BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
IPS provisioning to ABAP Cloud Developer Trial
Walks through provisioning users and groups from SAP Cloud Identity Services' Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.
Where it sits
Explains
SAP Cloud Identity Services - Identity ProvisioningBTPSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.Identity provisioningBTPIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. [Authentication](capability:authentication) answers who is calling one request; provisioning decides whether the user exists in that system at all.RFC connectivityBTPRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.
Source
reachable
Who is behind it
Laurenceauthor
Properties
About this work
For rfc-connectivity
Applies in
Group by19 of 19 pieces
Piece, what it offersStill applies
Expose RFCs as MCP Tools in Integration SuiteExpose RFCs as MCP Tools in Integration SuiteWalks through creating an MCP server in SAP Integration Suite from an RFC source: an on-premise RFC destination labelled for Integration Cell inclusion, a search over the backend's function modules (minimum seven characters), and up to 50 selected modules each becoming a tool. Covers the resulting server's configuration (Source, Tools and Prompts, with no Resources section for this source) and the two scopes an RFC-based server's policy adds beyond an API-sourced one, API.invoke and ESBMessaging.send, plus the RFC receiver adapter used at runtime. Demonstrates the flow with a purchase-order scenario where an AI client calls BAPI_PO_CREATE1 and BAPI_PO_GETDETAIL1 as MCP tools.ronit199666, published 2026-09-24
Using RFC Function Modules and BAPIs in SAP Build Process AutomationUsing RFC Function Modules and BAPIs in SAP Build Process AutomationWalks through calling an S/4HANA BAPI (BAPI_BILLINGDOC_CREATEMULTIPLE, to create a billing document) from an SAP Build Process Automation action: mapping the virtual host to the internal system in SAP Cloud Connector over the RFC protocol and exposing the needed function modules, then creating an RFC-type destination in the BTP cockpit with the virtual message server and SMLG logon group. Once those two are in place, SAP Build lists the exposed BAPIs and RFCs for use in an action.MrRaj, published 2026-07-09
Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Creating an SAP SD Billing Document Using a BAPI in SAP Build and Accessing It Through 'Joule Work'Walks through the two pieces of connectivity a SAP Build Process Automation action needs to call an on-premise BAPI: mapping the virtual host to the internal S/4HANA host in Cloud Connector over the RFC protocol, and creating an RFC-type destination in the BTP cockpit so BAPI_BILLINGDOC_CREATEMULTIPLE becomes a selectable action. The resulting process creates an SD billing document from a sales document number and is reached through SAP Build Work Zone, including from the Joule Work mobile app.MrRaj, published 2026-06-29
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Building Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationBuilding Custom Joule Skills via RFC: Guide for SAP S/4HANA and ECC IntegrationWalks a Joule skill from a spoken question about a production order's status to an answer in SAP Build Workzone: a Cloud Connector tunnel and a destination in the BTP cockpit reach the S/4HANA or ECC system, a BAPI/RFC Action Project in SAP Build wraps the BAPI that reads the order, and Joule Studio, classic edition turns the action into a skill and deploys it. Establishing the connection and its destination before the action project exists is RFC connectivity and Destinations done for a low-code consumer rather than a CAP service. The action type here is BAPI/RFC, alongside the OData actions Joule Studio's own entry names.Robin-Qiu, published 2026-04-01
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIAutomating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioning — getting a user out of every system that holds them once they leave — by chaining btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.shasankgupta024, published 2026-01-01
Modernizing RFC/BAPI-based Integrations for a Clean Core with SAP Integration SuiteModernizing RFC/BAPI-based Integrations for a Clean Core with SAP Integration SuiteWalks a BAPI-based interface from SAP PO through three paths to SAP Integration Suite: lift-and-shift, which keeps the RFC connection to the ABAP system as-is and calls it through Integration Suite's RFC adapter; protocol modernization, which re-exposes the same BAPI as a SOAP web service; and clean core modernization, which replaces it with an SAP-managed API surfaced by the migration assessment report. Follows a BAPI_MATERIAL_AVAILABILITY interface through the first and third paths, showing the generated RFC-adapter iFlow against the OData API found for it.arunmaarirajha_kv, published 2025-10-10
🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & Target🚀 Introducing SCIM API for SAP Sales & Service Cloud v2: Seamless User Sync between Source & TargetSAP Sales & Service Cloud v2's SCIM API is now generally available by default, having moved out from behind a feature toggle before 1 November 2025. It runs on SAP Identity Provisioning Service, which pushes user records from SAP Identity Authentication Service into the target system over SCIM 2.0's GET/PUT/PATCH /scim/v2/Users endpoints, gated on an employee record already replicated from S/4HANA, SuccessFactors or ERP. This version adds PATCH operations, provisioning of application-specific groups as business roles, and cursor-based pagination beside the existing startIndex/count scheme, and no longer needs SAP Cloud Integration in the path.Yogananda, published 2025-08-30
Configuring SAP Cloud Integration for an IBP to S/4HANA (on prem / private cloud) integrationConfiguring SAP Cloud Integration for an IBP to S/4HANA (on prem / private cloud) integrationWalks through creating the two BTP destinations an Cloud Integration iflow needs for an IBP-to-S/4HANA integration: one of type RFC with a WebSocket RFC server host and port for the IBP tenant, and one of type RFC with the on-premise proxy type, a Cloud Connector location ID and a virtual host for the S/4HANA system. It then has the reader copy SAP's prebuilt IBP integration packages into the Design workspace and deploy every reusable iflow in them before a business iflow can call the S/4HANA extractor through SAP Connectivity service.SofianePebre, published 2025-08-27
Using SAP managed iFlows for Time series data Integration in SAP IBP – Part 1 - Reading dataUsing SAP managed iFlows for Time series data Integration in SAP IBP – Part 1 - Reading dataWalks through a custom iFlow that reads time-series and master data out of SAP IBP by calling the RFC function modules IBP exposes under communication scenario SAP_COM_0931, reusing SAP's own "SAP IBP – Reusable Integration Flows" package discovered inside SAP Integration Suite and run from SAP Cloud Integration. The call itself goes through an SAP Destination service destination of type RFC — Proxy Type Internet, a communication-user's credentials and jco.client.* properties for host, port and serialization — rather than a connection wired by hand, which is the destination handling RFC connectivity asks for. It also covers the asynchronous read: a UUID transaction id and an offset-driven paging loop for pulling large result sets in packages.Domnic, published 2025-07-18
Using SAP managed iFlows for Time series data Integration in SAP IBP – Part 2 - Writing dataUsing SAP managed iFlows for Time series data Integration in SAP IBP – Part 2 - Writing dataWalks through building a custom integration flow in Cloud Integration that writes time-series and master data into SAP IBP by calling the SAP-managed reusable iFlows behind communication scenario SAP_COM_0931, which consume RFC function modules through a communication user. It details the BTP destination needed to reach them (Type RFC, Proxy Type Internet, and the jco.client.* properties), and the main-flow and local-integration-process design — payload validation in a Groovy script, batch creation, then the XML attributes and payloads for posting master data and key-figure values and for triggering post-processing.Domnic, published 2025-07-18
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
Microsoft Sentinel for SAP goes agentlessMicrosoft Sentinel for SAP goes agentlessExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud Connector setup together with SAP Integration Suite: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's Destinations maintenance view, with a user authorised to call them (RFC connectivity). It also covers calling the audit log API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.published 2024-12-17
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?Explains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity Services already generates the SCIM ID and Global User ID in uuid format for each record.1Gunnar, published 2023-09-12
How to use SAP Data Intelligence with SAP Cloud ConnectorHow to use SAP Data Intelligence with SAP Cloud ConnectorWalks through reaching an on-premise network from SAP Data Intelligence Cloud with Cloud Connector: installing the client, assigning the Cloud_Connector_Administrator role, registering the subaccount, and mapping on-premise systems as ABAP, HANA or HTTP back-ends in Data Intelligence's Connection Manager. For an ABAP back-end it names the function-module whitelist and the gateway port format RFC access needs, per SAP Note 2835207.Former Member, published 2021-03-16
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Future-ready access governance from SAP: Strategy and innovationFuture-ready access governance from SAP: Strategy and innovationStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioning, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
Details
Graph
Identity provisioningcapability, core only
RFC connectivitycapability, core and community
SAP Communitypublishing source
SAP Communitybtp-tag
SAP Communitycloud-identity-services-tag
Source
Type
blog
Published on
Host
community.sap.com
First seen
History
- explains → applies_to on capability:rfc-connectivityDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
- Entered the atlasDiscovered via SAP Community · btp-tag, SAP Community · cloud-identity-services-tag.
For your agent
- Ref
content:ips-provisioning-to-abap-cloud-developer-trial- JSON
- /content/ips-provisioning-to-abap-cloud-developer-trial.json
- MCP
- Connecting an agent