Managing the BTP Accounts

When you enable the Cloud Foundry environment in one of your subaccounts, the system automatically creates a Cloud Foundry organization for you. The subaccount and the org have a 1:1 relationship and the same navigation level in the cockpit (even though they may have different names). You can create spaces within that Cloud Foundry organization. Spaces let you further break down your account model and use services and functions in the Cloud Foundry environment.

An organization is a development account that an individual or multiple collaborators can own and use. All collaborators access an organization with user accounts, which have roles such as Org Manager or Org Auditor.

A space provides users with access to a shared location for application development, deployment, and maintenance. An organization can contain multiple spaces. Every application, service, and route is linked to a space. Roles provide access control for these resources and each space role applies only to a particular space.

In the cloud management tools feature set B, SAP BTP provides a set of role collections to set up administrator access to your global account and subaccounts.

Role collections group authorizations for resources and services. Your administrators assign these role collections to other platform users to create new administrators. Role collections consist of individual roles. For more information on role collections and roles, see the related link.

Role collections are account-specific. Role collections that exist in the global account don’t exist in the subaccounts. Likewise, role collections in subaccounts aren’t available in the global account.

You can use the default role collections, but you can’t change or delete them. SAP BTP provides the following administrator role collections:

• Global Account Administrator
• Subaccount Administrator
• Directory Administrator
• Cloud Connector Administrator
• Connectivity and Destination Administrator
• Destination Administrator
• Subaccount Service Administrator

SAP BTP also provides viewer role collections for the global account and for subaccounts. In contrast to the administrator role collections, viewer role collections only grant read access. These include the following:

• Global Account Viewer
• Subaccount Viewer
• Directory Viewer

If you assign the Global Account Administrator role collection to a user, this user can perform administration tasks for subaccounts, role collections, identity providers, entitlements, and regions on the level of the global account. If you assign the Global Account Viewer role collection, this user can view subaccounts, role collections, identity providers, entitlements, and regions on the level of the global account.

If you assign the Subaccount Administrator role collection to a user, you grant a user administration permission for a subaccount.

If you assign the Cloud Connector Administrator role collection to a user, you grant the user administration permissions for the Cloud Connector in a subaccount.

If you assign the Connectivity and Destination Administrator role collection to a user, you grant the user administration permissions for the Cloud Connector and SAP Destination service in a subaccount.

If you assign the Destination Administrator role collection to a user, you grant the user administration permissions for the SAP Destination service in a subaccount.

If you assign the Subaccount Service Administrator role collection to a user, you grant the user administration permissions for the Service Manager in a subaccount.

If you assign the Global Account Viewer role collection to a user, you grant read access to the same information as the Global Account Administrator role collection.

If you assign the Subaccount Viewer role collection to a user, you restrict a user's viewer permission to the subaccounts.

The role collections Directory Administrator and Directory Viewer can be assigned during the creation of a directory. If you select the checkbox Manage Authorizations in the creation wizard, you can assign users the role collections during the step Manage Authorizations. You can't create custom role collections for directories.

The Directory Administrator role collection grants a user administration permission for directories.

The Directory Viewer role collection grants a user read access to the same information as the Directory Administrator role collection.

The roles are based on role templates, which are provided by applications. The application identifier refers to the application, which provides the role templates.

The following table provides the information about some of the more common roles available.