SAP BTP · Federation & Advanced Authentication

In service provider–initiated SAML SSO, two signed messages cross the wire. What are they, who signs each, and why does identity provider–initiated SSO have only one?

Answer locked. Get the free KnowCard app to reveal it — plus spaced-repetition review so it actually sticks.

This is one card from the KnowCard library — thousands more across SAP, Linux, Python and more. In the app you get the answer, AI explanations, and cards that come back right before you would forget them. Free to start on iOS, Android or the web.

More in Federation & Advanced Authentication

A user hits an app for the first time after you enabled TOTP two-factor authentication for their group. What must they do on that first login, and how do you later confirm MFA is actually active on the account?

You run Identity Authentication as a proxy to Microsoft Entra ID and want two-factor authentication. Does the second factor have to be enforced inside Identity Authentication itself?

An admin wants 2FA enforced for one sensitive app but not for casual sign-ins to a low-risk app in the same tenant. Where in Identity Authentication does 2FA actually get configured, and what does that scoping imply?

In a risk-based authentication policy, when does the default action (Allow / Deny / Two-Factor Authentication) actually fire, and what does setting it to Deny mean for a login that matches no rule?

What are the three dot-separated parts of a JSON Web Token (JWT), and what does each hold?

When you federate Microsoft Entra ID into Identity Authentication via SAML, which system is the identity provider and which is the service provider — and what is the practical tell for getting the metadata exchange right?

Start learning today

Free to start — download the app or use it in your browser.