An example embodiment may involve a software application executable on a computing device of a computational instance of a remote network management platform associated with a managed network. The managed network may contain an enterprise resource planning (ERP) system comprised of computing devices of the managed network on which ERP software is executable. The managed network may be granted a number of authorizations to access the ERP system and capabilities thereof. The ERP system may store user-related data for individual users of the managed network who access the ERP system. The software application may communicate with one or more of the ERP clients to access the user-related data, use a set of compliance criteria to identify, within the user-related data, a set of users, and store in memory an indication identifying the set of users as a potential source of non-compliance with the number of authorizations.