Hybrid & Cloud
Segregation of Duties (SoD)
Automatically prevent permission conflicts before risks arise
Users who request permissions should not be able to approve them themselves. And anyone who approves payments should not be able to change master data on their own. With FirstWare IDM-Portal, you embed Segregation of Duties rule sets directly into your daily IAM processes – reliably across cloud, SaaS and on-premise systems.
Made in Germany
DSGVO- & NIS2-konform
25 Jahre IAM Experts
Vendor- & cloud-independent
When permission combinations become a risk
Reality Check:
When permission conflicts become a risk
Department changes, deputies and special assignments can cause permissions to accumulate unnoticed. Critical combinations open the door to misuse and compliance violations.
Critical permission accumulation
Role changes accumulate permissions instead of cleaning them up, resulting in toxic combinations.
Risk of misuse & fraud
Creation, approval and execution in one pair of hands: control mechanisms are missing.
Manual checks cannot keep up
Across multiple systems such as Entra ID, SAP and on-premise environments, combinations can no longer be monitored manually.
Unwelcome surprises during audits
An auditor uncovers policy violations, resulting in costly rework and liability risks.
Segregation of Duties with the IDM-Portal
Prevention through
real-time conflict detection
Prevent toxic combinations from occurring in the first place
FirstWare IDM-Portal checks every access request, every assignment and every role change against predefined SoD rule sets at the point of entry. When a person tries to obtain a permission that conflicts with their existing rights, such as being requester and approver at the same time, the system automatically blocks the assignment. This helps you prevent compliance violations proactively instead of having to resolve them later with considerable effort.
Role-based segregation of duties
(RBAC & ABAC)
Binding rules for your organization
Easily define in the portal which roles, groups or attributes must not be combined. Whether you want to map policies for separating development and production or approval limits relevant to finance, FirstWare IDM-Portal automatically enforces your governance requirements – for human users as well as non-human identities such as service accounts and AI agents.
Integrated approval workflows &
exception handling
Deliberate decisions with clear accountability
When a policy exception is operationally unavoidable, the request is not left unattended in the system. The portal enforces multi-stage approval workflows, involves risk owners and documents the time-limited exception. Accountability remains exactly where it belongs – with the business departments and risk management.
Automated cleanup &
audit readiness
Simple preparation for ISO 27001, NIS2 & BAIT
The IDM-Portal transparently reveals historical SoD conflicts or conflicts caused by manual system changes. With automated recertification and deprovisioning processes, you can revoke unauthorized permissions at the push of a button. Every rule set and every conflict resolution is logged in a tamper-proof way – for smoother compliance audits.
What is FirstWare IDM-Portal?
Flexible IAM solution for Identity Governance & Administration
FirstWare IDM-Portal is a user-friendly IAM solution for automated provisioning and lifecycle management of all identities and groups in complex, hybrid IT landscapes.
Powered by my-IAM – the underlying technology platform that enables seamless integration of any IT systems and cloud services.
One rule set for your entire IT landscape
Whether cloud-native, hybrid or on-premise – segregation of duties only works when it does not stop at system boundaries. FirstWare IDM-Portal centrally monitors SoD rules across all your directories and applications:
HR source systems
Personio, SAP SuccessFactors, SD Worx
Identity Provider & Directories
Microsoft Entra ID, Active Directory, Keycloak
Spezial- & Fachanwendungen
Cloud SaaS, databases and industry software via API/CSV
Your benefits
Automatic protection against conflicts
Real-time checks for access requests
Reduced security & fraud risks
Audit-ready at the push of a button
Relieve IT through clear delegation
Made in
Germany
Frequently Asked Questions
Frequently asked questions about Segregation of Duties, the clear separation of critical tasks, secure permission structures and the prevention of conflicts of interest with FirstWare IDM-Portal.
What does Segregation of Duties (SoD) mean in identity management?
Segregation of Duties is a core control element of access governance. It ensures that critical tasks and permissions are distributed across multiple people to prevent conflicts of interest, errors and intentional misuse.
How does FirstWare IDM-Portal prevent SoD conflicts?
The portal checks requests and permission assignments against defined rule sets in real time. When a user requests a role or group that conflicts with their existing rights, the assignment is either not executed at all or is routed for explicit exception approval.
What happens when an SoD conflict is operationally unavoidable?
For justified exceptional situations, the IDM-Portal enables controlled exception management. Exceptions can be granted for a limited time, require approval by defined risk owners and are fully logged for later audits.
Which regulations and standards require verifiable segregation of duties?
Regulatory frameworks such as NIS2, ISO 27001, GDPR, BSI IT-Grundschutz and finance- or healthcare-related requirements such as BAIT, VAIT and SoX require critical business processes to be secured through effective and verifiable segregation of duties.
Does segregation of duties also work in hybrid environments?
Yes. FirstWare IDM-Portal checks and controls rule sets across systems, regardless of whether identities and groups are stored in local directories such as Active Directory, Microsoft Entra ID or specialized applications.
Let's Talk
Sustainably eliminate permission conflicts and audit risks
Let us review together how you can implement Segregation of Duties (SoD) in your organization in an automated way and without bureaucratic effort.
Call us at 0 8196 - 998 4330 or use our contact form.