Managing Cloud Foundry Environments

Managing Service Subscriptions

Managing Users on SAP BTP

Managing Users and Authorizations on SAP BTP

Managing Users and Authorizations in SAP BTP Environments

Managing Boosters

Managing Extensions

Maintaining Unified Customer Landscape

Managing Extensibility and Integration Concepts

Managing SAP Solution Integration

Managing SAP BTP Shared Responsibility Model

Managing the Data-to-Value Concept

Assigning Roles and Managing Authorizations

Objective

After completing this lesson, you will be able to define SAP’s architecture guidance framework and best-practice references.

Introduction

In this lesson, you’ll learn how platform users and business users are created, stored, and authorized across the BTP landscape. You’ll understand the differences between Global Account, Directory, and Subaccount user management; how role collections are assigned; how shadow users work; and how application-specific roles are delivered and maintained.

These skills are essential for consultants who troubleshoot access issues, support customer identity setups, or validate role assignments during implementations.

User Management in a Global Account

In a Global Account, you can create platform users and assign predefined role collections to them.

To create a user, you need to navigate to Security→Users, and choose the Create button in the top-right corner.

When creating a new user, you always have to specify the identity provider. By default, users are created using the default identity provider SAP ID service. If you've configured a custom identity provider in a global account, you can change the IdP in the Identity Provider field.

SAP BTP Cockpit Global Account Users page showing user management list and “Create User” modal with fields for User Name (email), Identity Provider selection (Default identity provider), E‑Mail, and Create/Cancel buttons.

There's one predefined role collection for administrative tasks and one for read-only access to the global account.

With the Global Account Administrator role collection, the user can perform the following tasks:

Create new and edit existing Subaccounts, within the Global Account
Manage entitlements
Manage users
Manage role collections

With the Global Account Viewer role, the user only gets read access to the mentioned items.

With the authorizations from predefined roles for Global Accounts, the user is not permitted to access any Subaccount that has been not created by them.

SAP BTP Cockpit Global Account Role Collections page for authorization management; table lists role collections with description, roles, user groups, and actions; includes predefined Global Account Administrator and Global Account Viewer; Create button visible.

User Management in a Directory

You can create directories for better structuring. Furthermore, you can enable user management for the directories. You can create and maintain directory administrators and viewers. This is an optional step, and you can always disable it again if you need to.

If you want to have more directory administrators next to yourself, enable user management. If not, keep it disabled.

When adding a new user, you always have to specify the identity provider. By default, a user's origin is the default identity provider, SAP ID service. If you have configured a custom identity provider in a Global Account, you can change the IdP in the Identity Provider field.

SAP BTP Cockpit Directory user management: enable Entitlement and User Management, then use the Users page’s Create button to add directory users; predefined role collections include Directory Administrator and Directory Viewer.

User Management in a Subaccount

If a user should be able to access a Subaccount, the user needs to be added under Security→Users on the Subaccount level.

SAP BTP Cockpit Subaccount “BTP_DEV” Users page showing user list and the Create button; a Create User dialog is open with fields for User Name (email), Identity Provider (Default identity provider), E‑Mail, and Create/Cancel actions.

To add a new user to the Subaccount, perform the following steps:

Open the SAP BTP cockpit.
Go to your Subaccount.
Choose Security→Users.
Choose Create. The SAP BTP Cockpit displays a dialog box where you can enter the user data.
Enter the user e-mail in the User Name and E-Mail fields.
Choose the identity provider where the user is stored. The dropdown list in the Identity Provider field displays the identity providers for which the trust connection has been configured in the Subaccount.
If you've configured a custom identity provider in a Global Account and you want to create a new platform user for the Subaccount, choose the IAS tenant in the Identity Provider field that's used for platform users.
Choose Create.

You can now proceed with assigning Role Collections to the new user.

Note

Users from the SAP ID service are identified by their e-mail address and not their user ID. This is why, when using the default identity provider to create a new user, you need to enter the e-mail address as the user name. If you have multiple user accounts that share the same e-mail address in SAP ID service, they all get the same authorizations.

For more information, see Create Users.

Default Role Collections in a Subaccount

There are several predefined role Collections that you can use when adding platform users to a Subaccount. These are the two most important ones:

Subaccount Administrator
Subaccount Viewer

If you assign the Subaccount Administrator role collection to a user, you grant the user administration permissions for the Subaccount. The user is then able to view and configure the entitlements for the Subaccount, create users, assign role collections, configure trust, create destinations, and so on.

The user who creates the Subaccount automatically gets the administrator permissions. All other users must explicitly be added as Subaccount users and have the corresponding role collections assigned.

SAP BTP Cockpit Subaccount “BTP_DEV” Role Collections page for authorization management; table lists predefined collections (Cloud Connector Administrator, Connectivity and Destination Administrator, Destination Administrator, Subaccount Administrator, Subaccount Service Administrator, Subaccount Viewer) with columns for description, roles, user groups, actions; Create button visible.

After initially deploying your accounts, there are also other default role collections available in the cloud management tools. If you do not want to provide all administration rights to a user, but narrow it down to a specific task (for example, connectivity administration), you only assign the relevant role collection.

Summary

Role collections define user authorizations in SAP BTP cockpit and structure access to platform and applications.
Shadow user assignments control subaccount access and centralize permission management for administrative and developer tasks.
Platform administrators receive comprehensive privileges through predefined role collections for secure environment management.

Next lesson