SID Deactivate in Public Cloud/IAS

[#1]

Hi Experts,

We are using SAP S/4HANA Cloud Public Edition with IAS/CBC and S4HC. For employee offboarding, we are considering the following process to deactive SID instead of delete SID, for we are afraid if we delete, it will influence IAS/S4 system inconsistent.

Process as following:

1. Set user status to Inactive in IAS

Status: Inactive
Valid To: End of Valid Date
(eg 2026/06/16)

2. Remove user groups in IAS

All unassign(clear all group)

3. Synchronize changes to CBC in IAS(IPS)

4. Maintain Worker work type valid date in APP "Manage Workforce" in S/4HANA Cloud
Worker Types End date:
End of Valid Date
(eg. 2026/06/16)

5. Lock the business user in APP "Maintain Business User" in S/4HANA Cloud

Click "Lock" indicator

6. Remove all assigned business roles in APP "Maintain Business User" in S/4HANA Cloud

Remove all Business Role

Q1: For sure following step is correct or SAP recommended approach is delete SID? 

Q2: If you complete the steps above, the SID account will no longer occupy FUE?

Thanks.

Tina

[HenrikeGroetecke · Accepted solution]

#GenAI-Assisted Content

Hello,

Thank you very much for your question. 

I asked our internal chatbot for support, and here's the response. Please check whether the suggestions help you resolve your issue:

Q1: Is the following step correct or is SAP’s recommended approach to delete SID?

The steps you outlined for deactivating a user instead of deleting the SID are generally correct and align with SAP’s practices for managing user lifecycle. Deactivating a user by setting their status to inactive and removing their roles and groups is a valid approach to ensure that the user no longer has access without deleting their SID. This method helps avoid potential inconsistencies between IAS and S/4HANA systems.

SAP provides functionality to block and delete business users, but it is important to consider the consequences of deletion, such as losing references to the user in system records. Blocking a user is a safer approach if you want to retain historical data and avoid issues with references in the system. [^1]

Q2: Will the SID account no longer occupy FUE after completing the steps above?

Once you deactivate the user and remove all roles and groups, the user should no longer occupy a Full User Equivalent (FUE) license. FUEs are typically calculated based on active users with assigned roles that allow them to perform business functions. By locking the user and removing their roles, you effectively reduce their access and usage, which should reflect in your FUE count. 

While you can simply delete user master records from the system, think of the consequences to any references to that user master record before you do. When deleted, the system removes the user data from the master record.

For more information, see Identity and Access Management - Blocking and Deleting Business Users.

Kind regards, 

Henrike

[KUO_WANRU · Accepted solution]

Hi Henrike, Thanks for your fully explanation for two questions, we understand now

[Lucian]

Hi @KUO_WANRU,

I have just  a small observation for the Central Business Configuration part :

Removing all the relevant roles in CIS will trigger the deletion of the business user in the target system with the next provisioning job executed.

If you just want the user to be blocked there it is sufficient to set the inactive status in CIS since authentication will no longer work for the user in question.

This users are different then the business users in the Cloud ERP system and will not be impacting your FUE calculation done there.

Regards.

Lucian