BTP Identity Authentication Part 1: What Identity Authentication Does
SAP Cloud Identity Services – Identity Authentication (IAS) is the central authentication service for SAP cloud apps. Learn its roles (identity provider or proxy to a corporate IdP), applications and user stores, MFA and password policies, and how it connects to BTP subaccounts and SAP SaaS apps.
What this complete series covers
Learn Identity Authentication in a clear, practical sequence — from the basic idea to real project use, troubleshooting, and interview-ready understanding.
- Who it is for
- Best for SAP consultants, developers, and learners who want a practical understanding of Identity Authentication.
- Prerequisites
- A basic understanding of SAP BTP helps. Hands-on steps may require a BTP subaccount and access to the relevant Integration Suite or BTP service.
- Final outcome
- By the end, you should be able to explain Identity Authentication clearly, follow the main end-to-end flow, apply it in a project scenario, and troubleshoot the most common issues.
- Part 1: BTP Identity Authentication Part 1: What Identity Authentication Does
Introduces SAP Cloud Identity Services - Identity Authentication (IAS), its role as the default identity provider for BTP subaccounts, and why centralized authentication matters fo
- Part 2: BTP Identity Authentication Part 2: Trust and Corporate IdP Federation
Walks through establishing trust between a BTP subaccount and an Identity Authentication tenant, and federating IAS with a corporate identity provider using SAML/OIDC, including ru
- Part 3: BTP Identity Authentication Part 3: Conditional Authentication and MFA
Learn how to federate a corporate identity provider into SAP Cloud Identity Services and enforce conditional authentication policies such as risk-based access, group-based routing,
System and release assumptions: SAP BTP services evolve regularly. Capability names, screens, and setup steps can differ by region, entitlement, and tenant version; the core design principles remain the same.
Explanation
📌 KEY POINTS
✅ IAS authenticates users for SAP cloud apps and BTP subaccounts.
✅ It can store users itself or act as a proxy to a corporate IdP (e.g. Microsoft Entra ID) — the common enterprise setup.
✅ Applications in IAS represent connected systems (BTP subaccount, SaaS apps) with their own authentication rules.
✅ Identity Provisioning (IPS) synchronizes users/groups between systems.
⚠️ Maintaining users separately in IAS and the corporate directory creates duplicate identities and access gaps.
━━━━━━━━━━━━━━━━━━━━
▶ WHAT THIS SERIES COVERS
Part 1: What IAS does
Part 2: Trust and corporate IdP federation
Part 3: Conditional authentication and MFA
━━━━━━━━━━━━━━━━━━━━
▶ 1. ROLES OF IAS
- IdP vs proxy.
━━━━━━━━━━━━━━━━━━━━
▶ 2. APPLICATIONS
- One per connected system.
━━━━━━━━━━━━━━━━━━━━
▶ 3. USERS & GROUPS
- Local store, provisioning, groups in tokens.
━━━━━━━━━━━━━━━━━━━━
▶ 4. POLICIES
- Password, MFA, risk-based rules.
━━━━━━━━━━━━━━━━━━━━
▶ 5. INTEGRATION
- BTP subaccounts, S/4HANA Cloud, SuccessFactors, etc.
━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP
- Open the IAS admin console.
- Review applications and corporate IdPs.
- Check which user attributes and groups are sent.
✅ CHECKPOINT: you can explain the login path for one app.
Code example
===== LOGIN PATH (proxy mode) =====User → BTP app → IAS (proxy) → corporate IdP (e.g. Entra ID) → assertion → IAS → token to BTP with groups ===== CONSOLE AREAS =====Applications | Corporate Identity Providers | Users & Authorizations (groups) | Risk-based authentication | Identity Provisioning (separate service)Real project scenario
A financial services company had users maintained in IAS and Entra ID separately; leavers kept access. Switching IAS to proxy mode with provisioning of groups from Entra ID made the corporate directory the single source.
Common mistakes
- Duplicate user stores.
- Testing in prod tenant.
- No provisioning.
- Missing group attributes.
- No MFA.
Best practices
- Proxy to corporate IdP.
- Separate test tenant.
- Use provisioning.
- Send groups.
- Enforce MFA where needed.
Interview angle
Questions: "What is IAS?", "IdP vs proxy mode?", "What does Identity Provisioning do?"
Strong answer: roles, applications, users/groups, policies, integrations.
Practice this lesson
Quick check
1. Interviewers commonly ask candidates to explain the difference between Identity Authentication and Identity Provisioning, and to describe why a company would not simply use the default SAP ID Service in production. In the Identity Authentication context, which answer shows the strongest practical judgment?
2. Users are maintained separately in IAS and the corporate directory, and leavers keep access. What fixes this?
3. What is the main role of SAP Cloud Identity Services – Identity Authentication in enterprise landscapes?
Interview questions
1. What are the core concepts of Identity Authentication, and how would you explain them clearly in an SAP interview?
Answer it in your own words first, then compare.
2. A company keeps users in both IAS and its corporate directory. Explain Identity Authentication and the target setup.
Answer it in your own words first, then compare.
Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.