Why it comes up
BTP subaccounts get created quickly, usually by a project that needs to ship something. Each one brings its own identity provider decision, its own role collection naming and its own destination configuration. Two years in, nobody can answer who has access to what.
What the work covers
Identity Authentication (IAS)
A single identity provider decision, with corporate IdP federation and MFA settled up front.
Identity Provisioning (IPS)
Provisioning between the corporate directory, IAS and the subaccounts, so leavers actually leave.
Role collections
A naming and assignment model that works across subaccounts and environments.
API security
API access, destinations and principal propagation designed rather than accumulated.
Identity governance
Extension-layer access included in the same recertification cycle as the core system.
Cloud access controls
Subaccount and space-level administration separated from developer access.
What you get
A documented BTP identity and authorization model, configured IAS and IPS, and a role collection standard.
Other services
Role redesign
Business role catalogues built from usage data
SoD remediation
Conflicts ranked, mitigated and signed off
Fiori authorization
Spaces, pages and catalogues mapped to roles
Audit readiness
Evidence prepared before the auditor asks
Baseline assessment
A fixed-price read of where you stand today
Bring us in at the gate that suits you.
Phase 01 stands alone as a fixed-price baseline assessment if you want to understand your exposure before committing a workstream.