that define what a user can do, such as object permissions, field permissions, and app settings. A role is part of the role hierarchy and controls record-level access through sharing. You can have the same profile but different roles, which affects which records they can see. Excessive access can come from either, so you need to review both.

How do I handle excessive access for a user who needs temporary access?

Use time-boxed access. In SAP, you can set a validity period on roles using SU01 or GRC. In Salesforce, you can use permission sets with a Start Date and End Date (available in some editions). In ServiceNow, you can create a role with a time condition or use the Access Request module to set an expiry. Always document the reason for temporary access and ensure it is removed automatically.

What should I do if I find a SoD conflict?

First, confirm the conflict is real and not just a false positive. If it is real, you have two options: remove one of the conflicting permissions, or implement a mitigating control such as a secondary approval from a manager. In SAP, you can use the GRC tool to create a mitigation. In Salesforce, you can use a validation rule or a flow to require an extra approval. In ServiceNow, you can use an approval workflow on a record. Document the decision and the rationale for audit purposes.

Is it better to use a least-privilege model from the start?

Yes, a least-privilege model is the best practice. Start with the minimum access needed for each role, then add permissions on an as-needed basis. This is easier to maintain than trying to remove access later. It also reduces the attack surface and simplifies compliance. However, it requires more upfront planning and a clear process for requesting additional access.

Related

• Office 2010: Disable or Enable Clipboard
• Xiaomi X Series 4K Smart TVs Launched in India?
• Best DocuSign Alternatives for Editing and Signing PDFs