Configuring Cloud Foundry Organizations and Spaces

Objective

After completing this lesson, you will be able to explain user and member management within Cloud Foundry orgs and spaces.

Introduction

This lesson focuses on environments, identity, security, service configuration, boosters, extensibility, and integration concepts that directly impact SAP Ariba Category Management, Intake, and Spend Control Tower implementations.

Consultants will learn where key configurations live, what responsibilities fall to the consultant vs. the architect, and how to troubleshoot common environment and identity issues.

This lesson bridges the gap between "understanding BTP" and working confidently inside BTP landscapes.

Cloud Foundry Environment

Cloud Foundry is the runtime environment inside SAP BTP where applications actually run.

Think of SAP BTP as the "city," subaccounts as "neighborhoods," and Cloud Foundry as the construction site where the buildings (apps + services) are assembled, deployed, and operated.

When Cloud Foundry is enabled in a subaccount, it gives SAP and customers access to:

  • Spaces where apps run

  • Service instances apps depend on

  • Role assignments for developers/operators

  • Resources (memory, routes, backing services, etc.)

Without Cloud Foundry, many next-gen SAP apps cannot run because they rely on Cloud Foundry services and runtimes.

Cloud Foundry

The SAP BTP, Cloud Foundry environment is a service that manages one or more spaces.

The Cloud Foundry environment is where many critical next-generation Ariba applications actually run—including Category Management, Intake Management, and future BTP-native procurement capabilities. Understanding Cloud Foundry is not about becoming a developer; it is about knowing where your customer’s applications live, how they are provisioned, and how to troubleshoot when something goes wrong.

Space

A Space is the operational workspace inside the Cloud Foundry environment where applications actually run. Each space contains the compute resources, configurations, and deployed services your applications need.

In next-generation Ariba solutions (Category Management, Intake, Spend Control Tower), technical components such as HTML5 UI modules, integration services, and extension applications are deployed into a space.

Service Instance

A Service Instance is a provisioned, runnable "copy" of a BTP service used by an application. Service instances allow apps to use capabilities such as HTML5 hosting, destinations, workflow, integration, or data storage.

Next-gen Ariba apps depend on several BTP services.

Examples:

  • HTML5 Application Repository → hosts the UI next-generation Ariba applications
  • Destination Service → enables connectivity to ERP, MDI, and other Ariba services
  • SAP Cloud Identity Services → secures authentication and user onboarding

If a required service instance is missing, misnamed, in the wrong space, or unbound to the application, customers may see symptoms like:

  • Tiles not loading
  • "Service not found" errors
  • Integration failures

Space Quota

A Space Quota defines how much memory, number of applications, and number of service instances a space is allowed to consume. It prevents spaces from exceeding the entitlements assigned to the subaccount.

The SAP BTP, Cloud Foundry environment may define space quotas for spaces based on the quota of its entitlement.

Diagram of SAP BTP hierarchy: entitlements, quotas, services, regions, instances.

A space is a runtime of SAP BTP, Cloud Foundry environment. The Cloud Foundry environment manages these spaces and defines quotas to size them. Service instances run in a space. A Cloud Foundry environment contains what is referred to as an org.

Note

In Cloud Foundry, an org is a development account that an individual or multiple collaborators can own and use. There's a one-to-one relationship between org and SAP BTP, Cloud Foundry environment.

SAP BTP Cockpit: Subaccount overview, enable Cloud Foundry, create organization and spaces.

From the Overview of a subaccount, the SAP BTP, Cloud Foundry environment can be easily enabled by choosing Enable Cloud Foundry. There can be only one environment per subaccount, but this environment can have many spaces.

Hint

The proposed Org Name includes the global account name. This may lead to a very long name with special characters like spaces. Other services refer to the name like destinations used for the SAP Cloud Transport Management Service (cTMS). Therefore, the org name shouldn't be too complicated.

After enabling the Cloud Foundry environment in a subaccount, the Cloud Foundry menu on the left in the SAP BTP cockpit can be expanded showing Spaces, Space Quotas, and Org Members.

SAP BTP Cockpit Cloud Foundry Spaces: user selects Create Space, enters “dev_space,” assigns space roles (Developer, Supporter, Manager, Auditor); resulting dev_space card appears showing organization quota for memory and service instances.

Spaces can be created in the Overview or by choosing Cloud Foundry→Spaces on the left. Choosing the Create Space button opens a popup asking for a space name and space roles, which should be assigned to the user creating the space.

The first space created in a Cloud Foundry environment gets the whole org quota assigned. If additional spaces should be created, this quota must be reduced to free quota for the other spaces.

SAP BTP Cockpit Cloud Foundry Spaces, space quote, unlimited is highlighted.

A space quota defines the amount of memory and the number of routes, service, and app instances for a space. It can be created and assigned to spaces in Cloud Foundry→Space Quotas. The popup for creating a space quota provides the org quota underneath every input field as assistance.

Entering -1 in an input field assigns an "unlimited" quota for the resource. This means that the org quota is used.

Hint

The only true unlimited resource is the number of app instances.

Service Instance in Cloud Foundry

SAP BTP hierarchy overview: entitlements define global account, directory, and subaccount running in regions; quotas apply to services; Cloud Foundry manages spaces with space quotas; services and Cloud Foundry deliver HTML5 apps.

An example of a service instance is the app-host service plan of HTML5 Application Repository Service. It uses a numeric quota and can therefore be used in as many subaccounts in parallel as there's quota available.

SAP BTP Cockpit showing Subaccount “00_dev” overview with Cloud Foundry environment details (API endpoint, org name/ID, memory limit) and a Spaces list containing “dev_space” with zero applications and service instances.

A space can be opened by selecting the line in the Spaces table in the Overview of the subaccount. Another way is to choose the header of the tile for a space in Cloud Foundry→Spaces. Both will show the details like deployed applications or service instances running in the space.

SAP BTP Cockpit: selecting HTML5 Application Repository Service, creating an app-host instance in Cloud Foundry runtime for space dev_space; instance dev_html5 appears under Instances with status Created.

From the Service Marketplace in a subaccount, a service can be created by choosing a service plan. A service instance needs in addition the environment (Cloud Foundry), runtime (space), and a unique instance name. Creating the HTML5 Application Repository Service results in a service instance in Instances and Subscriptions.

Note

The instance should have a CLI-friendly name (command line interface): A short string (up to 32 characters) containing only alphanumeric characters (A–Z, a–z, 0–9), periods, underscores, and hyphens. It cannot contain spaces.

From the Service Marketplace in a Cloud Foundry space, a service can be created in the same way as in the subaccount. The only difference is that only the service plan and instance name are needed. The environment and space were already set by selecting the service marketplace in the space.

Entity Relationships Between Global Account, Directory, and Subaccounts

Diagram of SAP BTP account hierarchy.

The figure Entity Relationships Between Global Account, Directory, and Subaccounts depicts the relationship between a global account, its directories, subaccounts, environments, regions, entitlements, and quotas for feature set B.

A subaccount is specified for the environment Neo or for the environment Multi-Environment (KYMA, ABAP, and Cloud Foundry environment).

Note

The Neo environment of SAP BTP was the first version of SAP BTP available on the market after the product launch.

The Neo environment lets you develop HTML5, Java, and SAP HANA extended application services (SAP HANA XS) applications. You can also use the UI Development Toolkit for HTML5 (SAPUI5) to develop rich user interfaces for modern web-based business applications.

SAP is focusing on the multi-environment account model with feature set B.

Learn More

If you still have an SAP BTP, Neo environment, a migration may be suitable for you. Before starting to migrate your scenario, get in touch with our SAP BTP migration experts to create an individual road map for your transition. For further information please refer to: migrating from neo

Learn more here: SAP Business Technology Platform

Summary

  • Cloud Foundry organizations and spaces provide isolation, quotas, and role-based access for applications and services.
  • Subaccount configuration and organization provisioning use SAP BTP cockpit and Cloud Foundry Command Line Interface for membership management.