What is FUE in SAP Cloud ERP licensing?

FUE (Full User Equivalent) is SAP's licensing metric used in S/4HANA Cloud and SAP Cloud ERP. It maps actual user activity to a normalized license unit. SAP calculates FUE consumption based on the activities a user can perform, the authorization objects assigned to their roles, and the business persona that best matches their system behavior. GRC Aura analyses your authorization assignments and shows the optimal FUE allocation.

What is the difference between FUE and PUPM?

FUE (Full User Equivalent) is the older license unit used in SAP RISE and S/4HANA on-prem migrations. PUPM (Per User Per Month) is the new SAP Cloud ERP licensing model where each user is billed monthly based on assigned Business Catalogs. GRC Aura supports both models and helps optimize licensing under PUPM by showing which Catalogs are actually used.

How much can I save with GRC Aura?

Based on GRC Advisory consulting data, customers typically reduce SAP Cloud ERP licensing costs by 25 to 35 percent after optimization. The exact savings depend on the share of Advanced vs Core licenses, current downgrade potential, and PUPM rate negotiated with SAP. Use the free ROI Calculator at grcaura.com/calculator to estimate your savings in 2 minutes.

Does GRC Aura connect directly to my SAP tenant?

Yes. GRC Aura connects to your SAP Cloud ERP (S/4HANA Cloud Public Edition) tenant via standard SAP APIs. Setup typically takes 3 to 4 days. Read-only access — GRC Aura does not modify your SAP system. Pilot setup is free.

Who is behind GRC Aura?

GRC Aura is built by GRC Advisory Sp. z o.o., a Poland-based SAP Security and GRC consulting firm with multi-year experience in SAP authorization, role design, and license optimization. GRC Advisory holds ISO 27001 certification and is an authorized SAP partner.

SAP Cloud ERP · License Intelligence

SAP Cloud ERP License Optimization — FUE & PUPM Intelligence

SAP Cloud ERP (formerly SAP S/4HANA Cloud Public Edition) licenses are billed by PUPM – per user, per month, based on assigned Business Catalogs. GRC Aura shows what is actually used so every license tier you pay for is backed by real activity.

Calculate your savings →

3–4

Days to connect

Day 1

First savings visible

Changes to SAP

Read-only

API access

What you see on day one

Four answers your license manager cannot give you

SAP Cloud ERP tells you what you assigned. GRC Aura tells you what is actually used: per user, per role, per Business Catalog.

Users with unused roles

Exactly who carries role assignments that never appear in the Security Audit Log. Revoke with evidence, not guesswork.

Users with downgrade potential

Advanced-licensed users whose real activity fits Core or Self-Service. Every downgrade is a recoverable FUE.

FUE savings estimate

Quantified recoverable FUE per user and per role, refreshed for the period you care about: 1 month to 2 years.

PUPM license view

Catalog-level usage: which Business Catalogs are actually opened, which push users into higher tiers, and which are assigned but never touched.

How it works

From raw SAP data to actionable intelligence

GRC Aura correlates three standard SAP Cloud ERP data sources into a single, clear picture of real license usage.

SAP Security Audit Log

Captures real user actions: which Fiori apps are actually opened.

Business Users & Roles APIs

User → Role → Catalog → App mapping.

SAP Fiori Reference Library

App metadata and pricing categories per release.

GRC Aura Dashboards

Users · Roles · Applications · Actionable insights.

Setup time

Typically 3 to 4 days to configure in SAP Cloud ERP.

Connection type

OAuth 2.0 (preferred) or Basic Auth depending on the API endpoint.

Release aware

Aura tracks Fiori app versions for your SAP release automatically.

Historical data

Analyze 1 month, 6 months, 1 year, or selected calendar years.

The manual way vs. the Aura way

SAP gives you a spreadsheet. GRC Aura gives you the answer.

SAP's official tool for determining user license types in SAP Cloud ERP is a manual Excel worksheet - roles, task mappings, workshops, and guesswork. GRC Aura replaces the guesswork with actual usage data.

Without GRC Aura

SAP User Type Mapping Worksheet

SAP's official approach: a multi-tab Excel file with 29+ predefined roles, hundreds of task-to-license mappings, and a summary tab that estimates user counts by type. You fill it in manually - role by role, person by person.

Requires workshops with security consultants, functional consultants, and business stakeholders
Based on what people should do - not what they actually do
A snapshot - outdated the moment someone changes roles
SAP itself labels it "Beta" and notes it does not guarantee accuracy
Result: best-case estimate, worst-case expensive over-licensing locked in for 3–5 years

USER TYPE MAPPING WORKSHEET (BETA)

Task / ObjectUser typeR001R002R003R004R005

Employee self-service requisitioningSelf Service×××××

Create purchase requisitionsOperational××

Accounts payable processingFIN Base×

… 200+ more rows across 6 worksheets

With GRC Aura

Actual usage. Per user. Per catalog. Updated daily.

GRC Aura reads your SAP Cloud ERP Security Audit Log and Business Roles API. Instead of estimating what each person might need, it shows what they actually used - in the last 30 days, 6 months, or 2 years.

No workshops. No spreadsheets. No consultants needed to fill in the matrix.
Based on real Fiori app launches - not role assignments or job descriptions
Live - flags changes as they happen, not once a year at renewal
Shows the delta: what license you pay for vs. what the data justifies
Result: exact list of users to downgrade, with evidence, ready to act on

UserAssigned tierUsed tierLast activityAction

J. Kowalski FIN Premium Self Service 214 days ago Downgrade ↓

M. Nowak FIN Premium Operational 3 days ago Downgrade ↓

A. Wiśniewska Operational Operational Today ✓ OK

💡 47 users can be downgraded · estimated saving €38,400 / year

Want to see it with sample data first?

Interactive demo of a 591-user tenant. No signup, no SAP connection, no emails. Explore the same tabs and filters your team would use on day one.

Open the demo →

Setup

Connected in 3 steps

GRC Aura connects via standard SAP Cloud ERP APIs. No agents. No middleware. Nothing to install on your system.

Step 1

Communication user

Open Maintain Communication User in SAP Cloud ERP. Create a dedicated communication user for Aura API access and record the credentials securely.

Step 2

Communication system & arrangement

Create a Communication System (inbound, no host required). Configure Communication Arrangements: OAuth 2.0 for most APIs, Basic Auth for others.

Step 3

Validate & connect

Test each endpoint using the Service URL from Communication Arrangements. Once validated, Aura begins pulling data immediately.

Knowledge hub

Understand SAP licensing before it costs you

In-depth articles from the GRC Advisory team - the mechanics of FUE and PUPM, real project cases, and how to embed license intelligence into your access process.

Browse all articles → FUE → PUPM guide

30-day pilot

Test GRC Aura on your real SAP data before committing.

Every engagement starts with a structured 30-day pilot. We connect to your SAP Cloud ERP tenant, you validate the results. Subscription starts only after you've seen the data.

Initial call & NDA

We start with a short call to confirm your environment and scope. Before any data is shared, we sign a mutual NDA - standard practice when working with SAP Security Audit Log data. This typically takes 2–3 business days to complete.

Download our standard NDA template (.docx) → - mutual confidentiality, no penalties clause.

Technical connection

Your SAP admin creates a dedicated read-only Communication User. We configure GRC Aura against your tenant - no changes to your SAP Cloud ERP system, no agents installed, no write access. Typically completed within 3–4 business days of credentials being provided.

Deployment options: ✓ Hosted on your BTP (recommended) - Aura runs inside your SAP landscape, data never leaves your environment. ◦ Hosted by GRC Advisory (Google Cloud) - we connect read-only to your SAP APIs, process data in our secure environment. Suitable where BTP is not available.

First data visible within a few days

GRC Aura begins processing your Security Audit Log and role assignments. A first dashboard with license usage per user and role becomes available - on your actual data. We walk you through the findings in a short call.

30 days to validate

You have 30 days to review the data, discuss findings with your license manager or SAP team, and assess the savings potential against your specific contract situation. At the end of the pilot, you decide whether to subscribe. If not - we disconnect, no invoice.

Interested in a pilot? Tell us the basics - we'll confirm fit and send the NDA within one business day.

Prefer email? Write to us directly →

Estimate

3 numbers, instant savings estimate

Enter your total SAP user count, the share of Advanced licenses, and your average FUE cost. The calculator runs locally. Aggregated inputs are sent anonymously to Google Analytics. No personal data collected.

👥 SAP users (total) Headcount with any SAP licence

📊 % Advanced licences Share on highest-cost PUPM tier

💶 Monthly rate (€/user/month) Your negotiated PUPM rate · typically €35–90

Downgrade potential: 25%

Enter your organisation's data to see estimated annual savings.

📅 Book a savings review → Try interactive demo →

Pricing

Simple pricing based on tenant size

One price per SAP Cloud ERP tenant, scaled by user count. No per-seat fees, no setup costs. Billed annually. Every engagement starts with a 30-day pilot - subscription begins only after you've validated the results.

Essentials

First savings visibility. Instant ROI.

^€500 / month

Billed annually (€6,000/yr) · 1 SAP Cloud ERP tenant · up to 500 users

Pay upfront → €5,700/yr

✓Per-user license view
✓Savings estimate
✓1 month of history
✓Email support

Request a pilot →

Starter

Who is over-licensed right now?

^€800 / month

Billed annually (€9,600/yr) · 1 SAP Cloud ERP tenant · up to 1,000 users

Pay upfront → €8,640/yr

✓ Per-user license view
✓ Role-level cost view
✓ Savings estimate
✓ 3 months of history
✓ Email support

Request a pilot →

Get your FUE savings report

Tell us about your tenant and we will send a sample analysis showing where your FUE budget is stuck. No obligation, no sales call unless you want one.

No agents

Standard SAP APIs only.

Instant insight

Savings visible on first login.

Zero risk

Read-only. No changes to SAP.

Prefer a live walkthrough? Book a call →

Partner Program

Grow your SAP practice with GRC Aura

Advisory firms and system integrators can extend their offering with GRC Aura - Reseller and VAR models, transparent margins, 24-month pipeline protection.

View partner program → Download Partner Guide PDF →