SAP BTP Security — Identity Authentication (IAS), Identity Provisioning, Role Collections and Trust
As of 2026-10-30
Learn how SAP BTP separates authentication from authorization: SAP Cloud Identity Services (Identity Authentication and Identity Provisioning) prove who a user is and copy identities, while the SAP Authorization and Trust Management service turns scopes, role templates and role collections into the permissions an application checks. You establish trust between a subaccount and an IAS tenant, map an identity provider group to a role collection, write an xs-security.json descriptor, and verify the result in the token. The module closes with the analytics and AI angle: SAC and Datasphere logins, principal propagation for live connections, and agent identity.
What you will learn
- Read Security → Trust Configuration of a subaccount and name each trusted identity provider and its logon availability
- Establish trust between a subaccount and an IAS tenant by OpenID Connect or SAML
- Write an xs-security.json with one scope, one role template and one role collection and create the xsuaa instance
- Map an IdP group to a role collection and confirm the scope in the decoded JWT
- Configure an Identity Provisioning source and target system and read a transformation
Concept overview: who you are, and what you may do, on SAP BTP in 2026
Three separate things answer three separate questions on SAP BTP. SAP Cloud Identity Services answers "who is this person?" (Identity Authentication, IAS) and "which identities exist where?" (Identity Provisioning, IPS). The SAP Authorization and Trust Management service (technical name xsuaa) answers "what may this person do in this application?" through scopes, role templates, roles and role collections. The corporate identity provider (Microsoft Entra ID, Okta or similar, named here only as examples) stays the system of record for people and groups. Mixing these up is the root of most BTP security tickets.
Prerequisites
- An SAP BTP trial or free-tier subaccount in the Cloud Foundry environment
- Basic knowledge of SAML 2.0 or OpenID Connect and JSON Web Tokens
Outcomes
- Distinguish authentication (IAS) from authorization (xsuaa) in a BTP landscape
- Explain the chain scope, role template, role, role collection and where each is defined
- Choose between default provider, automatic OIDC trust and manual SAML trust for a given landscape
- Design a group-to-role-collection mapping table for a business user population
- Position agent identity and principal propagation as extensions of the same trust chain
Full module with the Consultant plan — €19.90/month. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.