A finance manager got separated on a Friday. By Monday, IT disabled all her access: Microsoft Entra account, mailbox, Teams and SharePoint accesses are gone. Every dashboard shows her as fully offboarded.
Three weeks later, a quarterly access review tells a different story. Her user is still live in the on-premises S/4HANA system, still carrying authorizations to post journal entries and release vendor payments. Entra never knew that SAP account existed. SAP GRC Access Control never heard she had left the company.
Reason - The systems simply were not talking to each other. And that quiet gap between them is where a surprising amount of identity risk actually lives.