One identity for every user, from cloud consoles to SAP Fiori.
We connect your corporate directory, usually Microsoft Entra ID, to SAP Cloud Identity Services, SAP Fiori, SAP BTP, SAP Cloud ERP and your cloud platforms. Users sign in once with multi-factor authentication, accounts are created and removed automatically, and auditors can see who has access to what.
Why identity needs attention in a cloud and SAP move
Most organisations have grown separate user stores over time: Active Directory for Windows, local SAP user master records, BTP subaccount users and separate cloud console logins. Each new SAP Cloud ERP system, BTP application or hyperscaler account adds another place to create and remove users. People keep access after they leave, passwords get reused, and audits take weeks. A move to RISE with SAP or SAP BTP is the right moment to put one identity provider in charge and connect everything to it.
Too many logins
Separate passwords for SAP GUI, Fiori, BTP and cloud consoles frustrate users and lead to weak password habits.
Leavers keep access
When accounts are removed by hand, they are often missed in one system. Automated provisioning closes that gap.
SAP Identity Management is retiring
SAP Identity Management mainstream maintenance ends in 2027, with extended maintenance to 2030. Customers need a successor for provisioning.
Weak sign-in protection
Passwords alone are easy to phish. Multi-factor authentication and conditional access sharply reduce account takeover.
What we do
We design and build identity and access for your SAP applications, cloud platforms and surrounding systems.
Identity provider design
We agree which directory is the source of truth, usually Microsoft Entra ID, and how SAP Cloud Identity Services connects to it as a proxy. The design covers employees, contractors, partners and service accounts.
Single sign-on to SAP
We set up SAML or OpenID Connect sign-on to SAP Fiori, SAP GUI where supported, SAP BTP and SAP Cloud ERP through SAP Cloud Identity Services. Users sign in once with their corporate account.
Multi-factor and conditional access
We enforce MFA and conditional access policies centrally in Microsoft Entra ID or your chosen provider. Rules can depend on device, location and risk, and apply to all connected SAP apps.
User provisioning
We automate user and group provisioning from Entra ID into SAP Cloud Identity Services, and from there into SAP Cloud ERP, BTP and other SAP cloud apps. Joiners, movers and leavers flow through without manual tickets.
Cloud console access
We connect AWS IAM Identity Center, Azure role-based access and Google Cloud to the same directory, with least privilege roles and just-in-time elevation for administrators.
SAP Identity Management successor
We plan the move off SAP Identity Management to Microsoft Entra ID Governance and SAP Cloud Identity Services, following the migration guidance from Microsoft and SAP. Existing provisioning rules are mapped and tested.
How it works
- 1
Assess
We review your directories, SAP user stores, BTP subaccounts, cloud accounts and current provisioning. We list every application that needs sign-on and its supported protocols.
1 to 2 weeks - 2
Design
We define the identity provider chain, attribute mapping, group to role mapping, MFA and conditional access policies, and the provisioning flows. Security and audit teams review the design.
2 weeks - 3
Build and pilot
We configure trust between Entra ID and SAP Cloud Identity Services, connect a first set of SAP and cloud apps, and run a pilot with a small user group. Issues are fixed before wider rollout.
3 to 5 weeks - 4
Roll out
We onboard the remaining applications and user groups in waves, switch on provisioning and retire local passwords where possible. Users get short guidance on the new sign-in.
2 to 6 weeks - 5
Govern
We set up access reviews, sign-in monitoring and break-glass accounts, and hand over runbooks. Ongoing changes can run under our managed service.
Ongoing
Identity services on each cloud
The native identity services we connect to your corporate directory and to SAP.
| Need | AWS | Microsoft Azure | Google Cloud |
|---|---|---|---|
| Workforce sign-on to the cloud | AWS IAM Identity Center | Microsoft Entra ID | Cloud Identity, Workforce Identity Federation |
| Federation with an external provider | IAM Identity Center with external identity provider | Microsoft Entra ID federation and B2B | Workforce Identity Federation |
| Multi-factor and conditional access | IAM Identity Center MFA | Microsoft Entra multifactor authentication, Conditional Access | 2-Step Verification, Context-Aware Access |
| Just-in-time privileged access | IAM Identity Center permission sets with an approval workflow | Microsoft Entra Privileged Identity Management | Privileged Access Manager |
| Managed Active Directory | AWS Managed Microsoft AD | Microsoft Entra Domain Services | Managed Service for Microsoft Active Directory |
| Secrets and keys | AWS Secrets Manager, AWS KMS | Azure Key Vault | Secret Manager, Cloud KMS |
Identity for SAP Fiori, BTP and SAP Cloud ERP
SAP Cloud Identity Services is the centre of SAP's identity strategy. Its Identity Authentication service handles sign-on for SAP cloud applications and BTP, and its Identity Provisioning service creates users in connected SAP systems. Microsoft recommends that when Entra ID is your main directory, BTP trusts Identity Authentication, which in turn federates to Entra ID as the corporate identity provider, so MFA and conditional access are enforced in one place. For SAP Fiori on ECC or SAP S/4HANA, including systems run by SAP under RISE with SAP, SAML sign-on can be configured with Entra ID. Microsoft also documents provisioning to SAP S/4HANA on-premise through SAP Cloud Identity Services and SAP Cloud Connector, and to ECC through its provisioning agent. Authorisations stay in SAP roles and BTP role collections, mapped from directory groups.
- Entra ID federated to SAP Cloud Identity Services for BTP and SAP cloud apps
- SAML sign-on to SAP Fiori and SAP NetWeaver based systems
- Automated provisioning to SAP Cloud ERP, BTP and SAP S/4HANA
- Directory groups mapped to SAP roles and BTP role collections
© 2026 Mawkish Technologies. This guide, its diagrams and illustrations are protected by copyright. You’re welcome to learn from it and to quote it with credit and a link. Reproducing it, by hand or through AI, and publishing it as your own is not allowed. Read our copyright notice
Deliverables
- Identity architecture covering directory, SAP Cloud Identity Services and cloud platforms
- Single sign-on configured for SAP Fiori, SAP BTP, SAP Cloud ERP and other apps
- MFA and conditional access policies with break-glass procedures
- Automated joiner, mover and leaver provisioning flows
- Least privilege and just-in-time access for cloud administrators
- SAP Identity Management transition plan, runbooks and access review setup
Frequently asked
Do we need SAP Cloud Identity Services if we already have Entra ID?
For SAP cloud applications such as SuccessFactors, an Identity Authentication tenant is already part of the setup. For BTP you can federate directly to Entra ID, but Microsoft recommends going through Identity Authentication because it centralises configuration across subaccounts. Entra ID remains the source of users and sign-in policy.
Can users sign in to SAP Fiori with their Microsoft account?
Yes. SAP Fiori on SAP NetWeaver supports SAML sign-on, and Microsoft publishes a tutorial for configuring it with Entra ID. Users then sign in with the same account and MFA they use for Microsoft 365.
What replaces SAP Identity Management?
SAP Identity Management mainstream maintenance ends in 2027, with extended maintenance to 2030. SAP positions SAP Cloud Identity Services as its strategic direction, and Microsoft and SAP have published guidance on moving provisioning scenarios to Microsoft Entra. We assess your current rules and plan the move.
Does this change under RISE with SAP?
SAP runs the systems and infrastructure under RISE with SAP, but user identity, sign-on and authorisations remain your responsibility. We configure sign-on and provisioning for your RISE systems, coordinating with SAP where system settings are needed.
Does identity data fall under Sri Lanka's data protection law?
Yes, names, email addresses and sign-in logs are personal data. The core obligations of Sri Lanka's Personal Data Protection Act No. 9 of 2022 apply from 1 January 2027. We help you limit the attributes shared between systems and keep sign-in logs under control.
Often paired with this
Plan your move with people who know SAP.
One working session with our cloud and SAP architects. You leave with the options, the risks and a first plan.
- Your landscape reviewed
- The right cloud and region
- A first roadmap
Sources
- Manage access to your SAP applications, Microsoft Learn
- Using Microsoft Entra ID to secure access to SAP platforms, Microsoft Learn
- SAP Fiori SSO with Microsoft Entra ID, Microsoft Learn
- Preparing for SAP Identity Management's end of maintenance in 2027, SAP Community
- How effective is multifactor authentication at deterring cyberattacks, Microsoft Research
- Privileged Access Manager overview, Google Cloud
- Single sign-on with SAP Cloud Identity Services and Microsoft Entra, AWS
- Data protection compliance regime takes effect on 1 Jan 2027, Daily FT
The Lumhaven Map is our shorthand for looking after the details nobody sees in Identity & Single Sign-On.
AWS, Microsoft Azure, Google Cloud and SAP are trademarks of their respective owners.