Lesson 4 of 5
Assigning role collections
10 min
Listen to this lesson
The best authorization model in the code achieves nothing if the wrong people hold the role collections. Assignment is where security meets the joiner, mover and leaver process, and where auditors look first. SAP BTP offers two ways to give users role collections: assign them to individual users, or map them to user groups (or other attributes) delivered by the identity provider.
Direct assignment and group mapping
In the cockpit, under Security > Role Collections, an administrator can add users to a role collection directly, identified by their user ID and identity provider. Alternatively, when the subaccount trusts a custom identity provider, the role collection can be mapped to a user group that the provider sends in its Groups attribute. SAP's documentation describes group mapping as the efficient approach: add a person to the group in the identity provider, and they receive every authorization in the mapped role collections. Role collections can also be mapped to other user attributes.
- JoinerA new fleet desk employee is added to group BTP_FLEET_AGENTS in the corporate directory
- Sign-inAt the next logon, SAP Cloud Identity Services passes the group in the Groups attribute
- MappingIn each subaccount, group BTP_FLEET_AGENTS is mapped to role collection Fleet Agent
- TokenThe user's token contains the FleetAgent scope; the app grants agent access
- LeaverRemoved from the group in the directory; access ends at the next token, without touching SAP BTP
Contoso's assignment rules
| Role collection | Mapped group | Subaccounts | Approver |
|---|---|---|---|
| Fleet Agent | BTP_FLEET_AGENTS | cmc-ext-test, cmc-ext-prod | Fleet desk manager |
| Fleet Supervisor | BTP_FLEET_SUPERVISORS | cmc-ext-test, cmc-ext-prod | Dan, as process owner |
| Fleet Customer (customer attribute from the IdP) | BTP_FLEET_CUSTOMERS | cmc-ext-test (test contacts only), cmc-ext-prod | Fleet desk manager and customer contact |
| Subaccount Administrator | Direct assignment to named people only | Each subaccount separately | Platform lead and security |
Role collection assignments for the fleet app. Test subaccounts use separate test identities.
Assignments are made per subaccount. A mapping in cmc-ext-test grants nothing in cmc-ext-prod, which is exactly what stage separation needs: testers can hold supervisor rights in test without holding them in production. Contoso uses dedicated test identities for each role in cmc-ext-test, so test evidence is not mixed with real users' activity, and production mappings are reviewed separately.
Reviewing access
Under Security > Users, administrators can search users and see each user's role collections, drilling down to the roles inside. That view, together with the identity provider's group memberships, is the basis for periodic access reviews. Watch for direct assignments that bypass groups, for powerful collections such as Subaccount Administrator held by people who no longer need them, and for shadow users who have left the company but still hold direct assignments.
Segregation of duties applies here as in SAP S/4HANA. The people who change role collections in cmc-ext-prod should not be the people who approve the access they grant, and developers should not hold assignment rights in production. Changes to role collections and mappings are configuration changes: they should follow the same request, approval and evidence path as any other production change, so that an auditor can trace each assignment back to an approval.
What would you do?
A fleet agent moves to the finance team. Two weeks later, an access review shows she can still close inquiries in the fleet app. Her group memberships in the corporate directory are correct. What is the likely cause and fix?
- Role collections are assigned to users directly or mapped to identity provider groups or attributes.
- Group mapping ties access to the joiner, mover and leaver process; prefer it for business users.
- Assignments are per subaccount; use separate test identities in test subaccounts.
- Security > Users shows each user's role collections for access reviews.
- Keep powerful collections for named, approved people and review direct assignments often.
Check your understanding · not graded
Lesson check
1. Which identity provider attribute carries group memberships for role collection mapping?
2. Why does a mapping in cmc-ext-test grant nothing in cmc-ext-prod?
3. Where can an administrator see a user's role collections for an access review?
4. Which assignment survives a change in the corporate directory and therefore needs regular review?