Review Sage 100 Users and Roles

Sage 100 allows companies to create security roles that control access to companies, modules, menus, tasks, and system permissions. A security review should confirm that user access still aligns with actual job responsibilities and that employees only have access required for their day-to-day work.

Organizations should also review access to sensitive modules, company maintenance settings, and security configuration areas. Users with multiple overlapping roles or excessive permissions may introduce unnecessary risk if access has expanded over time without review.

Limit Administrator Access

Administrator access should be restricted to a small number of trusted users and reviewed regularly. Companies should confirm that administrative rights are still necessary, remove outdated access for former employees or consultants, and avoid using shared administrator accounts whenever possible.

Administrative privileges should not be used for routine processing tasks unless absolutely required. Limiting elevated access helps reduce both accidental changes and security exposure.

Validate Backups and Disaster Recovery

Backups are a critical part of ERP security and business continuity planning. If data is damaged, encrypted, deleted, or lost, the recovery process becomes just as important as preventing the issue in the first place.

Companies should confirm that Sage 100 data, custom reports, integration folders, and related repositories are included in backup planning where appropriate. Backup files should be stored separately from the production environment, and restore testing should be performed periodically to confirm recovery procedures actually work when needed.

Review Third-Party Integrations

Many Sage 100 environments include third-party applications for EDI, shipping, reporting, warehouse management, payment processing, and other operational functions. These integrations should be reviewed regularly to confirm they are still required, properly secured, and included in upgrade and backup planning.

Organizations should also review how integrations connect to Sage 100, what level of access they require, and whether dedicated accounts are being used instead of standard employee credentials. Unused integrations or outdated access points should be removed when no longer needed.

Secure Remote Access

Many Sage 100 environments rely on Remote Desktop Services, Citrix, or hosted desktop environments for remote access. Because these systems often serve as the primary entry point into the ERP environment, they should be reviewed carefully as part of an overall security strategy.

Areas commonly reviewed include multi-factor authentication, remote desktop permissions, idle session timeout policies, consultant access, and controls around file transfers or shared clipboard access. Companies should also confirm that former employees no longer retain remote login access.

Sage documentation also includes environment-specific considerations for Remote Desktop Services and Citrix deployments, including workstation and server configuration recommendations.

Stay Current and Supported

Running unsupported software can increase both security and operational risk. Companies should periodically review their Sage 100 version, Windows Server compatibility, workstation requirements, and third-party enhancement compatibility to confirm their environment remains supported.

Upgrade planning is especially important for organizations preparing for Sage 100 2026, which is a 64-bit only release and may require additional planning for environments still running older 32-bit components. Reviewing upgrade readiness early can help reduce disruption and avoid compatibility surprises later in the process.