Identity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.
Stands between the application and the company's own provider: the users are hosted in its tenant or read from the corporate provider behind it, and the password and authentication policies enforced are the company's own.
Ask for a tenant, connect the corporate provider to it, and map the attributes the provider returns to the ones the applications expect.
Authenticates the person. It is the identity provider a subaccount trusts, and the place single sign-on across the SAP applications in the landscape is decided.
Ask for a tenant and establish the trust: a subaccount trusts SAP ID service until someone changes that.
Establishing who is calling and making that identity available
Getting users, groups and roles into every system that needs them
CAP integration with SAP Integration Suite advanced event mesh
CAP integration with SAP Integration Suite advanced event mesh
Browser login and session module for SAP MCP servers
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
SAP's Node.js application router in front of business applications
Token validation and security context for XSUAA and IAS
OAuth server issuing JWTs and holding scopes for BTP apps
Extracts header fields and line items from business documents
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
Identity Provisioning jobs syncing SAP Concur users for Joule
Business notifications from CAP Java via SAP Alert Notification
SAP's Node.js application router in front of business applications
Token validation and security context for XSUAA and IAS
OAuth2 token validation from XSUAA and SAP Cloud Identity Services
Terraform template for a BTP subaccount set up for Joule Studio
SAP's AI engagement layer across SAP applications
Hands-on applying SAP BTP security recommendations to a trial account
Hands-on integrating Cloud Identity Services with Microsoft Entra
Business sites and digital workspaces with collaboration tools
Role-based business site for SAP and third-party apps
Provisioning jobs carrying users and groups between systems
Identity Authentication API
Default Issuer Compliance Enabled for New Apps in Non-Compliant Tenants
Tenant Migration
API Authentication
Sync SSO Cookie Between Domains
Regular Upgrade
Regex Validation in Transformations
Certificate Authentication
Off-Cycle Upgrade
Regional Availability
Regular Upgrade
Regular Upgrade
Off-Cycle Upgrade
Off-Cycle Upgrade
User Token Requests Rejected When Subject Matches Application Client ID
Regular Upgrade
Handling Transformations Exceeding 500 Mappings
Validating Transformation Change Descriptions
Identity Directory API
Off-Cycle Upgrade
Tenant Migration
Identity Directory API
Regular Upgrade
Total Results Strategy Property
SAP HANA Database Connector Now Generally Available
Off-Cycle Upgrade
SAP Fieldglass - Patch Support
Regular Upgrade
SAP Analytics Cloud (SCIM API v2) supports userUUID
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Regular Upgrade
Default Value Applied When patch.group.members.above.threshold Is Not Configured
SAP Ariba Proxy Systems: Base64 Encoding for Special Symbols
Groups
Groups
Groups
Groups
Groups
Off-Cycle Upgrade
Regular Upgrade
User Attributes
Corporate Identity Provider Authentication Enforcement Validation
User Attributes
Regular Upgrade
Configuration of Policy Authorizations for Authorization Policies
Automatic Creation of Identity Provisioning Tenants on SAP Cloud Identity for Neo Tenants
Off-Cycle Upgrade
Regular Upgrade
Identity Directory API
User Types
Profile Attributes
API Authentication
Regular Upgrade
SAP HANA Cloud, HANA Database connector - Renamed and Extended
Local Identity Directory - Compliance Status Updated in SAP Cloud ALM
Tenant Request via SAP for Me Documented
Block and Delete Users
SAP CPQ - Support for Paging-Related Properties
Regular Upgrade
Bulk Request Size Validation
Name Attribute Restructured
Application Scope Restricted
System Notifications
Regular Upgrade
Blocked Creation of Custom Attributes with sap_ Prefix
Regular Upgrade
Conditions Correctly Displayed in Graphical Editor
Support Multiple OIDC Identity Providers Configurations with Same Issuer
Tenant Migration
Off-Cycle Upgrade
SAP Sales Cloud and SAP Service Cloud version 3 – supported filter
Regular Upgrade
Job Execution Details Show API-Triggered Jobs
Added locale to preferredLanguage Mapping - SAP S/4HANA Cloud Public Edition version 3 and SAP Integrated Business Planning version 2
Off-Cycle Upgrade
User Attributes
SAP Cloud Identity Services Supports Nested Attributes
Reserved sap_ Prefix for Attribute Names
SAP Integrated Business Planning v2 and SAP S4HANA Cloud Public Edition v3 - Changes in Transformations
SAP Concur Connector Version 3 - Group Assignments are Ignored
SAP Data Custodian - New Mapping for the externalId
SAP Integrated Business Planning Version 2 - Support for Paging-Related Properties
Multi-Factor Authentication
Multi-Factor Authentication
Regular Upgrade
LDAP Attribute Validation for MS Active Directory
SAP Ariba Applications Connector - Support for Current and Next-Generation SCIM APIs
Regular Upgrade
Microsoft Active Directory - New Property
Support for externalName group attribute
TimeZone Format Update for SAP IBP 2602
Off-Cycle Upgrade
Regular Upgrade
Changes in Read and Proxy Read Transformations
SAP AS ABAP Proxy - Decoding Role ID
Support for externalName group attribute
Group Deletion and Removal of Assignments in SAP AS ABAP
Change in Status Code Behavior for Identity Provisioning Proxy Scenarios
Regional Availability
Regular Upgrade
Administration Console Look and Feel
Support for externalName in SAP Analytics Cloud
Identity Provisioning UI Improvements
Enhanced Confirmation Dialogs for Reset and Delete
Support for externalLocation Group Attribute
Changed Name for SAP S/4HANA Cloud Connector
User Interface for the Configuration of Refresh Token Lifetime Changed for OIDC Applications
Regular Upgrade
Corporate Identity Providers
Off-Cycle Upgrade
Regular Upgrade
SAP Concur - New Connector Version
SAP Signavio Process Transformation Suite Connector
convertLocaleCode Function Introduced
User Groups
Deprecated oauth.resource.name property
sf.company.id not required for certificate authentication
Data Control Language (DCL) for the Definition of Authorization Policies
Regular Upgrade
Provided APIs
Regional Availability
Off-Cycle Upgrade
Regular Upgrade
New SAP BTP Subscriptions and Applications Appear as Child Applications of the Subaccount Application
Issuer Name
User Attributes
SAP S/4HANA Cloud - New Connector Version
SAP Integrated Business Planning - New Connector Version
SAP S/4HANA Cloud - HR integration switch off
Handling group uniqueness in Identity Authentication and Local Identity Directory
SAP AS ABAP - Configuring Number of Users Read at Once
Change in the Behavior for User Managed Group Assignment
Regular Upgrade
Signing Certificate
Domains
Handling user unlock in SAP S/4HANA Cloud target systems
Central store logs – create and delete groups
Application-Specific Groups
SAP Ariba Applications
Support for externalName Attribute in Identity Authentication (using SCIM API version 2) and Local Identity Directory Transformations
Regular Upgrade
Mail Server
Support for Additional Schema and Attributes in SAP Ariba Applications Transformations
Off-Cycle Upgrade
Renamed System
Privacy Policy
Real-Time Provisioning Logs are Enhanced
Regular Upgrade
Provided APIs
Regular Upgrade
Subject Name Identifier
Deprecation of SAP Ariba Category Management Connector
convertTimezoneCode Function Introduced
Deprecation of SAP Ariba Category Management connector
Principal propagation from SAP BTP to an On-Premise Cloud Connector with a Token From a Corporate Identity Provider
Off-Cycle Upgrade
Regular Upgrade
Password Recovery
Identity Directory SCIM API
Mandatory email for job subscribers
Regional Availability
Off-Cycle Upgrade
Regular Upgrade
SAP Ariba Central Invoice Management supports userUUID
Meta attribute mapping reordered
Regional Availability
Regular Upgrade
Support for SAP extension schema for groups
Change in provisioning job behavior
Regional Availability
Change in provisioning job behavior (Effective July 15, 2025)
Off-Cycle Upgrade
CAPTCHA Protection
Regular Upgrade
Support for SAP extension schema for groups
Off-Cycle Upgrade
Override Conditional Authentication with URL Parameter
Off-Cycle Upgrade
Signing Certificates
Regular Upgrade
Identity Federation
User Attributes
SAP Revenue Growth Management connector
Job Execution Outcome introduced
System reset confirmation message extended
Support for SAP extension schema for groups
Support for extension enterprise schema for users
Regular Upgrade
Applications
SAP Analytics Cloud and SCIM System - new properties
Changed behavior of logging and tracing properties
REST API
Regular Upgrade
SAML 2.0 Configuration
Password Management
Cloud Identity Services Documentation
Support for SAP extension schema for groups
Regular Upgrade
SAP ODM User Schema Support
Download all deleted entities for a provisioning job
Client Certificates
REST API
Application Authorizations
Manage Corporate Identity Providers
Privacy Policy and Terms of Use
Application Protocol Type
SAP Sales Cloud and SAP Service Cloud - new version
SAP Build Work Zone, standard edition - schema support
Support for SAP extension schema for groups
Regional Availability
Regular Upgrade
Machine Translation
Support for SAP extension schema for groups
Identity Authentication (using SCIM API version 2) - changed behavior
Registration and Upgrade Forms
Provided APIs
OpenID Connect
Support for OAuth 2.0 Authorization Server Issuer Identification
Regional Availability
Regular Upgrade
OAuth Client Authentication
Download all updated entities for a provisioning job
Central store logs display source entity ID
SAP Ariba Applications - default transformations changes
Bundle options documentation
Regular Upgrade
Identity Federation for Applications
SAML 2.0 Configuration
Attributes Based on Flexible Expressions
Attributes Based on Flexible Expressions
User Attributes
User Attributes
Warning of unsupported entity
Support for externalId in UUID format
No restart for failed job
Authorizations Based on Policies
Regular Upgrade
Group Provisioning
Certificate Renewal
User Management
SAP Cloud Identity Services - Identity Authentication integration with SAP Cloud ALM
Increased Number of API Permission Groups Allowed
Central store-based provisioning
Intelligent Opportunity Analyzer connector
Group mapping changes
Provisioning sub-attributes of emails attribute
Troubleshooting entity deletion
Off-Cycle Upgrade
Central store logs
New conditional function implemented
Regular Upgrade
Authorizations Based оn Policies
Enforce Nonces for Authentication Requests to Corporate Identity Providers
Disabling ID Token Hints for Corporate Identity Providers During Logout
Group mapping changes
Provisioning sub-attributes of emails attribute
Authorizations Based оn Policies
Regular Upgrade
Invalid mapping in SAP AS ABAP
Group Provisioning
Provisioning sub-attributes of emails attribute
New conditional functions implemented
Group mapping changes
Reduced Set of Scopes for Credentials of Cloud Identity Services Instances
Off-Cycle Upgrade
Regular Upgrade
SAP Build Work Zone, advanced edition - userType provisioning
Tenant Reset renamed to Reset Provisioning Settings
Identity Directory API
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Create User Groups
Group Authorizations Based оn Policies
valueMappings transformation expression is enhanced
Download all created entities for a provisioning job
SAP BTP Platform Members (Cloud Foundry) and SAP BTP XS Advanced UAA (Cloud Foundry) - support for active and verified attributes
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Corporate IdPs
Granular access to Identity Provisioning
Provisioning system buttons relocated
SAP Sales Cloud and SAP Service Cloud - define threshold of group members for patch requests
Changed behavior of csrf.token.path for SAP Analytics Cloud
Regular Upgrade
SAP BTP Platform Members (Cloud Foundry) - write transformation
Identity Directory API
Regular Upgrade
Increased Maximum OIDC Token Validity
Password Recovery
Regional Availability
Changed behavior of skip create for SAP Application Server ABAP
SAP BTP Platform Members (Cloud Foundry) connector
Support for OAuth certificate authentication
Regional Availability
Regional Availability
Regional Availability
Regular Upgrade
User Management
Support for OAuth authentication
SAP Enable Now connector
SAP Ariba Applications extended schemas and attributes
Regional Availability
Regional Availability
Regular Upgrade
Off-Cycle Upgrade
Regular Upgrade
SAML 2.0 Metadata
SAML 2.0 Metadata
Password Recovery Options
SAP HANA Cloud, SAP HANA Database connector
SAP Ariba Central Invoice Management connector
SAP Datasphere connector
Support for OAuth certificate authentication
Condition and skip update - changed behavior
Skip create and delete operations of groups - removed
Reset of SAP Master Data Integration - changed behavior
SAP Data Custodian - filter users by group display name
Regional Availability
Off-Cycle Upgrade
Regular Upgrade
Mail Server Configuration
Deprecation of SAP Concur User v1 API
Separation of Signing Key for SAML and OIDC Tokens
SAP Central Business Configuration - bundle option documentation
Off-Cycle Upgrade
Regular Upgrade
Regional Availability
Regular Upgrade
Administrators
OpenID Connect
User Management
Condition and skip update - changed behavior
isValidEmail function supports new value
Read and proxy read transformation changes
Write and proxy write transformation changes
Regional Availability
Regional Availability
Regular Upgrade
Off-Cycle Upgrade
Administration Console Look and Feel
Profile Page
Regional Availability
SAP Cloud Identity Services - Identity Provisioning integration with SAP Cloud ALM
Regular Upgrade
Regional Availability
Regional Availability
User Management
Support for OAuth certificate authentication
Procurement Data Warehouse connector
Local Identity Directory - group mapping
SAP Business Ecology Management bundle is deprecated
ips.application.id property introduced
SAP Advanced Financial Closing - group mapping
Regular Upgrade
Regional Availability
Regional Availability
Security recommendations for SAP Cloud Identity Services - Identity Provisioning
skipOperations create is enhanced in SAP Analytics Cloud version 1 target systems
Off-Cycle Upgrade
Regular Upgrade
Custom Schemas
SAP Ariba Category Management connector
Off-Cycle Upgrade
User Management
Regular Upgrade
User update capability for SAP Build Work Zone, standard edition
SAP Market Communication for Utilities - bundle option documentation
Real-time logs show the origin of the users
Application-Specific Groups
Managing Groups
Integration of SAML and OIDC Logout Flows
Regular Upgrade
Logos
Manage Applications
User Details
Handling Third-Party Cookies
Handling rate limits for Microsoft Entra ID read operations
SAP SuccessFactors Employee Central Payroll connector
Data type name changed
Regular Upgrade
User Groups
Conditional Authentication
Regular Upgrade
Custom Schemas
User Tokens
Risk-Based Authentication
Risk-Based Authentication
Notifications
Social Identity Providers
Feedback Survey
Data type introduced for expressions in Identity Provisioning graphical editor
Changing totalResults attribute calculation mechanism
Renamed System
Regular Upgrade
IdP Proxy Scenarios
SAP Intelligent Agriculture connector
Identity Authentication Documentation and Release Notes Changes
Regular Upgrade
Authorizations Based on Policies
Configure Applications
Authenticate with System as Admin
External Providers
Off-Cycle Upgrade
Custom Domains
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Custom Schemas
OpenID Connect
OpenID Connect
Regular Upgrade
OpenID Connect
Subject Name Identifier
Regular Upgrade
Email Notifications
Off-Cycle Upgrade
Regular Upgrade
Manage Administrators
Application Authorizations Based on Policies
Off-Cycle Upgrade
Regular Upgrade
Branding and Layout
Upgrade Dates
Regional Availability
Regular Upgrade
Regular Upgrade
Regular Upgrade
User Attributes for Subscribed Applications
Custom Mail Server
Off-Cycle Upgrade
Regular Upgrade
Regular Upgrade
Tenant Texts
Regional Availability
Implicit Grant Type Not Enabled by Default
Refresh Token Flow of OIDC Protocol Restricted to Validity of Web Session
Regular Upgrade
Source System, Master Data Texts Configuration
Off-Cycle Upgrade
Application Development in Authorization Management
Root Certificate Replacement
End User Screens
Customer Documents
Integration of Default Attributes and Assertion Attributes in Applications
Regular Upgrade
Groups
Authorizations Based on Policies
In-App Help
Regular Upgrade
Corporate IdP
Off-Cycle Upgrade
Regular Upgrade
Manage Administrators
Subscribed Applications
Off-Cycle Upgrade
Regular Upgrade
Risk-Based Authentication
Regular Upgrade
Terms of Use Documents
Privacy Policy Documents
Support for Prompt Parameter
Off-Cycle Upgrade
Regular Upgrade
Removal of Applications of Type Reuse
OpenID Connect
OpenID Connect
User Management
Regular Upgrade
System Notifications
REST API
User Groups
Authentication
Off-Cycle Upgrade
Corporate IdPs
System Upgrade
Corporate IdP
OpenID Connect Configurations
System Upgrade
Corporate IdPs
System Upgrade
System Upgrade
OpenID Connect
Tenant Settings
System Upgrade
System Upgrade
Rewording of Security Recommendations
Deprecation of Security Recommendation BTP-IAS-0016
SMS Verification
Tenant Offering
Authorizations Based on Policies
System Upgrade
User Management
Global User ID
OpenID Connect Configurations
Corporate IdPs
Configuration of Authorization Policies
System Upgrade
Administration Console
Troubleshooting
OpenID Connect
System Upgrade
System Upgrade
User Management
Applications
Troubleshooting
OpenID Connect
OpenID Connect
Identity Service
Administration Console
System Upgrade
System Upgrade
System Upgrade
System Upgrade
Manage Applications
System Upgrade
User Management
System Upgrade
Regional Availability
Tenant Settings
Administration Console
User Management
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
artifact:btp-cloud-identity-services