Provisioning Systems and Initial Setup

Objective

After completing this lesson, you will be able to navigate the system provisioning process and initial setup tasks

Initial Onboarding Communications for SAP S/4HANA Cloud

After signing the SAP S/4HANA Cloud contract, the designated signer (typically a CTO, CIO, or executive) receives a purchase order confirmation email within twenty four hours. This message includes essential purchase details and outlines the immediate next steps in the process.

Identifying the IT Contact

The IT Contact serves as the customer’s system administrator. This individual is responsible for receiving all system provisioning notifications and technical communications regarding the environment. On the contract start date, the IT Contact receives a "Welcome" email with important system information.

Key points regarding the IT Contact:

  • Initial Assignment: If an IT Contact was not specified during the contract signing, only the signer receives the "Welcome" email.
  • Knowledge Sharing: Because the welcome email is sent only once and cannot be resent, the designated system administrator must be informed of its contents even if they were not the original recipient.
  • Updating the IT Contact: Only one person can hold the IT Contact role. If the role needs to be reassigned, you must create a support case in the SAP for Me portal via the Services & Support dashboard with the following details:
    • Subject: Request update to the Contact Person IT
    • Description: Please change the IT Contact to [Name], [Email Address]
    • Component: XX-S4C-OPR-SRV

Note

While only one person can be the IT Contact, multiple individuals can be assigned as Communication Contacts to receive general system-related updates.

Screenshots of the initial onboarding communications to customers.

Onboarding Resources and Support

In addition to the SAP S/4HANA Cloud welcome email, customers will also receive a separate welcome email for the SAP Business Technology Platform (SAP BTP).

To ensure a smooth transition, SAP provides the Customer Onboarding Resource Center. This website documents all the critical information contained in the welcome emails and includes free webinars to enable customer administrators in provisioning systems and setting up authorizations.

We strongly recommend that core members of the project team attend an onboarding webinar to ensure everyone is on the same page. These sessions provide a high-level overview of available resources and a clear roadmap for the upcoming implementation steps.

Screenshot of the Onboarding Resource Center

System Provisioning in SAP for Me

Initial System Bundle

The IT Contact initiates the provisioning process from SAP for Me → Systems & Provisioning Dashboard → SAP S/4HANA Cloud Landscape. Several core systems are provisioned as part of the initial bundle:

  • SAP Cloud Identity Services: If the customer does not already have an account, a new service is automatically provisioned. If the organization already uses SAP Cloud Identity Services, they can connect the new systems to the existing account. New customers can select the data center region during this step.
  • SAP Cloud ALM: Used for managing the application lifecycle.
  • SAP Central Business Configuration: The central tool for configuring business processes.
  • SAP S/4HANA Cloud Starter System: This includes both customizing and development tenants.
Screenshot of system provisioning in SAP for Me.

Note

For first-time implementers, it's critical to activate the Identity Authentication Service first. Regardless of the order in which you receive system emails, you must use the Identity Authentication service to create users and assign the necessary permissions for all other provisioned systems.

To learn how to set up SAP Cloud Identity Services, check out the Identity Authentication documentation in SAP Help Portal.

Subsequent System Provisioning

After the Fit-to-Standard workshops have been completed in the Explore phase, the remaining systems can be provisioned:

  • SAP S/4HANA Cloud Development System (both customizing and development tenants)
  • SAP S/4HANA Cloud Test System
  • SAP S/4HANA Cloud Production System

    Note

    Provisioning the Production System triggers a 30-day countdown, after which the Starter System is automatically decommissioned. Do NOT provision the Production System until all Fit-to-Standard workshops are complete. If additional workshops are required after this point, customers may subscribe to an optional Sandbox System for a fee.

Try it yourself!

Learn how to request SAP Central Business Configuration via SAP for Me in this tutorial.

ExerciseStart Exercise

User Creation and Permission in SAP Cloud Identity

Assigning Initial Access to Systems

Once the initial systems are provisioned, the IT Contact must grant access to key project roles. This ensures the implementation team can begin configuration and project management activities immediately.

Graphic summarizing the roles who need access to different systems at the beginning of an implementation.

SAP Central Business Configuration Access

SAP Central Business Configuration is the primary tool for scoping and configuring the business processes of the solution.

  • Partner Lead Configuration Expert: Must receive access immediately to deploy business content into the SAP S/4HANA Cloud Starter System tenants.
  • Partner Line of Business (LoB) Configuration Experts: Will require access eventually to perform specific business process configurations. This can be assigned later in the project timeline.

SAP Cloud ALM Access

SAP Cloud ALM is used to manage the end-to-end implementation lifecycle, including task management and progress tracking.

  • Partner Project Manager: Requires immediate access to set up the implementation project and assign tasks to team members.
  • Customer Project Manager: Should be included during the initial setup to become familiar with using the tool for project oversight.
  • General Project Team (Partner and Customer): All members should eventually be granted access to view their assigned tasks and document their completion.

SAP S/HANA Cloud Starter System Access

The Starter System is used for demonstrating business process during the Fit-to-Standard workshops.

  • Partner LoB Configuration Experts: Access should be granted after the Lead Configuration Expert has deployed the business content. This allows them to prepare for their Fit-to-Standard Analysis workshops.
  • Partner Lead Configuration Expert: Also requires access to conduct workshops for cross-functional topics such as:
    • Organizational Structure
    • Two-Tier ERP
    • Human Resources (HR)

Overview of providing access to SAP Central Business Configuration

SAP Cloud Identity Services is a single suite that comprises two main components: Identity Authentication and Identity Provisioning.

Because these components function as distinct services, IT contacts must switch between two different administrative interfaces to provide user access for SAP Central Business Configuration.

Graphic summarizing how to provide users access to SAP Central Business Configuration.

Activate the user account in the SAP Identity Authentication Service

The IT Contact first activates the SAP Cloud Identity Authentication Service (IAS) via the link provided in the system provisioning email.

Screenshot of the Identity Authentication Service activation email.

Create CSV User Template

To provide users with access to SAP Central Business Configuration, the IT Contact must first create the user records and grant the necessary permissions. The most efficient way to manage this for a project team is through the Identity Authentication Service. While you can create users individually, mass-importing a CSV file allows you to create multiple users and assign permissions simultaneously.

The first step in this process is preparing the user data. The IT Contact should collect a list of all partner project team members requiring access, ensuring they have each person's first name, last name, and email address. Using this information, you will create a CSV (comma-separated value) template, typically managed in Microsoft Excel.

When building your template, it is critical that the column names, or attributes, align exactly with the naming structure defined in the SAP Help Portal documentation. You are not required to include every possible attribute in your file; however, you must include all mandatory attributes along with any optional fields you plan to use for your specific configuration. Preparing this file correctly ensures a smooth import process into the Identity Authentication service.

Example of a CSV file that could be used to create users and assign the correct permissions.
  1. Create a new Microsoft Excel spreadsheet and Save As → Comma Separated Value (.CSV).
  2. In the first row, enter the attributes: status, loginName, mail, firstName, lastName, and groups.
  3. The status should be active for all users
  4. Enter the information for each project team mmeber in the loginName, mail, firstName, and lastName fields. The IT Contact should add the information for their own user in a row, too.
  5. In the groups column, first check the latest roles that can be assigned in SAP Central Business Configuration and their authorized task activities.

Role Assignments

The partner lead configuration expert should be assigned the program manager role (SAP_CBC_CONSUMPTION_PROGRAM_LEAD), which provides the permission to create a new project and activate business content in the SAP S/4HANA Cloud starter system, in addition to the development system at a future point in time.

The IT Contact should assign themselves and the partner and customer project managers the auditor role (SAP_CBC_CONSUMPTION_AUDITOR), so they have visibility into the activities being completed in the system.

The partner LoB configuration experts should be assigned the key user role (SAP_CBC_CONSUMPTION_KEY_USER), so they have the ability to enter configuration values for the SAP S/4HANA Cloud development system when it eventually needs to be configured with the customer's data. It's not necessary to enter configuration values for the starter system, because this data is already populated, however the LoB experts should be able to look at the configuration activities in the starter system in preparation for their Fit-to-Standard workshops.

Import users to SAP Central Business Configuration

To grant access to SAP Central Business Configuration, the IT Contact must create user records and assign the appropriate permissions. While the Identity Authentication service allows for manual user creation through the User Management tile, the most efficient method for project teams is the bulk import process.

Using the Import Users tile to upload a CSV file offers two significant advantages:

  1. Efficiency: You can create multiple user accounts simultaneously rather than entering data for each individual.
  2. Consolidation: The import file allows you to both define the user identity and assign necessary permissions in a single step.

Before beginning the import, ensure you have collected the required details for all partner project team members, specifically their first names, last names, and email addresses. This data must be formatted in a CSV template that follows the attribute naming conventions specified in the SAP Help Portal documentation.

Screenshot of importing users in the Identity Authentication Service.
  1. Log into the Identity Authentication Service (IAS) and select the Import Users tile.
  2. Choose the SAP Central Business Configuration system from the list.
  3. Select the Browse… button, upload the CSV file of users created in the previous step and choose Import.
  4. Select Send to send email notifications to the users.

Run a job to replicate users & their assigned permissions to SAP Central Business Configuration

To finalize the process, the IT Contact must run a provisioning job in Identity Provisioning. This step replicates the newly created users and their assigned permissions to the SAP Central Business Configuration system.

It is important to trigger this job immediately, as the activation emails have already been sent to the users. Without this replication, users will receive their login credentials but will not yet have the backend permissions required to access the system.

Screenshot of running a job in Identity Provisioning Service to replicate users and their permissions to SAP Central Business Configuration.
  1. Log into the IPS
  2. Select the Source Systems tile, then choose the Identity Authentication Service (IAS) from the list.
  3. Select the Jobs tab and click the Run Now button ONCE for the Read Job.

Email notifications sent to project team members

Once the user replication is complete, each project team member receives an activation email for their account along with the URL for the SAP Central Business Configuration system.

With access granted, the partner lead configuration expert can begin the process of activating content in the SAP S/4HANA Cloud starter system. The specific steps for content activation will be explored in detail later in this course

Screenshots of initial email sent to newly created users and login screen.

Note

Learn about user setup & access in the SAP Help Portal and how to avoid common issues in this SAP Blog: Avoid access issues during the initial setup of SAP Central Business Configuration.

Try it yourself!

Learn how to manage create users and provide access to SAP Central Business Configuration via SAP Cloud Identity Services in this tutorial.

ExerciseStart Exercise

Learning

SAP FacebookSAP YoutubeSAP LinkedIn