The BTP account model

Contoso Motor Co.'s SAP S/4HANA program keeps the ERP core clean: standard where possible, and custom logic outside the core when it is needed. Much of that outside work lands on SAP Business Technology Platform (SAP BTP): a side-by-side app that lets Great Lakes Fleet Services staff check the status of their alternator orders, integration flows that send purchase orders to Lakeside Components, identity services for sign-on, and the tools that move all of it from development to production. Before any of that is built, someone has to decide how Contoso's BTP account is organized. That structure is what this course is about.

Global account

A global account represents a contract with SAP. It is a management entity: global account administrators see the entitlements that were bought, create directories and subaccounts, and distribute entitlements to them. No application runs in the global account itself. A company can have more than one global account, for example when different contracts or commercial models apply, but for most companies one is the starting point. Contoso's global account is simply called Contoso Motor Co.

Directories

Directories are optional folders between the global account and the subaccounts. They can contain subaccounts and other directories, so you can build a hierarchy, and SAP's learning material notes that the hierarchy can be seven levels deep in total: the global account at the top, a subaccount at the bottom, and up to five levels of directories in between. Directories earn their keep in larger organizations: they can hold entitlements to hand on to their subaccounts, and they allow delegated administration, so a directory administrator manages only the subaccounts in their directory. Labels, free-text key-value pairs such as cost center or owner, can be attached to directories and subaccounts to make filtering and cost reviews easier.

Subaccounts

A subaccount is where applications are deployed, services are consumed and subscriptions are managed. Each subaccount is assigned exactly one region, the data center location where its apps, data and services are hosted, provided by SAP or by an infrastructure partner. The region is chosen when the subaccount is created, so choose it deliberately: latency to users and data residency both depend on it. Subaccounts are isolated from each other. Each has its own members, role collections, trust configuration to identity providers and entitlements, and a user in one subaccount has no access to another unless explicitly granted. Environments, such as Cloud Foundry or Kyma, are enabled at the subaccount level.

Two kinds of users meet BTP. Platform users are administrators and developers who work in the cockpit, deploy applications and configure services. Business users are the people who use the applications, such as Contoso's fleet customer service team. Both are normally authenticated through an identity provider, typically SAP Cloud Identity Services connected to the corporate directory, and receive access through role collections in each subaccount. Administrators work in the SAP BTP cockpit, and the SAP BTP command line interface offers the same account operations for scripting.