Account Model, Governance & Best Practices

If you deactivate SAP ID for admins, how do you keep an emergency way back into the global account — and how do you keep that emergency door from becoming the weak point?

For a high-security BTP setup, why might you register administrative users under a domain that has nothing to do with your company?

You're creating custom roles in the global account. What naming rule protects you from future SAP updates, and which old ABAP habit should you drop?

If you only ever introduce directories for one reason on BTP, what does SAP say that reason should be?

Beyond splitting subaccounts by dev/test/prod, what additional axes does SAP suggest at the subaccount level, and what do they buy you?

How does SAP recommend structuring role collections at the subaccount level, and how can you align them with an existing SAP ERP or S/4HANA landscape?

A three-tier SAP Integration Suite landscape needs more than dev/test/prod subaccounts. How many subaccounts does SAP recommend, and what are the extra ones for?

SAP creates your global account and runs the underlying infrastructure. In the shared-responsibility split, what is left for you as the BTP customer to manage?

Your team builds an SAPUI5 interface on BTP. What recurring check keeps a platform update from silently breaking it, and how often should you run it?

Why does SAP recommend separate subaccounts for dev, test, and production rather than separating those stages by spaces inside one subaccount?

How many nesting levels of directories can a global account contain?

You need to isolate two business units' data and visibility on BTP. At which level does BTP actually enforce that separation?

When you start grouping subaccounts with directories, what organizing axes does SAP suggest, and what do they have in common?

A customer requires personal data to be processed only in the EEA. What does enabling EU Access give you, and where can it still fail?

Does a subaccount's region have to match where your company or admins are located?

What is a global account in SAP BTP, and what can you NOT do directly in it?

Where in the BTP hierarchy do you actually pin a region and environment — the global account or the subaccount?

Are subaccounts in the same global account dependent on each other — e.g. do they share users and entitlements?

What is the SAP BTP Guidance Framework, and what kind of help does it actually provide?

BTP needs two team types — cloud development teams and the platform engineering team/CoE. Which one owns what, and where is the line?

Which three documents does SAP recommend the platform team hand to developers before onboarding them?

What's the recommended starting point for a scalable BTP account structure — full directory hierarchy up front, or something simpler?

In a dev/test/production setup, what specifically belongs in the test subaccount versus the development subaccount?

When you first start on SAP BTP, should you integrate your corporate IdP immediately, or start with something else?

What is the platform engineering team (CoE) responsible for on BTP — and what is explicitly NOT theirs to own?

In a directories-per-functional-area model, what sits inside each directory, and what's easy to overlook about IdP and permissions?

Which SAP services support security monitoring and incident detection on BTP?

What distinguishes a governance 'service catalog' from developers just self-subscribing to services in the marketplace?

You want several functional areas to use the same subscribed SaaS application. Why might that force a separate subaccount per area?

Why does SAP favor DevOps (build team also operates) over handing BTP apps to a separate ops team?

When does SAP say S/4HANA clients should be separated into different subaccounts — and when is it not warranted?

What kinds of regular security testing does SAP recommend for a BTP environment?

What is the security document for in BTP governance, and how is it different from the onboarding document?

Why must on-premise connectivity be configured separately per subaccount instead of once globally?

Which data-protection measures must be built into a BTP application from the planning phase rather than bolted on later?

What four foundational models should be in place BEFORE you start building apps on BTP, and why before?

What is the onboarding document for, and when in the process must it be completed?

When do you choose an account model with directories instead of subaccounts alone?

What are reference architectures in BTP best practices, and how do they differ from something you can just deploy?

What principle governs ongoing authorization management on BTP, and what's the action it forces over time?

What is a directory in the BTP account model, and is it mandatory?

The standard is separate dev, test, and production subaccounts. In a highly mature DevOps organization, how can that three-way split collapse — and what makes it safe?

You want to track resource consumption and park unused capacity for one specific project on BTP. What's the smallest unit BTP can meter, and what does that force into your account design?

A BTP service is misbehaving. Before you open an incident, which two SAP resources should you check first, and in what order?

Where do you find advance notice of planned BTP maintenance and the downtime it will cause, so you can warn users before it happens?

A new BTP admin wants self-paced learning and community help. Which SAP resources should they use, and what's the catch with certification?

Which users actually need access to the global account on BTP, and who explicitly does not?

How does SAP recommend hardening how global account administrators sign in — and why deactivate SAP ID rather than just leaving it as a fallback?

BTP offers three different mechanisms for assigning authorizations to users. What are they, and when does each fit?

A developer is annoyed that work in the development subaccount sometimes vanishes. What property of the dev subaccount must the platform team communicate up front?

Finance asks for one clean invoice and exact per-app cost attribution on BTP. Which of those can BTP actually deliver, and at what level?

Why does SAP insist on at least two administrators — both for the global account and for each subaccount — and what extra redundancy does the subaccount need?

How can the platform team let development teams perform privileged operations — restart a production app, create a database schema — without handing them direct access to those subaccounts?

Your organization expected a single global account but ended up with two. What commercial situations cause SAP to issue multiple global accounts?

Unlike S-users, P-users and default-IdP assignments never expire on BTP. What must you do when an admin holding a P-user leaves the company?