Cloud Identity Services: Authentication & Provisioning

An admin hand-edits a few user attributes directly in the IPS target system, then the scheduled Read Job runs. What happens to those manual edits, and does switching to a Resync Job protect them?

You need to trust your own certificate authority for X.509 client-cert logins and route IAS notification emails through your company SMTP server. Are these per-application settings, and where do tenant-wide options like these live?

If asymmetric encryption solves symmetric's key-exchange problem, why don't modern connections just use asymmetric encryption for everything?

You want Identity Authentication itself to act as the source system in an Identity Provisioning job. What must you set up in IAS first so IPS can even read from it?

Besides username/password, what authentication methods can SAP BTP use?

A partner needs to administer your BTP global account using an X.509 client certificate for automation. They currently log in with a self-registered P-user. Will that work, and what must change?

You want administrators to log into the subaccount itself using your corporate Microsoft Entra ID. Can Entra ID be set as the platform IdP, and what is the workaround?

Cloud Identity Services bundles two services. If your problem is 'users exist in HR but aren't appearing in the target SaaS app,' which one do you reach for, and why not the other?

What factors can multifactor authentication (MFA) use in Identity Authentication?

A consultant has separate S-user, P-user, and I-user accounts and is told an SAP Universal ID will 'unify' them. What does unification actually mean for those underlying accounts?

A teammate proposes using IPS to handle user login and SSO for a new app. Why is that the wrong tool, and what does IPS actually do with an identity?

When creating an IAS user, when is 'Set active status' the correct activation option, and when would choosing it be a mistake?

A customer wants Identity Provisioning but has no other SAP cloud subscription and asks to buy IPS on its own. What do you tell them?

A teammate says 'check the user's authorizations first, then authenticate them.' Why is that backwards, and what breaks if a system authorized before authenticating?

On a brand-new BTP subaccount, which IdP already works out of the box, what does it cost, and what's the only step left before a user can log in?

You must provision identities from a cloud system into an on-premise application that has no direct connection to the cloud. Which IPS system role solves this, and what's wrong with a plain source-to-target setup?

For a Cloud Foundry subaccount, at what level and via what path do you configure the platform and application identity providers?

IAS lets you set password-related email-link validity anywhere from 1 hour to 30 days. Where in that range should it sit, and why not the high end?

A colleague says 'we store users in LDAP.' What's imprecise about that, and why does the distinction matter when integrating BTP?

To defend BTP logins against brute force you lock accounts after N failed attempts. What's the trade-off in setting N, and what second control must back it up?

Is SAP Identity Authentication (IAS) where your users are stored, or something else? Get the category right and say what its core job is.

What is the SAP ID service, which account types does it cover, and how is it distinct from Identity Authentication (IAS)?

What are the central functions of SAP Identity Authentication?

Why does supporting SCIM let Identity Provisioning onboard a new target system without building an app-specific connector first?

What three business scenarios does Identity Authentication support?

What is the smallest scheduling interval for an IPS read job, and what does that floor mean for how 'real-time' provisioning can be?

What are the four menu areas of the Identity Authentication admin console?

You want BTP to use an on-premise LDAP directory as its user store. What component is the precondition, and what would relying on a raw firewall opening miss?

SAP BTP uses SAML and OAuth 2.0. What is each one actually for, and what's the trap in calling both 'login' standards?

A reviewer asks you to add a step to 'manually activate TLS' before launching a BTP cloud app. Is that step needed?

Among the three BTP identity-federation scenarios, which one do you pick when the driver is centralizing auth for an LDAP or third-party IdP, and why not just SAP ID or a direct corporate IdP?

Before a risky IPS provisioning to production you want a no-data-change preview. Which job type is correct — Simulate or Validate — and what does each actually check?

After an attacker silently changes a victim's IAS email and password, the victim got no warning. What setting was almost certainly off, and why does its default matter?

In SAP BTP's Cloud Foundry environment, what form do access tokens take, and what is the application router's role with them?

What user types can be assigned when creating a user in Identity Authentication, and which is the default?

You're deciding where to register a population of users on BTP: the platform IdP or the application IdP. A developer needs cockpit/CLI access; a customer needs to use a business app. Which goes where, and what's the cost of swapping them?

An employee is leaving on a known date. Deleting their IAS account on the last day feels cleanest. What does that cost you that setting a Valid To date wouldn't?

Your IAS production license is active. How many tenants do you actually have, and what does that mean for where you test config changes?

Why does an IPS transformation involve two mapping stages rather than one direct source-to-target mapping?

IAS lets you configure the session timeout window (Tenant Settings > Single Sign-On > Session Timeout). What's the trade-off in setting it longer vs. shorter, and when is a long timeout the wrong call?

What is the URL pattern for reaching your Identity Authentication tenant, where does the tenant ID come from, and where else does that ID appear?

In the Identity Authentication admin console you need to (a) download change and troubleshooting logs as CSV, (b) upload a custom CSS login theme, and (c) export the user list. Which of the four menu areas do you open for each?

A developer argues that an internal API over plain HTTP is fine because 'nobody is watching the wire.' At the protocol level, what actually happens to an HTTP message in transit, and what does HTTPS change?

Symmetric encryption is fast and battle-tested (AES, DES, Blowfish). So what single problem makes it unsafe to rely on alone across an untrusted network?

Marketing wants the login page to show the company logo and let consumers sign in with Google or LinkedIn. Which service delivers that, and across how much of your account does a single tenant reach?

Beyond who is eligible for an X.509 certificate, how does client-certificate authentication actually verify a user, and which SAP tool issues these certificates for S-users?

In an LDAP directory, how is a single entry uniquely addressed, and what do the parts of CN=Martin Koch, OU=Consulting, DC=Clouddna, DC=at mean?

OAuth 2.0 grants scoped resource access but doesn't itself tell an app who the user is. What layer fills that gap, and which BTP environment's authentication builds on it versus SAML?

You just activated the first administrator on a brand-new Identity Authentication tenant. What does SAP recommend doing right away, and what risk does skipping it create?

In a B2C web-shop scenario on Identity Authentication, walk the self-registration path from landing on the page to recovering access later if the password is forgotten.

In a B2E landscape mixing SaaS (SuccessFactors, Concur) with on-prem S/4HANA, what is the single central entry point for employees, and what role does Identity Authentication play alongside it?

A helpdesk agent should look up user data in Identity Authentication but never edit applications or delete groups. Which admin role fits, and does it matter whether they are a 'personal' or 'system' administrator?

SCIM is why Identity Authentication can talk to many systems without bespoke connectors. Who governs the standard, which specs define it, and what is the root object every SCIM object derives from?

By default, from what address do Identity Authentication activation and notification emails arrive, and what is the option if that sender does not fit your domain?

When you create a user group in Identity Authentication, which two name fields are mandatory, what characters are forbidden in them, and where does the group's unique ID come from?

A security team asks you to tighten IAS password rules: shorten the max reuse window and force changes more often. Can you edit the policy IAS ships with, and where do these knobs live?

A user is locked out of IAS after too many bad logins and files a ticket asking an admin to keep the account locked until they investigate. Why can't you honor that request as stated?

You want to force every IAS password to include all four of lowercase, uppercase, digits, and symbols. Which part of the password policy do you set that in?

In an IAS SAML setup, which side plays the identity provider and which plays the service provider, and where in the IAS console do the connected subaccounts actually show up?

You open Applications & Resources > Applications in IAS to configure trust for a subaccount, but that subaccount isn't in the list. What is the most likely cause?

On an application's Trust tab in IAS, the authentication type is already set and differs between two subaccounts you manage. What determines whether it defaults to SAML 2.0 or OIDC?

You're designing an Identity Provisioning landscape and want to wire up many corporate stores feeding many downstream apps. What hard ceilings on source and target counts do you have to design within?

You're onboarding external business partners into IAS. Should you open self-registration like you do for consumers, and what does the B2B model do instead?

Where did TLS come from, when was its predecessor first released, and what kind of method is TLS essentially?

One BTP option lets applications hit an on-prem LDAP directory directly; another federates through Identity Authentication. In the IAS-proxy variant, what authenticates to what, and what reaches the LDAP server?

Marketing wants the IAS login and password-reset screens to match corporate identity. Which tab do you use, and what three things can you actually restyle there?

A user is locked out and support suspects a stale password. Where do you read (read-only) when the password was set and whether it is locked, versus where do you actually unlock the account or reset the email counter?

SAP Identity Management (IDM) is AS Java-based. When does it reach end of maintenance, is there a direct SAP successor, and where does SAP point customers instead?

Central User Administration (CUA) still ships with and is supported in AS ABAP. So why does SAP nonetheless recommend SAP Cloud Identity Services for central user management?

Sketch SAP's reference architecture for cloud identity management feeding an S/4HANA landscape: where do identities originate, and what role does SAP Cloud Identity Services on BTP play in the chain?