SECURITY_GRCbeginner
BTP Security
Understand SAP BTP security across identity providers, trust, role collections, destinations, OAuth, technical credentials, Cloud Connector and subaccount or space boundaries. Learn how authentication, authorization and connectivity remain separate concerns.
Overview
Understand SAP BTP security across identity providers, trust, role collections, destinations, OAuth, technical credentials, Cloud Connector and subaccount or space boundaries. Learn how authentication, authorization and connectivity remain separate concerns.
Lessons in this topic
- SAP BTP Security and GRC Tutorial (Part 1)Understand BTP identity as two related domains: platform users administer BTP accounts and environments, while business users access applications; both authenticate through configured identity providers and receive authorization separately through roles or role collections.
- Role Templates, Roles and Role Collections in SAP BTP (Part 2)Understand BTP authorization composition: applications define role templates, role instances are created from those templates, and role collections group roles so they can be assigned to users or trusted-IdP groups.
- XSUAA, OAuth 2.0, Scopes and JWT-Based Application Authorization (Part 3)Understand Cloud Foundry application security through Authorization and Trust Management (XSUAA): OAuth/OIDC tokens carry scopes and identity claims that applications validate to enforce role-based access at runtime.
- Securing Destinations, Cloud Connector and Principal Propagation (Part 4)Secure BTP-to-on-premise connectivity by separating destination configuration, Cloud Connector tunnel/resource exposure, trust and authentication, and principal propagation so connectivity does not become authorization bypass.
- BTP Security Operations: Audit Logs, Secrets, Certificates and Least Privilege (Part 5)Operate BTP securely with continuous audit logging, secret/certificate lifecycle management, least-privilege administration, dormant-access review, environment separation and incident-ready evidence.
Interview questions covered
- You are the senior consultant/architect responsible for SAP BTP Identity and Trust: Platform Users, Business Users and Identity Providers. The project situation is: A consultant could log into BTP cockpit but could not access an application. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?
- You are the senior consultant/architect responsible for Role Templates, Roles and Role Collections in SAP BTP. The project situation is: A support engineer needed to manage destinations. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?
- You are the senior consultant/architect responsible for XSUAA, OAuth 2.0, Scopes and JWT-Based Application Authorization. The project situation is: An API returned 403 although login succeeded. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?
- You are the senior consultant/architect responsible for Securing Destinations, Cloud Connector and Principal Propagation. The project situation is: A Fiori app reached on-premise S/4 through Cloud Connector but every user saw the same broad data because the destination used one powerful technical user. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?
- What are the core concepts of BTP Security for Identity, Authorization and GRC, and how would you explain them clearly in an SAP interview?
- How would you apply BTP Security for Identity, Authorization and GRC in a real SAP project? Walk through the design or implementation approach.
- A production issue is reported in BTP Security for Identity, Authorization and GRC. What would you check first, and how would you troubleshoot it systematically?
- What are the most important design decisions, trade-offs, and best practices in BTP Security for Identity, Authorization and GRC?
- Suppose you inherit an existing BTP Security for Identity, Authorization and GRC solution. How would you review it before making a change?
- You are the senior consultant/architect responsible for BTP Security for Identity, Authorization and GRC Operations: Audit Logs, Secrets, Certificates and Least Privilege. The project situation is: A production integration failed when a client certificate expired. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?