Using Global Accounts and Subaccounts

Objective

After completing this lesson, you will be able to use global accounts and subaccounts

Global Accounts and Subaccounts

Overview - SAP BTP Offering

SAP BTP offers users the ability to turn data into business value, compose end-to-end business processes, and build and extend SAP applications quickly.

The services and solutions of SAP BTP are available on multiple cloud infrastructure providers. The multi-cloud foundation supports different environments, such as Cloud Foundry, ABAP, and Kyma, as well as multiple different regions, and a broad choice of programming languages.

The central point of entry to the cloud platform is the SAP BTP cockpit, where you can access your accounts and applications and manage all activities associated with them.

The figure, Overview of Global Accounts and Subaccounts (Feature Set A), depicts the relationship between a global account, its subaccounts, environments, regions, entitlements, and quotas. It shows the administrative tasks to be considered at the global account level as well as at the subaccount level.

If your global account is on cloud management tools, feature set B, the account structure looks different. With feature set B, the new hierarchical element called directory is introduced, which is essentially a grouping of subaccounts. Furthermore, subaccounts can have multiple environments.

The figure, Overview of Global Accounts, Directories, and Subaccounts (Feature Set B), depicts the relationship between a global account, its directories, subaccounts, environments, regions, entitlements, and quotas for feature set B.

Accounts, User and Member Management

Best Practices for Managing Cloud Accounts

The following table outlines the best practices for managing cloud accounts.

Best Practices

ObjectRecommendation
Global Account
  • For each commercial model (license type), you get a separate global account.
  • Appoint at least one person as administrator. The administrator is responsible for adding new subaccounts, adding members to a global account, and managing the entitlements. We recommend that you also appoint at least one substitute administrator. If the main administrator leaves the company or is unavailable, it is important that you have someone who is available to take over these tasks.
  • You purchase entitlements for each global account (according to your commercial model). The administrator of the global account distributes quotas to the individual subaccounts.
Directory
  • Directories are only available with feature set B.
  • Appoint at least one person as administrator. The administrator is responsible for adding new subaccounts, managing members, and managing entitlements. We recommend that you also appoint at least one substitute administrator. If the main administrator leaves the company or is unavailable, it is important that you have someone who is available to take over these tasks.
Subaccount
  • Each subaccount runs in exactly one region (data center) and one environment.
  • Appoint at least one person as an administrator. The administrator is responsible for adding new members to the subaccount and assigning their business roles. We recommend that you also appoint at least one substitute administrator. If the main administrator leaves the company or is unavailable, it is important that you have someone who is available to take over these tasks.

User and Member Management

On the cloud platform, member management happens at all levels from global account to space, while user management is done for deployed applications.

User accounts enable users to log on to SAP BTP and access subaccounts and use services according to the permissions given to them. We distinguish between two types of users.

  • Platform users are usually developers, administrators or operators who deploy, administer, and troubleshoot applications and services on SAP BTP.
  • Business users use the applications that are deployed to SAP BTP. For example, the end users of your deployed application or users of subscribed apps or services, such as SAP Business Application Studio or SAP Web IDE, are business users.

Member management refers to managing permissions for platform users. A member is a user who is assigned to an SAP BTP global account or subaccount. Administrators can add users to global accounts and subaccounts and assign roles to them as needed. You can use predefined roles - for example, the administrator role for managing subaccount members.

User management refers to managing authentication and authorization for your business users. This is only done for your deployed applications.

Account Model

The SAP BTP cockpit is structured according to global accounts, directories, and subaccounts.

Global Accounts

A global account is the realization of a contract you or your company has made with SAP.

A global account is used to manage subaccounts, members, entitlements, and quotas. You receive entitlements and quotas to use platform resources per global account and then distribute the entitlements and quotas to the subaccount for actual consumption. There are two types of commercial models for global accounts: consumption-based model and subscription-based model.

Directories

Directories allow you to organize and manage your subaccounts according to your technical and business needs.

A directory can contain directories and subaccounts to create a hierarchy. Using directories to group other directories and subaccounts is optional - you can still create subaccounts directly under your global account.

You can create a hierarchical structure that is 7 levels deep. The highest level of a given path is always the global account and the lowest is a subaccount, which means that you can have up to 5 levels of directories.

Directories allow you to monitor usage and costs for contracts that use the consumption-based commercial model. In addition, you can also add the following features to your directories (optional):

  • Manage Entitlements: Enables the assignment of a quota for services and applications to the directory from the global account quota for distribution to the directory's subaccounts. When you assign entitlements to a directory, you express the entitlements and maximum quota that can be distributed across its children subaccounts. You also have the option to choose the auto-assignment of a set amount of quota to all subaccounts created or moved to that directory. Subaccounts that are already in the directory, when you select that option, will not be auto-assigned quota.
  • Manage Authorizations: Enables authorization management for the directory. For example, it allows certain users to manage directory entitlements. You can only use this feature in combination with the Manage Entitlements feature.

Subaccount

Subaccounts let you structure a global account according to your organizations and projects requirements regarding members, authorizations, and entitlements.

A global account can contain one or more subaccounts in which you deploy applications, use services, and manage your subscriptions. Subaccounts in a global account are independent from each other. This is important to consider with respect to security, member management, data management, data migration, integration, and so on, when you plan your landscape and overall architecture.

Each subaccount is associated with a region, which is the physical location where applications, data, or services are hosted. The specific region is relevant when you deploy applications and access the SAP BTP cockpit using the corresponding cockpit URL. The region assigned to your subaccount does not have to be directly related to your location. You could be in the United States, for example, but operate your subaccount in Europe.

The entitlements and quotas that have been purchased for a global account have to be assigned to the individual subaccounts.

Global accounts and subaccounts are completely independent of user accounts.

Explore the Global Account

Explore the Sub Account

Log in to track your progress & complete quizzes