Quick answer
- **SAP GRC Access Control** — on-premise, mature, deep SoD ruleset for ECC & S/4HANA.
- **SAP IAG** — cloud-native on SAP BTP, governs access across SAP + non-SAP cloud apps (SuccessFactors, Ariba, Concur, AWS, Azure).
Architecture
GRC runs on NetWeaver ABAP and integrates via RFC. IAG runs on BTP, uses Identity Provisioning Service (IPS) and Identity Authentication Service (IAS), and connects via cloud connectors.
Which to learn first?
If you are new, learn GRC Access Control first — most enterprises still run it and the concepts (risk analysis, mitigation, emergency access) map directly to IAG. Then extend into IAG for cloud-first companies.
Job market
IAG demand is rising 3x year-over-year as customers move to RISE with SAP. Consultants who know both GRC + IAG command a 30–40% salary premium.