SAP Cloud Identity Services

Featured Content

SAP TechEd 2025 Virtual: Experience the Best of SAP TechEd and Broaden Your SAP Security Expertise

You missed SAP TechEd Berlin? Don’t worry – we recorded many sessions for you, and they’re available free of charge on the virtual SAP TechEd platform. We have put together a list of security sessions for you in our latest blog post!

Watch replays of security sessions

Q3 2025 Quarterly Release Highlights: SAP BTP Security and Identity & Access Management

Our development teams have been busy again this quarter, delivering a range of new features and enhancements across SAP BTP Security and Identity & Access Management. Highlights include CAPTCHA protection improvements, provided APIs for SAP Cloud Identity Services, and automatic signing key rotation for access tokens. Explore the full updates in our latest release recap!

Learn more

Identity and Access Management with Microsoft Entra

This new blog post series aims to provide technical guidance on how to plan and implement IAM with SAP Cloud Identity Services and Microsoft Entra. In Part I, explore the implementation of a workflow-based access management solution to SAP BTP with Microsoft Entra ID Governance. In Part II, learn about a hybrid scenario for managing identities and their access across SAP BTP and S/4HANA on-premise. Part III enhances the scenario by introducing SAP SuccessFactors as the source for employee and user data.

Part I: Managing Access to SAP BTP

Part II: Provisioning to SAP BTP and SAP S/4HANA

Part III: SAP SuccessFactors and Role Provisioning

Setting Up a Unified Joule Instance: Key Considerations and Common Questions

As SAP’s generative AI assistant, Joule is designed to deliver a consistent, AI-powered experience across SAP’s portfolio. Establishing a Unified Joule instance requires careful planning around identity, trust configuration and provisioning, as well as consistent SAP Cloud Identity Services integration.

Read the blog post

Integration of SAP Cloud Identity Services and Microsoft Entra ID for Joule

In the first blog post, you'll establish trust between SAP Cloud Identity Services and Microsoft Entra ID using OpenID Connect. Then you'll configure Joule to authenticate with Microsoft Entra ID as a corporate identity provider. In the second blog post, you'll configure the Joule app in Microsoft Copilot and Teams so you can start conversations with other Joule agents.

Read the first blog post

Read the second blog post

Authenticating GitHub Actions Workflows Deploying to the SAP BTP Cloud Foundry Environment with JWTs

This blog post demonstrates how to authenticate to the SAP BTP, Cloud Foundry environment from a GitHub Actions workflow using GitHub-issued short-lived JSON Web Tokens (JWTs), thereby eliminating the need for manual secret management and enabling secure, efficient CI/CD workflows.

Check out the details

Global User IDs and SAP Cloud Identity Services: Essentials for AI Integration in SAP Landscapes

Modern companies are increasingly using SAP across multiple products as their operations are becoming more cloud-based, diversified and advanced with AI. In these environments, it is important to accurately identify the same person across multiple systems and to provide appropriate authentication and authorization. Learn about the role and mechanism of Global User IDs and how to configure SAP Cloud Identity Services to support its implementation.

Read the blog post

CIO Guide: Identity Lifecycle in SAP Landscapes

Explore how identity and access management (IAM) software from SAP supports building successful system integrations in cloud and hybrid environments. With SAP Cloud Identity Services and well-established IAM related industry standards, SAP improves system integration and helps provide a seamless user experience while also improving security and compliance.

Read the CIO guide

Watch the webinar replay

Expert Content

Overview

SAP Cloud Identity Services are SAP’s central cloud IAM services for authentication, single sign-on, and identity lifecycle. SAP solutions integrate with SAP Cloud Identity Services and reuse its functionality where possible.

Authentication is delegated to Identity Authentication. User information is either directly read from the Identity Directory or the solution’s user store is integrated with SAP Cloud Identity Services via SCIM-based user provisioning. Newly built applications will use the Authorization Management service for policy-based authorization checks.

This standardizes the IAM setup, reduces duplicate functionality, and gives customers a clear setup and central IAM configuration and access point.

Solution overview presentation

Watch the overview video

Evolving Identity Authentication and Identity Provisioning into SAP Cloud Identity Services

SAP Cloud Identity Services – Why and How to Integrate Them for a Consistent Identity Lifecycle

Identity Authentication

Identity Authentication is a cloud service for authentication, single sign-on, and user management in SAP cloud and on-premise applications. It can act as an identity provider itself or be used as a proxy to integrate with an existing single sign-on infrastructure.

Learn more

Identity Provisioning

Identity Provisioning offers a comprehensive, low-cost approach to identity lifecycle management in the cloud. It helps you provision identities and their authorizations to various cloud and on-premise business applications.

Learn more

Identity Directory

The Identity Directory is the central component for persisting users and groups inside the SAP Cloud Identity Services. Using the Identity Directory not only simplifies the process of ensuring a proper user lifecycle, but also lays the foundation for integration with SAP cloud applications.

Overview blog post

Documentation

Authorization Management

The Authorization Management Service allows administrators to assign access based on policies centrally within SAP Cloud Identity Services. An access policy allows a user to perform certain actions on a resource, subject to restricting rules. These rules can be adapted by the administrator so that policies fit company requirements before being assigned to users.

Overview blog post

Developer guide