SAP Business One licences for scanner and app users: named user and Indirect Access explained

The rule: named users, also indirectly.

SAP Business One is licensed per named user. SAP's licence guide defines one as an employee of the customer, a subsidiary or a third party "who is authorized to access, directly or indirectly, the licensed SAP Business One software". Two consequences follow. Employees may not share one user name to log on, and "directly or indirectly" means that a person who only ever sees B1 through another program is still a named user in SAP's eyes.

Since version 9.2 the logon limitation also applies to the DI API and to Indirect Access licences: one named user, one session. A named user can also run add-ons on only one machine at a time.

The licence types.

• Professional: everything. The planner, the controller, the key user.
• Limited CRM, Limited Logistics, Limited Financials: a fixed subset of modules at a lower price. Limited Logistics covers sales, purchasing, inventory and production for someone who never opens the general ledger.
• Starter Package: the small-company edition, with its own user type. SAP's guide says a Starter Package key cannot be combined with other user licences; since feature package 2008, Indirect Access is the exception and can work alongside it.
• Indirect Access: no B1 client at all. The user may reach B1 only through an add-on, the DI API or the Service Layer. It is the cheapest licence that lets a program log in as a user.

Two things people often don't know. Every user type already includes Indirect Access authorisation: the licence guide states that Professional, Limited and Starter users "all include Indirect Access authorizations", so a Professional user needs nothing extra to work through an add-on. And SAP's own mobile apps are "included in the normal SAP Business One user license"; what a user can do in the app depends on the licence they hold.

What Indirect Access is for.

An add-on or an integration logs in to B1 as a user, with a name and a password, whether it uses the old DI API or the Service Layer. That user needs a licence like any other, and Indirect Access is the one made for it: it allows the connection and refuses the B1 client. The SAP user behind a scanner server, a web shop link or a planning board is typically an Indirect Access user. Since feature package 2208 it can also work jointly with a DI Server licence.

The licence is not the only thing that user needs. It also needs the authorisations for what it posts (goods receipts, transfers, counting), and an app that uses saved queries through the Service Layer needs the two "SQL Query" authorisations as well. Your partner sets both.

How scanner add-ons have handled it for years.

The established scanning solutions for B1 use one technical SAP user per installation. Produmex Scan, the best-known one, puts it like this in its documentation: "For the Produmex Scan add-on no extra SBO license is needed", the service that posts is "assigned to one SBO user", that user needs "at least an SAP Indirect Access license", and the warehouse worker is a SAP employee, not a SAP user, who logs in on the device with an employee number or PIN. The employee number is written to a user-defined field on every document, so you can still see who scanned what.

That model has two advantages that explain why it became the norm. The technical user is the only SAP session, so eight scanners don't need eight concurrent sessions and eight Professional licences. And the B1 side stays simple: one user, one set of authorisations, one audit trail with the employee named on the document.

The honest part: what the add-on cannot promise.

SAP's licence guide says a named user is anyone who accesses B1 "directly or indirectly". The vendors' model has one technical user and many employees behind it. Nothing in SAP's public material reconciles the two in so many words. Whether your warehouse staff need a named user licence of their own on top of the technical user is therefore not something an add-on vendor can promise you, us included. It depends on your contract and on how your B1 partner, who sells and audits the licences, reads it.

So ask, in writing, before you roll out. Most partners will tell you the technical-user model is how scanning add-ons have been licensed for years. Some will want a Limited Logistics or an Indirect Access licence per person. Either way, it is their answer that counts at the audit, not a line on a vendor's website.

Technicians are a different case.

For a field service app the picture is simpler, and more expensive. A technician's check-in, signature and resolution text should be traceable to a person in B1 itself, so each technician works under their own named user. Someone who only uses the app can do with an Indirect Access licence; a planner who also works in the B1 client needs Professional or Limited. SAP's own Service app follows the same logic: it is included in the user licence, so every technician on it is a licensed user.

What to ask your partner.

• Which licence the technical user of the add-on gets, and which authorisations it needs for the documents it will post.
• Whether your scanner users or technicians need named licences of their own, which type, and the answer in writing.
• If you are on a Starter Package: that Indirect Access can be added to it (feature package 2008 or later), and what else cannot.
• Whether the Service Layer is installed and switched on, because the licence is useless without it.

What KScan, KFSM, KHRM and KCRM do.

KScan follows the established model: one technical SAP user with at least an Indirect Access licence, warehouse staff as SAP employees who log in on the scanner with a PIN, and the employee's name in the remark on every document posted. Which licences your staff need beyond that is a question for your partner, and the KScan page says so too. KFSM, our field service add-on, gives every technician their own named B1 user. The KFSM page explains why. KHRM, our personnel system, uses one technical SAP user for the link, like KScan; employees sign in to KHRM, not to B1. There too, which licences your people need beyond that is a conversation with your partner (the KHRM page). KCRM, our CRM for sales people, works the same way: one technical SAP user for the link, and sales people who sign in to KCRM and are each linked to their own sales person code in B1. Which licences your sales people need beyond that you discuss with your partner (the KCRM page). More about CRM in B1 is in the CRM guide.

Sources: SAP Business One License Guide 10.0 (named user model, logon limitations, licence types, Starter Package, mobile apps); SAP Business One What's New for feature packages 2008 and 2208; Produmex Scan implementation documentation (licensing, Service Broker). Quotations are in English because the source documents are.