Why are external SAML/OIDC identity providers needed for authorization in a subaccount?

Why keep at least two users managed by the default identity provider in a subaccount?

What is the SAP Audit Log Viewer service used for, and what's needed to use it?

How are members identified at the subaccount and space level in SAP BTP?

Where do the role templates in a subaccount come from?

Give an example of an application that dynamically creates new roles during operation on SAP BTP, and what triggers each new role.

What does SAP now recommend instead of SAML for subaccount trust, and why?