BTP & Integrationintermediate

BTP Global Accounts Part 2: Designing Subaccount Structures for Environments

Key takeaway

Design subaccounts for a real landscape: separation by environment (dev, test, prod), by business domain or by region, entitlement distribution, trust and identity per subaccount, naming, and how transports move content between subaccounts.

Explanation

📌 KEY POINTS
✅ Separate subaccounts per environment (dev/test/prod) isolate data, users and quotas.
✅ Add domain- or region-based splits only when ownership or residency requires it.
✅ Distribute entitlements deliberately; production gets guaranteed quotas.
✅ Trust each subaccount to the corporate identity provider (usually via SAP Cloud Identity Services).
⚠️ Too many subaccounts multiply connectivity, trust and transport effort.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 1 explained the model. Now design.

━━━━━━━━━━━━━━━━━━━━
▶ 1. ENVIRONMENT SEPARATION

DEV, TEST, PROD per solution area.

━━━━━━━━━━━━━━━━━━━━
▶ 2. DOMAIN/REGION SPLITS

Only with a clear reason.

━━━━━━━━━━━━━━━━━━━━
▶ 3. ENTITLEMENT PLAN

Per subaccount; buffer for prod.

━━━━━━━━━━━━━━━━━━━━
▶ 4. TRUST & ROLES

Identity provider trust; role collections per subaccount.

━━━━━━━━━━━━━━━━━━━━
▶ 5. TRANSPORTS

Content moves DEV → TEST → PROD via transport management.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Define solution areas and environments.
Create subaccounts with naming pattern.
Configure trust and role collections.

✅ CHECKPOINT: prod has no developer admin access.

Code example

ABAP Code

===== DESIGN EXAMPLE =====acme-ext-dev (eu10) | acme-ext-test (eu10) | acme-ext-prod (eu10)acme-int-dev / -test / -prod (Integration Suite)Trust: IAS tenant → corporate IdP | role collections by environment ===== ENTITLEMENT PLAN =====DEV: small quotas | TEST: prod-like | PROD: guaranteed + buffer

Real project scenario

An integration architect found production iFlows edited directly by developers because Integration Suite ran in one subaccount. Splitting into dev/test/prod with transports restored change control.

Common mistakes

Single subaccount.
Too many splits.
Dev access in prod.
No trust setup.
No transport path.

Best practices

Env separation.
Justified splits.
Least privilege in prod.
Central identity.
Defined transports.

Interview angle

Questions: "How do you structure subaccounts?", "How do you control production access?", "How do contents move between environments?"
Strong answer: environment separation, splits, entitlements, trust/roles, transports.

Practice this lesson

Quick check

1. Why separate DEV, TEST and PROD into different subaccounts?

2. Developers edit production iFlows directly because all environments share one subaccount. What fixes this?

3. Each BTP subaccount should authenticate users against the corporate identity provider. What is configured?

Interview questions

1. A production issue is reported in Global Accounts and Subaccounts. What would you check first, and how would you troubleshoot it systematically?

Answer it in your own words first, then compare.

2. How would you apply Global Accounts and Subaccounts in a real SAP project? Walk through the design or implementation approach.