Updated 31 October 2026
Firefighter access gives someone temporary, elevated rights for an emergency. It only holds up if every use has a reason, an owner and a log that someone independent reviews.
Who does what
| Role | What they do |
|---|---|
| Firefighter | Uses the access, and gives a reason each time |
| Owner | Decides who may use the firefighter ID |
| Controller | Reviews the log of what was done |
In SAP Access Control, this is part of Emergency Access Management. Without it, the same three responsibilities still have to be covered by someone.
A simple procedure
- RequestSomeone asks for access, with a reason and preferably a ticket number.
- ApproveThe owner approves, or confirms straight afterwards in a real emergency.
- UseAccess runs for a limited time, for that task only.
- LogEverything is recorded, through the firefighter log or the Security Audit Log.
- ReviewAn independent controller compares what was done with the reason given.
- Follow upOdd activity gets a question. Frequent use of the same access gets a role fix.
What auditors usually ask
- Who can use it, and who approved that list?
- Does each use have a sensible reason?
- Was each log reviewed, and how soon?
- Was the reviewer independent of the user?
Common mistakes
- Firefighter access that has become everyday access
- Reasons like "support" that say nothing
- Logs that are signed in bulk once a quarter
- A shared login, so you can't see who was behind it
If the same firefighter ID is used every week, the emergency is really a missing role. Fix the role, and the firefighter log gets shorter.
Questions about firefighter access
What is a firefighter ID in SAP?
A firefighter ID is a temporary account with elevated access for emergencies. It is usually managed with Emergency Access Management in SAP Access Control.
Who should review firefighter logs?
Someone independent of the person who used the access, usually a controller who understands the process. Reviewing your own use proves little.
Can we do this without SAP GRC?
Yes, though it takes more discipline. You need a time-limited assignment, an approved request, the Security Audit Log switched on and a documented review of each use.
