SAP Cloud Identity Services - Identity Provisioning
Provisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.
SAP Cloud Identity Services - Identity Provisioning automates identity lifecycle processes, getting identities and their authorisations into cloud and on-premise business applications. Provisioning jobs move users and groups between supported cloud and on-premise systems, SAP and non-SAP, and transformations and filtering properties decide what is provisioned and what is skipped. A job runs in full mode, reading every entity from the source system, or in delta read mode, reading only what changed. Job logs are viewed and exported in the Identity Provisioning administration console, and a source system can be subscribed to for notifications on job status. It is one of the services of Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp, and the one plan its Discovery Center record lists is SAP Cloud to SAP Cloud, in Neo regions and SAP-run regions.
Where it sits
Who is behind it
In the atlas: maintains 137, wrote 14@SAPmaintainer
What it declares
Every artifact
- Type
- Service
- Origin
- By SAP
As a service
- Plans
- 4
- Regions
- 43
- Support component
- BC-IAM-IDS
Connections
Getting users, groups and roles into every system that needs them
Identity Authentication and Identity Provisioning as one tenant
Download
Learn more
- IPS provisioning to ABAP Cloud Developer TrialIPS provisioning to ABAP Cloud Developer TrialWalks through provisioning users and groups from SAP Cloud Identity Services' Identity Provisioning into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud Connector and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Laurence, published 2025-09-04Laurence, SAP Community
- 🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & Target🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & TargetSAP Sales & Service Cloud v2's SCIM API is now generally available by default, having moved out from behind a feature toggle before 1 November 2025. It runs on SAP Identity Provisioning Service, which pushes user records from SAP Identity Authentication Service into the target system over SCIM 2.0's GET/PUT/PATCH /scim/v2/Users endpoints, gated on an employee record already replicated from S/4HANA, SuccessFactors or ERP. This version adds PATCH operations, provisioning of application-specific groups as business roles, and cursor-based pagination beside the existing startIndex/count scheme, and no longer needs SAP Cloud Integration in the path.Yogananda, published 2025-08-30Yogananda, SAP Community
- Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25ivelinakiryakov, SAP Community
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
History in the atlas
- SAP's catalogue names Identity Provisioning as one of the services SAP Cloud Identity Services include. The first `part_of` on an artifact.
- First seen.
For your agent
- Ref
artifact:btp-identity-provisioning- JSON
- /artifacts/btp-identity-provisioning.json
- MCP
- Connecting an agent