Internal dashboard for 200+ users with RBAC and SAP S/4HANA integration, Next.js + Microsoft Entra ID SSO. Weekly KPI report preparation went from 6 hours to 0.
Background
The client is a Hungarian public-sector organization with 1500+ employees and complex internal data flows. SAP S/4HANA is the main ERP, alongside several legacy systems (an Oracle-based document repository, a custom workflow tool, and Excel-based KPI tracking).
Mid-level managers received weekly and monthly KPI reports prepared by hand: support staff exported from SAP into Excel, formatted, and assembled into PowerPoint decks. Across teams this consumed 6–8 hours per week, and reports always lagged 1–2 days.
Challenge
Two main challenges. (1) Compliance: they operate under ISO 27001, and every data movement and user action must be auditable. The existing SAP-export-to-Excel flow was acceptable because it was manual — an automated system needed similar audit log strictness. (2) RBAC: 200+ users split into 8 functional roles with different data access. The data-handling policy is strict: each role can only see data for specific organizational units.
The technical challenge was smaller than the process side. The IT team's 6-week internal approval cycle for any configuration change was an obstacle.
Approach
Phased rollout: pilot on 2 functional roles (25 users), then 4 weeks later 3 more roles, finally the full 8 roles.
The discovery phase invested 4 weeks in the RBAC matrix and compliance requirements. Everything had to be written down and signed off by the client's internal audit team. Slow phase due to IT involvement, but unavoidable — a poorly designed RBAC would have meant 2–3 months of refactoring later.
Solution
The dashboard is Next.js + TypeScript with Tailwind UI. Main components: (1) Auth via Microsoft Entra ID SSO, with role resolution based on existing AD membership. (2) KPI tiles in an organic grid, drag-and-drop configurable per role. (3) Drill-down view openable from a tile (source data in a table, exportable). (4) Audit log view (admin role) that records every data access.
The backend has a flexible data source config: the main source is SAP S/4HANA OData services, alongside Oracle document store via REST and a few team-specific Postgres databases. An aggregator layer runs scheduled refreshes (5 minutes to 1 hour TTL by data type). The audit log goes into a separate Postgres DB, immutable append-only.
Tech decisions
Microsoft Entra ID SSO: not a choice, the client's compliance required it. NextAuth is the bridge layer, enforcing role-level permissions through JWT claims.
Next.js vs SAP UI5 / Fiori: Fiori was strongly opposed by the CIO ('we're buying building tools now, not aligning to the core system paradigm'). Next.js is the in-house stack, the development cycle is more flexible, and integration with non-SAP systems is simpler.
Separate audit log DB: this is the solution that preserves audit log integrity even if the main DB is compromised. PostgreSQL with role-restricted append-only and daily backups.
Bumps
First hurdle: IT team approval cycles. Every Entra ID config change took 4–6 weeks. Workaround: in the first weeks we asked for a dedicated test tenant where we configured everything ourselves, only switching to production at cutover. Saved 3 weeks.
Second: RBAC matrix complexity. The original 8 roles expanded to 12 during execution because some roles had sub-roles. We refactored: introduced the 'permission set' concept that a role inherits. Now 8 roles + 24 permission sets, scaling better.
Third: SAP OData performance at peak hours. The 8–9am KPI refresh hit 200+ users at once and OData services throttled. We added a 'pre-warm cache' layer in the aggregator: the most-requested KPIs pre-aggregate at 7:45.
Results
Six months after go-live: 200 users active (215 against the planned 200+). Weekly KPI report preparation went from 6–8 hours to 0 (the report now generates automatically from the dashboard). Mid-level managers see KPIs in real time, not with a 1–2 day lag.
The audit log covers 100% of access. ISO 27001 internal audit passed; the external auditor specifically cited the audit-log mechanism. Data accuracy incidents (incorrectly exported Excel reports) dropped 91% vs baseline (from 8–10 monthly to 0–1).
Stack
18 weeks is long, but nobody feels they got the system 'foisted' on them. Discovery's 4 weeks were expensive in time, but in hindsight that's why it works.
Administrative director — Public sector organization
The quote represents typical client feedback; it is not a verbatim citation.
Related
We eliminated 4–6 daily hours of manual Excel transfers at a Central European logistics company: REST/OData interfaces from SAP ERP and a Next.js admin UI for daily operations. The back-office team reclaimed 3 FTE for other work.
Read detailsA React Native cross-platform mobile app with appointment booking, lab result downloads and push notifications. 60% of appointments now happen in the app, and call-center load dropped 24%.
Read detailsCase studies are based on real projects, anonymized at our clients' request. Numbers are approximations; specific business data remains confidential.