Request a trial
Menu
Products
Solutions
ERP
Authentication
Apps
LearnDocsWhy SSOGENRequest a trial

SSOGEN / Learn / EBS Archive Instance Access: Your Old Oracle EBS After the Move to Fusion

Learn

EBS Archive Instance Access: Your Old Oracle EBS After the Move to Fusion

After the move to Oracle Fusion Cloud ERP, the old E-Business Suite stays online and read-only for years. Plan who signs in to it, how, and until when.

Updated

Request More Info

EBS archive instance access is the plan for who can still sign in to the old Oracle E-Business Suite after the move to Oracle Fusion Cloud ERP. The archive usually stays online and read-only for years, because tax, audit and legal records live in it.

The people who need it change. The project team leaves, and outside auditors arrive once a year. The sign-in layer ages too: Premier Support for Oracle Access Management 12.2.x ends in December 2026.

Why does the old EBS stay online after cut-over?

When closed years stay in EBS instead of moving to Fusion, the archive must answer questions about them. It stays online until the last retention period for those records ends.

  • Tax records. IRS guidance lists 3 years in general. It lists 6 years when unreported income exceeds 25 percent of the gross income on the return, and 7 years for a loss from worthless securities or a bad debt deduction.
  • No end date. The IRS says to keep records indefinitely when no return was filed or a return was fraudulent.
  • Employment tax. Payroll records are kept at least 4 years after the tax is due or paid, whichever is later.
  • Your policy decides. The organization’s retention policy, set with legal and tax advisers, fixes the period per record type. The archive lives as long as its longest line.

Oracle states that Premier Support for EBS 12.2 runs through at least 2037, so a 12.2 archive can stay on a supported release through at least that year.

Who needs the archive, how they sign in, and for how long

Six groups need the archive: finance and tax staff, internal audit, external auditors, former project staff, EBS administrators and legal. Each has its own sign-in and end date.

Who Sign-in Until
Finance and tax staff Company provider Role ends
Internal audit Company provider Each audit
External auditors Firm’s provider or hosted account Audit window
Former project staff Hosted account One task
EBS administrators Company provider; SYSADMIN locally Archive shutdown
Legal and e-discovery Company provider Hold released

“Company provider” is the identity provider staff already use for Fusion. External auditors need the archive for year-end and statutory audits, for example a six-week window. Former project staff answer one named question about a conversion.

The table has one rule in every row: nobody signs in with an EBS password that a person must remember for years.

What breaks access to an archive instance?

Four things break archive access: an access manager past support, VPN accounts for outsiders, accounts of people who left, and passwords nobody remembers.

  • The access manager reaches end of support. Oracle’s Lifetime Support Policy dated April 13, 2026 lists Oracle Access Management 12.2.x with Premier Support ending December 2026 and Extended Support ending December 2027. Oracle Internet Directory 12.2.x has the same dates. Staying on OAM means an upgrade project, and a support contract, on a system you are retiring.
  • VPN accounts for outsiders. An external auditor needs a VPN account, a client on a laptop the firm controls, and a security review, for a few weeks of read-only work.
  • People who left. Accounts of the project team stay active in EBS, or their sign-in identity is gone, and nobody knows which users still matter.
  • Forgotten passwords. A finance analyst who opens the archive twice a year will not remember a separate EBS password.

How to give auditors read-only access without OAM or a VPN

Move sign-in to the company’s identity provider, give each outsider an identity you can switch off, and let EBS enforce read-only access and end dates.

  1. Replace the access manager. Put single sign-on on the archive’s web tier that does not depend on OAM or OID, and connect it to the identity provider your staff use for Fusion.
  2. Publish the archive without a VPN. Expose only the archive’s web application, with sign-in and policy in front, instead of putting the auditor’s laptop on your network.
  3. Give outsiders their own identity. Federate with the audit firm’s identity provider, or host each auditor’s account and invite them by email. Never share one login across a firm.
  4. Create read-only responsibilities. From EBS Release 12.2.6, a grant of the “EBS Read Only” permission set makes forms read-only per responsibility, user, organization or group. A form function with QUERY_ONLY=YES opens the form in query-only mode.
  5. Set end dates in EBS. EBS 12.2 lets you end-date a user and each responsibility assignment. Users and responsibilities cannot be deleted, which keeps the audit trail.
  6. End the outside identity on the same day. Disable the auditor’s sign-in account when the audit window closes, so the EBS end date and the sign-in agree.
  7. Keep the audit trail. Record every sign-in to the archive and keep the log for the same retention period as the data.

A worked example: an external audit of the Acme archive

One auditor gets one read-only responsibility, one window and two independent stops. Acme kept EBS 12.2 at https://ebs-archive.acme.example after its move to Fusion. Maria Lopez leads internal audit; James Carter is the external auditor.

Date Step Control
Feb 2 Maria requests access for James, Feb 9 to Mar 20 Named owner, written window
Feb 5 EBS user JCARTER, end date Mar 20, one read-only responsibility EBS end date, “EBS Read Only”
Feb 6 James added as an outside user to the archive’s group Assignment
Feb 9 He signs in from a browser with a second factor No VPN, no EBS password
Feb 9 to Mar 20 Queries and reports; every sign-in logged Audit trail
Mar 20 His sign-in account is disabled; the EBS end date is reached Two stops

The two stops do not depend on each other. If one is missed, the other still closes the archive to him.

What to check before the archive goes read-only

Check six things before the archive goes read-only:

  • A list of EBS users who will keep access, each with an owner and an end date. End-date everyone else.
  • Read-only responsibilities tested with a real auditor’s tasks: queries, reports and exports.
  • The local login. SYSADMIN still signs in at /OA_HTML/AppsLocalLogin.jsp for break-glass work.
  • User names match. The identity the sign-in layer sends equals the EBS user name.
  • Fusion and the archive share one sign-in, so a leaver loses both on the same day.
  • The audit log retention matches the longest record retention period.

How SSOGEN signs people in to an archived EBS

SSOGEN provides single sign-on for Oracle EBS without OAM or OID, and the same sign-in serves the archive and Oracle Fusion Cloud ERP.

  • On the EBS web tier. The SSOGEN Web Agent runs in the Oracle HTTP Server and uses the AccessGate application that ships with EBS. People land as their own EBS user, with their own responsibilities.
  • User names. The agent sends the signed-in identity in capitals, so jcarter arrives as JCARTER. That must equal the EBS user name.
  • Your provider. EBS signs in through SSOGEN or straight through your SAML or OpenID Connect provider, such as Microsoft Entra ID, Okta or AD FS. SYSADMIN keeps the local login.
  • Outside users. An audit firm’s own provider can be a connection that creates people as Partner or Contractor and adds them to a group. People without a provider are imported from a CSV file, and each gets an email to set a password, or an emailed sign-in link. See customer identity.
  • Who gets in. Assignment and the application’s sign-in policy decide, at every sign-in. Disabling a user ends their sessions.
  • Without a VPN. The SSOGEN Gateway publishes internal web applications in the browser; see access without a VPN.
  • Records. Every sign-in and refusal goes to the audit log, whose hash chain an administrator can check at any time; a daily schedule checks it too.

Questions people ask

How long do you keep an old EBS instance after moving to Fusion?

As long as the longest retention period for the records it holds. IRS guidance ranges from 3 years in general to 7 years for bad debt and worthless securities claims, and indefinitely for unfiled or fraudulent returns. Your organization’s retention policy sets the actual period for each record type, and the archive stays until the last one ends.

Can auditors get read-only access to Oracle EBS?

Yes. From EBS Release 12.2.6, granting the “EBS Read Only” permission set makes forms read-only for a responsibility, a user, an organization or a group. A form function with QUERY_ONLY=YES also opens a form in query-only mode. Give auditors a dedicated read-only responsibility with an end date, and test it with their real tasks.

Do you still need Oracle Access Manager for an archived EBS?

No. EBS needs a sign-in layer, not OAM in particular. Premier Support for Oracle Access Management 12.2.x ends in December 2026, so keeping it means an upgrade on a system you are retiring. Single sign-on through Oracle’s AccessGate and your company identity provider does the same job, with no OAM or OID to upgrade.

Can external auditors reach the archive without a VPN?

Yes. Publish only the archive’s web application, with sign-in, a second factor and a policy in front, and the auditor uses a browser. The auditor’s laptop never joins your network, and access is checked at each sign-in. Give each auditor their own identity, from their firm’s provider or a hosted account, never a shared login.

What happens to the EBS accounts of people who left?

They should be end-dated. EBS does not delete users, so the record stays for the audit trail, but an end date stops sign-in. When EBS sign-in runs through the company identity provider, a leaver who is disabled there cannot reach the archive either, even before anyone touches EBS.

Where to go next

Sources, all read 2026-11-13: