Managing Users and Authorizations in SAP BTP Environments

Configuring Role Collections and Environment-Specific Access

Objective

After completing this lesson, you will be able to explain formation concepts for integration and extensibility scenarios.

Introduction

In this lesson, you’ll learn how user management works inside the Cloud Foundry environment that runs within a subaccount. While earlier units explained platform-level and business-level users and role collection management, this section shows how Cloud Foundry orgs and spaces introduce their own membership structure and roles.

Consultants must understand these distinctions, because project teams often need to provision developers, manage access at the space level, and troubleshoot issues where platform roles and Cloud Foundry roles intersect.

Members in Cloud Foundry Orgs and Spaces

If you've enabled Cloud Foundry in your Subaccount, you can use additional hierarchical levels, such as orgs and spaces.

In a Subaccount, you can create one single Cloud Foundry org. This, however, can contain several spaces. There's no limitation on how many spaces you create in the org.

Note

The Cloud Foundry org is automatically created after activating the Cloud Foundry environment.
Diagram of SAP BTP hierarchy and role scopes: top green box “Global Account” flows down to teal “Subaccount,” then to purple “Org” and “Space.” Global Account and Subaccount levels use “Roles and Role Collections.” Org level shows “Org Roles and Org Members,” and Space level shows “Space Roles and Space Members.” Arrows indicate the downward structure; Org and Space are grouped inside a red outlined area. Icons beside each box depict users and settings.

For both hierarchical levels, users must be maintained and authorizations must be assigned. Within orgs and spaces, the users are called members.

SAP BTP Cockpit showing subaccount overview, Cloud Foundry org name, navigation menu, and org members management within environment page.

After you've activated the Cloud Foundry environment, you can find the name of the Cloud Foundry org on the Subaccount overview page.

In the navigation pane of the Subaccount, choose Cloud Foundry→Org Members to add or delete users in the Cloud Foundry org and to assign roles.

“Add Members” dialog shows email input, Origin identity provider dropdown, default roles (Org Manager, Org Auditor, Org User), and left navigation highlighting Cloud Foundry > Org Members with predefined role collections.

To add new org members, you need to provide the e-mail addresses of the users. You can assign two default roles to org members:

  • Org Manager

  • Org Auditor

If you're the one who creates the Subaccount, you're automatically assigned the Org Manager role. With the Org Manager role, you're able to create new org members. On adding a new user to the org, you also need to select the origin identity provider, which is SAP ID service by default.

Subaccount Cloud Foundry Spaces view with left navigation and space tiles. Bottom: Space “dev” members page highlighting Members menu and roles/actions for managing space members.

Within Subaccounts, you can create spaces to create service instances. To enable users to work within the space, you need to add them as members.

Add Members dialog shows email field, Origin identity provider dropdown, and role checkboxes: Space Developer, Space Supporter, Space Manager, Space Auditor. Left navigation highlights Members; callouts indicate Origin Identity Provider, Default Roles, and predefined role collections.

You need to enter the e-mail addresses of the users. When you add members to a space, the following roles can be chosen to be automatically assigned to the user:

  • Space Developer
  • Space Supporter
  • Space Manager
  • Space Auditor

While adding a new user to a space you also need to select the origin identity provider, which is SAP ID service by default.

When you add a user to a Cloud Foundry org or space and this user doesn't already exist as a shadow user in the subaccount, it will be automatically added to the subaccount but without any assigned role collection. This user will only be able to access parts of the SAP BTP cockpit that are needed for working with Cloud Foundry. If the user should be able to use all features within a subaccount, it requires authorizations through further role collection assignments. The Cloud Foundry role assignments are not visible on the subaccount level.

Summary

  • Role collections organize application roles at the subaccount level to grant environment-specific access.
  • Identity provider groups map to role collections for scalable, environment-aware user assignments.
Learning

SAP FacebookSAP YoutubeSAP LinkedIn