BrowseSAP Business Technology Platform, also named SAP Business AI Platform
Everything in BTP/BAIP
88 of 835
Type
Domain: Security & Compliance
Origin
Signals: SAP only
Content
More
Group by: Capability
EntryBySignalsLast activity
Audit loggingSAP only
s4hana-hana-audit-policiess4hana-hana-audit-policiesSQL templates for the SAP HANA audit policies of the database tenant an SAP S/4HANA system uses, in four sets from the mandatory default policies to scenario examples.sap official, btp
SQL templates for HANA audit policies of an S/4HANA tenant
SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp
Ingests and retains compliance audit data from BTP
teched2022-XP260teched2022-XP260An SAP TechEd 2022 session on configuring SAP BTP services according to SAP's published security recommendations: a custom identity provider, multi-factor authentication, password policy and audit logs.sap official, btp
TechEd 2022 session on SAP BTP security recommendations
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1Walks through subscribing to the SAP Audit Log service's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit logging events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Yogananda, published 2025-03-07
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarIntegrate SAP Business Technology Platform audit logs with IBM Security QRadarWalks through pulling entries from the SAP Audit Log service for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management service, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit logging entry arrive in QRadar as an offense.TusharTrivedi12, published 2024-01-03
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
SAP BTP Audit log Enable and retrieve logsSAP BTP Audit log Enable and retrieve logsWalks through enabling and retrieving records from the SAP Audit Log service on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.anikesh_jyotishi2, published 2024-07-12
AuthorizationSAP only
OAuth 2.0 on SAP BTPOAuth 2.0 on SAP BTPOAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.sap official, btp
OAuth 2.0 grant flows for applications and APIs in Neo regions
SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp
OAuth server issuing JWTs and holding scopes for BTP apps
auth-transport2auth-transport2Three MTA projects that declare a role collection in one xs-security.json out of role templates owned by the other two, so it can be transported rather than recreated in each subaccount.independent, btp
MTA projects sharing a role collection across role templates
Neither the package manifest nor the repository tree declares a licence.
SAP-samples/ams-samples-javaSAP-samples/ams-samples-javaSample Java applications, on Javalin, Spring Boot and CAP Java, showing policy-based authorization through the Authorization Management Service on SAP BTP, with DCL policies checked against JWT tokens.sap official, btp
Java apps showing policy-based authorization with AMS on SAP BTP
SAP-samples/ams-samples-nodeSAP-samples/ams-samples-nodeSample Node.js applications, a CAP bookshop and an Express shopping app, showing policy-based authorization through the Authorization Management Service on SAP BTP with policies written in DCL.sap official, btp
Node.js apps showing policy-based authorization with AMS on SAP BTP
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceAn approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceOne XSUAA instance across several CAP Java applications that call each other, rather than one per application. Short, and written from inside SAP Labs as something the author tried — the value is the shape of the arrangement, not a walkthrough.sreanik_dhanyakumar2, published 2022-09-14
Authorization Management Service in SAP Cloud Identity ServiceAuthorization Management Service in SAP Cloud Identity ServiceStates the direction of travel plainly — BTP moving authorization management from XSUAA to AMS inside SAP Cloud Identity Service — and then explains what a policy is, which is the unit that replaces a scope. Split between authorization for Cloud Identity itself and for custom business applications, and it is the concept post the CAP Java write-up refers back to.kevin_li, published 2024-10-17
Authorization management with OpenSearch's Document Level Security - SAP Cloud LoggingAuthorization management with OpenSearch's Document Level Security - SAP Cloud LoggingWhere the predecessor SAP Application Logging service reused CF space permissions for read-only access, SAP Cloud Logging integrates with SAP Cloud Identity Services (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.Hariharan-Gandhi, published 2025-11-24
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIHow to get authenticated user information with CAP in three different ways – Using the XSUAA APIThe third of three approaches the author sets out, and the one that returns the most: going to the XSUAA API directly rather than reading what CAP already put on the request. Depends on an earlier post for the project setup, so it starts mid-stream on purpose.ale_biagi, published 2022-07-18
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021A year in review, and one section in it is the reason it is here: "CAP isn't the solution for everything" — the author's point being that a pure UI5 or Fiori application does not need a CAP service wrapped around it, and that an approuter or the HTML5 Application Repository may be the better answer. The XSUAA section is a complaint about complexity rather than a guide, which is also worth having on the record.dr_vup, published 2021-12-30
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)Calling an unsecured endpoint on a schedule is trivial; this is the same thing once the endpoint is protected. The interesting part is the caller — the Job Scheduling Service is not a person, so CAP's pseudo-roles are where the post spends its time, and $XSSERVICENAME has to match the scheduler's own instance name.former_member412792, published 2022-12-12
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentUseful CAP CDS and Fiori Commands to Accelerate Development and DeploymentA command-by-command walkthrough of @sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA Cloud. cds add mta and fiori add deploy-config, from @sap/generator-fiori, build the Cloud Foundry deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.TiaXu, published 2022-10-19
Using Postman for API Testing with XSUAAUsing Postman for API Testing with XSUAAA way to get a JWT without routing traffic through the approuter and picking the token out of it. The author walks the alternatives first — redirect through the router, intercept the token — and says what is wrong with each, before requesting the token from the service directly.mariusobert, published 2020-03-02
Why developers should care about credential-types for xsuaa?Why developers should care about credential-types for xsuaa?Rotating secrets, argued from a habit rather than a feature: the author names the practice implicit in many beginner tutorials — lifting a secret out of a binding to use it elsewhere — and notes CAP has features that make it unnecessary in development. Then the three credential types side by side, configured on a CAP application's uaa resource in mta.yaml and through a deployment extension.former_member2839, published 2022-07-05
Why developers should care about credential-types for xsuaa?
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
XSUAA Local TestingXSUAA Local TestingAdding XSUAA to a CAP project two ways, and then the part that is usually missing: getting the authorisation to behave on a laptop rather than only after deployment. The default authentication mechanism is the easy half; testing it without a landscape is the reason this exists.ManasaManu, published 2024-10-17
XSUAA Local Testing
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Certificate managementSAP only
SAP Custom Domain ServiceSAP Custom Domain ServiceExposes a BTP application publicly under the customer's own domain instead of the default subdomain, with the TLS/SSL certificate and TLS configuration that domain is served with.sap official, btp
Serves BTP applications under the customer's own domain
Data privacySAP only
SAP Customer Identity and Access Management for B2CSAP Customer Identity and Access Management for B2CSAP's customer identity service: registration, login and consent for the users of a company's websites and apps, kept in one profile per customer, with regional data storage and risk-based authentication as options.sap official, btp
Registration, login and consent for customer-facing sites
SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp
APIs for retention, deletion and personal data reports
SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp
Retention rules triggering blocking, deletion and archiving
SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp
Service answering data subjects about their stored personal data
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1First of a three-part series on designing a CAP application on BTP that uses the platform's data privacy services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data Manager, SAP Data Retention Manager, SAP Data Privacy Integration and SAP Audit Log service. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2 and Part 3.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
Encryption and signingSAP only
SAP Keystore ServiceSAP Keystore ServiceA repository for cryptographic keys and certificates in SAP BTP's Neo data centres, which an application retrieves at runtime for signing, encryption and SSL communication.sap official, btp
Key and certificate repository in SAP BTP's Neo data centres
Identity provisioningSAP only
SAP Cloud Identity Services - Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp
Provisioning jobs carrying users and groups between systems
analytics-cloud-scim-api-samplesanalytics-cloud-scim-api-samplesAround 45 Postman collections that call the SAP Analytics Cloud SCIM API to create, update and transport users and teams.sap official, btp
Postman collections for the SAP Analytics Cloud SCIM API
sap-concur-user-provisioning-service-apissap-concur-user-provisioning-service-apisA Postman collection whose requests demonstrate the SAP Concur User Provisioning Service APIs for creating users in bulk and assigning their approvers.sap official, btp
Postman collection for the SAP Concur User Provisioning Service APIs
SAP-samples/concur-joule-ips-jobsSAP-samples/concur-joule-ips-jobsPre-configured Identity Provisioning jobs that source users from SAP Concur and write the SAP Global ID back, the prerequisite for enabling Joule and Task Center.sap official, btp
Identity Provisioning jobs syncing SAP Concur users for Joule
teched2025-XP261teched2025-XP261An SAP TechEd on Tour hands-on session that integrates Cloud Identity Services with Microsoft Entra to provision users across cloud and on-premises SAP systems.sap official, btp
Hands-on integrating Cloud Identity Services with Microsoft Entra
🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & Target🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & TargetSAP Sales & Service Cloud v2's SCIM API is now generally available by default, having moved out from behind a feature toggle before 1 November 2025. It runs on SAP Identity Provisioning Service, which pushes user records from SAP Identity Authentication Service into the target system over SCIM 2.0's GET/PUT/PATCH /scim/v2/Users endpoints, gated on an employee record already replicated from S/4HANA, SuccessFactors or ERP. This version adds PATCH operations, provisioning of application-specific groups as business roles, and cursor-based pagination beside the existing startIndex/count scheme, and no longer needs SAP Cloud Integration in the path.Yogananda, published 2025-08-30
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIAutomating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioning — getting a user out of every system that holds them once they leave — by chaining btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.shasankgupta024, published 2026-01-01
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
Future-ready access governance from SAP: Strategy and innovationFuture-ready access governance from SAP: Strategy and innovationStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioning, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?Explains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity Services already generates the SCIM ID and Global User ID in uuid format for each record.1Gunnar, published 2023-09-12
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
IPS provisioning to ABAP Cloud Developer TrialIPS provisioning to ABAP Cloud Developer TrialWalks through provisioning users and groups from SAP Cloud Identity Services' Identity Provisioning into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud Connector and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Laurence, published 2025-09-04
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
Malware scanningSAP only
SAP Malware Scanning serviceSAP Malware Scanning serviceScans an uploaded file over a REST call, with ClamAV behind it — the check an attachments plugin runs before a file is served back.sap official, btp
Scans uploaded files over REST with ClamAV
Rate limitingSAP only
API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp
API proxies with security and traffic policies and Developer Hub
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Configure an MCP Server Created from an HTTP EndpointConfigure an MCP Server Created from an HTTP EndpointDocuments configuring API Management’s HTTP-source MCP server tools, resources, prompts and policies. Resources are selected from GET operations and have URI templates/content types; prompts define User/Assistant messages with optional arguments, alongside MCP policy configuration.
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
Edge Integration Cell : Design, deploy and manage APIsEdge Integration Cell : Design, deploy and manage APIsWalks through creating an API artifact in API Management on the customer-managed Edge Integration Cell runtime, including the option to generate the artifact by importing an OpenAPI specification rather than from a URL or by hand. It then attaches an Authentication policy and a Quota step capped at four calls per minute, deploys, and shows both the resulting 401 and the quota-breach error in the Monitor logs. The author frames it as the first of a series on Edge Integration Cell's policies.published 2023-11-15
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
Information Map – Introduction Series: Graph in SAP Integration SuiteInformation Map – Introduction Series: Graph in SAP Integration SuiteIntroduces Graph, an enhancement to API Management within SAP Integration Suite that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.published 2024-02-21
MCP Gateway in Practice: Architecture, configuration, and hands-onMCP Gateway in Practice: Architecture, configuration, and hands-onA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration Suite: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API Management, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systems edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.SAP Developers
Modern integration at TÜV Rheinland: APIs, events and cloud transformationModern integration at TÜV Rheinland: APIs, events and cloud transformationTÜV Rheinland's migration from SAP Process Orchestration to SAP Integration Suite with API-led connectivity and event-driven architecture, told through business cases. The abstract names what was used: the SAP Integration Suite, Event Mesh capability, API Management, generative AI for faster development and SAP Cloud ALM for monitoring. It states nothing about how any of them was used, so the edges rest on the names and on the Platform migration the story starts from. A TechEd 2026 session (Wednesday 28 October, Berlin), written here from SAP's abstract; the recording is not yet published.
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
Road map for SAP Integration Suite: What ships next across all capabilitiesRoad map for SAP Integration Suite: What ships next across all capabilitiesSAP's road map for SAP Integration Suite across its capability areas: API Management, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourSAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourA features tour of SAP Integration Suite's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limiting's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rudhra, published 2026-08-03
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSSAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSPart 4 of a five-part beginner series on API Management within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rudhra, published 2026-08-24
SAP PI Migration to BTP Integration Suite Patterns and learning experiencesSAP PI Migration to BTP Integration Suite Patterns and learning experiencesWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud Integration iFlows — API Management proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.saikrishna_kalivarapu2, published 2024-12-04
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13
Secrets rotationSAP only
SAP Credential StoreSAP Credential StoreA vault for an application's passwords, keys and keyrings, reached over a REST API with a binding — so a secret is fetched at runtime and rotated in one place, never shipped in an environment variable.sap official, btp
Vault for an application's passwords, keys and keyrings
Vulnerability scanningSAP only
Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp
Tracks vulnerabilities in open-source components of BTP apps