Introducing Bundle Tenants

1. Log on to the Identity Provisioning user interface (UI).

2. Set up the source, target, and proxy systems for your provisioning scenario.

   In bundle tenants, some source and target systems are pre-configured. This means that the connection to the relevant source and target systems is automatically set up and you can run provisioning jobs. When adding a system, Identity Provisioning works as follows:

   1. Identity Provisioning in default mode: Provision user data from source to target systems.

      You add source and target systems only. This could be one source connected to one or multiple target systems, or one target connected to one or multiple source systems.

   2. Identity Provisioning in proxy mode: Provision user data to and from а central identity management solution and a system with proxy configuration.

      You add a proxy system and you have an external identity management system (such as SAP Identity Management) in place.

3. Configure the connection details for your systems if they are not automatically set in your bundle tenant. You have the following options:

   1. Add properties in the Identity Provisioning UI and provide the required connection information.

   2. Create a destination in your subaccount in SAP BTP cockpit and select it for the given provisioning system in the Identity Provisioning UI.

   If your bundle tenant is running on the SAP BTP, Neo Environment, the Identity Provisioning admin user must have the Manage Destinations role assigned.

   Note

   Creating a destination is mandatory for configuring SAP Application Server ABAP provisioning systems and on-premise systems using the Cloud Connector for which a Location ID is configured.

   You can also use it if you need to reuse one and the same configuration for multiple provisioning systems. In all other cases, we recommend that you use the Properties tab.

   If your bundle tenant is running on the infrastructure of SAP Cloud Identity Services, connectivity destinations can only be created for SAP Application Server ABAP provisioning systems.

4. Define what data you want to provision. You have the following options:

   1. Adapt the default transformation logic or use it as-is.

   2. Configure filtering properties for users and groups.

5. Run a provisioning job manually or set a time interval for scheduled jobs.

1. Open the testing or productive URL you have received either from the contract emails or from the incident you have opened.

   Depending on the infrastructure/environment your bundle tenant runs on, the URL follows the pattern:

   • SAP Cloud Identity infrastructure: https://<ias-host>/ips, where the Identity Provisioning tenant URL uses the host of the corresponding Identity Authentication tenant of the customer.

   • Neo environment: https://ips-<consumer_account>.dispatcher.<region_host>/webapp/index.html

2. Log on to the Identity Provisioning UI with your administration credentials.

   • SAP Cloud Identity infrastructure: Identity Provisioning administrator authenticates to the corresponding Identity Authentication tenant of the customer with the admin user that has the Manage Identity Provisioning role enabled in the Identity Authentication admin console.
   • Neo environment: Identity Provisioning administrator authenticates to the admin console of the service with his or her S-user credentials provided in the welcoming onboarding email from SAP. The admin user has the Manage Identity Provisioning role enabled in the Identity Provisioning admin console.

3. When the Identity Provisioning tenant is initially provisioned to your organization, only one user is added as a tenant administrator. After that, due to possible legal and security issues, SAP adds additional tenant administrators only in exceptional cases (for example, the existing administrator left the company, or for some reason there is no active administrator for this tenant).

4. To avoid access-related issues in such cases, it is always a good practice for you to assign more than one administrator. Adding additional ones is exclusively in the responsibility of the current tenant administrators. 

5. The Identity Provisioning UI opens as an independent HTML5 application. The Home page displays the following tiles:

   • SAP Cloud Identity infrastructure: Source Systems, Target Systems, Proxy Systems, Job Logs, and Authorizations
   • Neo environment: Source Systems, Target Systems, Proxy Systems, Job Logs, Authorizations, and OAuth

   

   In both standalone and bundle cases, secure communication is provided between this HTML5 application and the SAP BTP cockpit, realized by principal propagation. Unlike the standalone case however, with your bundle account you obtain the Identity Provisioning as software as a service. That means that we provide you with a global SAP Business Technology Platform account, and you do not need to operate in the platform cockpit.

   All source and target systems in your bundle tenant are available as proxy systems.

After purchasing a global account for SAP Business Technology Platform (in short, SAP BTP), you can obtain Identity Provisioning tenant. To do this, your subaccount needs to be subscribed to the Cloud Identity Services application in SAP BTP cockpit.

To obtain the Identity Provisioning tenant, make sure your subaccount is subscribed to the application in the correct region. If you do this in multiple regions, the tenant you obtain in the first region will be reused in all other regions.

In addition, if you already have an existing Identity Provisioning, it will be reused for the relevant provisioning systems entitled to your SAP BTP product.

To activate your tenant, complete the following steps:

1. In the SAP BTP cockpit, choose your subaccount in the SAP BTP, Cloud Foundry environment.

2. Navigate to Services Service Marketplace and select Cloud Identity Services.

   Note

   If you do not see Cloud Identity Service, navigate to Entitlements and add the default plan.

3. Under Application Plans, choose default and then Next.

4. In the Cloud Service Type dropdown, choose the tenant type. You have the following options:

   • Test
   • Productive - this is the default value

   The default application plan allows you to consume Identity Provisioning, Identity Authentication, and Identity Directory. The new test or productive tenant will be only created if there is not an existing one already that is bound to your customer ID, regardless of the region.

   The default test and productive tenants will be created in the same region.

5. Choose Next and Create to make a subscription to this application, bound to your customer ID.

   The default application plan allows you to consume Identity Provisioning, Identity Authentication, and Identity Directory. The new test or productive tenant will be only created if there is not an existing one already bound to your customer ID, regardless of the region.

   The default test and productive tenants will be created in the same region.

6. In the side menu of the SAP BTP cockpit, go to Services Instances and Subscriptions.

   Under the Subscriptions tab, in the table, you can find the Cloud Identity Services application.

7. Choose the icon (Actions) at the end of the subscription row and select Go to Application.

   This opens the Identity Provisioning administration console. The URL of your Identity Provisioning bundle tenant follows the pattern:

   • https://<ias-host>/ips

     This is valid for new Identity Provisioning bundle tenants created after March 15, 2022. They run on SAP Cloud Identity infrastructure.

   • https://ips-<consumer_account>.dispatcher.<region_host>/webapp/index.html

     This is valid for existing (reused) Identity Provisioning tenants created before March 15, 2022. They run on SAP BTP, Neo Environment.

   Note

   You can remove the subscription to the Cloud Identity Services application, that is to offboard your Identity Provisioning tenant, if you select the icon (Actions) and select Delete. Be aware of the following:

   • If your Identity Provisioning tenant is obtained only for SAP BTP and no other SAP cloud solutions are reusing it, this tenant will be deleted immediately.
   • If your Identity Provisioning tenant is reused in other SAP cloud solutions that bundle the service, this tenant will not be deleted until all SAP cloud solutions offboard it.