Identity and Access Management as the Real Perimeter of the SAP Cloud Landscape
Goodbye to the traditional model where the access points, firewall used to be the first perimeter when a user/intruder is trying to login to SAP landscape from an unmanaged laptop on a hotel or a public network. Identity took that place now. For SAP S/4HANA Cloud, SAP SuccessFactors, SAP Ariba, and SAP Business AI Platform (earlier known as SAP BTP) , the identity presenting itself at the door is the only control that consistently stands between an attacker and the general ledger.
This article walks through the pillars of cloud identity and access management and translates each one into the SAP services, configuration objects, and governance practices that actually carry the control.
Key Takeaways
•
SAP S/4HANA Cloud and SAP BAIP landscapes will utilize identity segmentation as the primary security boundary.
•
SAP CIS (Identity Authentication, Identity Provisioning, Identity Directory, Authorization Management) is the core operational centre of SAP cloud IAM.
•
There is no PFCG and SU01 in SAP S/4HANA Cloud, Public Edition. It uses business roles, business catalogs, and restriction types - the new authorization model.
•
MFA belongs on privileged and technical identities first, not last.
•
Access certification, segregation-of-duties analysis, and privileged access for public-cloud SAP are delivered through SAP Cloud Identity Access Governance rather than on-premise SAP Access Control.
•
AI agents are becoming principals in their own right and inherit every weakness in the identity model beneath them.
Why the Perimeter Moved