Syensqo Identity Architecture — SAP Tooling Overview

1) Purpose

Provide a clear architectural overview of the SAP tools that enable identity and access management (IAM) across Syensqo’s cloud and on‑premise applications.

2) Scope

• SAP identity governance and provisioning across cloud and on‑premise systems

• Standard joiner/mover/leaver (JML) processes and access request governance

• Risk and Segregation of Duties (SoD) control framework

• Periodic access certifications

• Connectivity, security, and operations considerations for the above

Implementation details for the various interfaces will be covered in the relevant specifications rather than in this document. 

3) Guiding Principles

• Cloud‑first: Prefer SAP SaaS services on SAP Business Technology Platform (BTP).

• Single source of identity: SuccessFactors as the workforce truth; Cloud Identity Services as the identity broker.

• Business‑role model: Assign access through business roles; avoid direct technical role assignment.

• Least privilege with controls: SoD, risk analysis, and periodic certifications are built‑in gates.

• Standards‑based integration: Use SCIM and established SAP connectors wherever possible.

• Environment isolation: Strict separation (DEV/TEST/PROD) for predictable promotion and auditability.

4) Landscape Overview

At the center is SAP Cloud Identity Access Governance (IAG), delivered as a SaaS tenant on SAP BTP. IAG integrates with SAP Cloud Identity Services (CIS)—notably Identity Authentication Service (IAS), Identity Provisioning Service (IPS), and Identity Directory—to authenticate users, propagate identity data, and orchestrate provisioning to target applications.

5) Core Services (Responsibilities)

5.1 SAP Cloud Identity Access Governance (IAG)

• Access Request & Workflow: Central entry point for requesting and approving access for R2 Release. For future releases this will change to automated triggers from SuccessFactors for business roles.

• Access Risk Analysis: Built‑in SoD and critical‑access checks before and after assignment.

• Role Design: Business‑role centric design aligned to functions and processes.

• Privileged Access: Controlled elevation for critical activities (emergency access).

• Access Certification: Campaign‑based periodic reviews for ongoing entitlement validation.

• Audit & Reporting: End‑to‑end traceability of requests, approvals, and provisioning events.

5.2 SAP Cloud Identity Services (CIS)

• Identity Authentication Service (IAS): SSO and authentication. Federates to Microsoft Entra ID; supports risk‑based and MFA policies.

• Identity Provisioning Service (IPS): Orchestrates identity and role provisioning between sources (e.g., SuccessFactors) and targets (e.g., IAG, Ariba, SAC).

• Identity Directory: Central store for user and group objects used by IAS/IPS and downstream systems.

5.3 SAP BTP Connectivity & Cloud Connector (SCC)

• Connectivity Service (BTP): Managed egress from IAG to enterprise networks.

• SAP Cloud Connector (SCC): Secure reverse tunnel from on‑premise to BTP so IAG can reach S/4HANA APIs without opening inbound firewall ports

Key Decisions and Requirements

Provisioning Architecture

Overview

SyWay’s SAP IAG landscape is delivered as a SaaS tenant on SAP Business Technology Platform, with the ability to connect to both cloud and on-premise systems. Environment alignment (DEV, INT, UAT, TRG, PRD) is achieved via dedicated IAG tenants in matching landscapes, ensuring consistent SoD enforcement and predictable deployments across stages. The architecture is cloud-first and region-agnostic, maintaining strict isolation of access-governance activities per environment while using SAP-delivered SCIM connectors for supported cloud apps (e.g., Ariba, SuccessFactors, iCertis, Work Zone). Integration with SAP Cloud Identity Services (IAS/IPS) standardizes provisioning flows.

IAG Subaccount Model

Runtime: SAP IAG is delivered as a SaaS service on SAP Business Technology Platform (multi-tenant, no direct runtime selection).

Naming: syw-<area>-<env>-<region> (e.g., syw-iag-dev-eu10)

Environment codes: dev, int, uat, trg, prd

Application Architecture Components

Global User ID integration:

As Syensqo continues to modernize its operations and expand its digital ecosystem, SAP solutions are playing an increasingly central role across multiple business domains. With the organization's landscape becoming more cloud-based and  integrated, maintaining a consistent identity framework across systems is essential.

Please refer to the  User ID and Attribute Mapping link for a complete overview of the user ID mapping across all landscapes.

Network Architecture

All of the tools in the SAP Identity Suite are delivered as SaaS, and integrated to S/4HANA and other systems behind the Syensqo firewall via the SAP Cloud Connector, as described in Network and Infrastructure Architecture DD-TEC-070

System Landscape

SAP IAG  will have 3 landscape: Development, Test and Production. Each landscape will connect to below applications.

The SAP IAG development environment will be integrated with the respective development target systems, including S/4HANA Dev, Ariba Development Tenant, and other applicable applications.

Upstream Sources (into IAG)

Connected Applications (via IPS)

Correlation: All targets must match on externalId = globalUserId. Where externalId is not supported, use a stable custom attribute (documented per connector).

System Access

Work Zone

All user access to SyWay systems will have one central landing zone in the form of SAP WorkZone. 

System Access User Flow

Application Security

Authentication Approach (SP‑Initiated SSO)

SyWay standardizes Single Sign-On (SSO) across the SAP Business Technology Platform (BTP) using region-specific SAP Identity Authentication Service (IAS) tenants federated with Microsoft Entra ID. Each BTP subaccount designates its respective IAS tenant as the trusted identity provider, ensuring consistent and secure user authentication.

All interactive user logins are Service Provider (SP)–initiated:

• Authentication between BTP subaccounts or services and IAS uses OpenID Connect (OIDC).

• Federation from IAS to Microsoft Entra ID is established via SAML 2.0.

For non-interactive authentication and system-to-system communication, SyWay adopts modern standards based on the target system’s capability:

• OAuth 2.0 (including Client Credentials Grant)

• OAuth2 SAML Bearer Assertion

• Mutual TLS (mTLS)

Basic authentication is permitted only as an exception where modern protocols are not supported; such cases must be formally documented and approved. Principal Propagation is enabled wherever supported to maintain user context across connected systems.

Human, SP‑Initiated SSO

Non‑Interactive / Service‑to‑Service & Destinations

Authorisations

Business roles represent a high-level grouping of access aligned to specific job functions or responsibilities within the organization. Instead of assigning individual permissions or technical roles directly to users, business roles provide a simplified and standardized way to manage access. Each business role will bundle the necessary access components required to perform a particular role, supporting consistency, ease of provisioning, and alignment with governance and compliance requirements.

Business Roles should be defined to act as process driven components that deviate from HR job titles.

Key benefits:

• Supports modelling of business roles that aggregate technical roles or permissions from multiple systems
• Roles can be built to reflect job functions, departments, or business processes
• The service performs real-time SoD checks during role creation or modification
• Designed roles can go through workflow approvals before activation.

Communication Security

The below table shows the in scope systems for Syway and the encryption protocols used to secure communication between each system.

Data Security

Data security in our landscape is about enforcing least privilege so that only authorized users can perform approved actions on the specific data they’re entitled to see. We will implement a layered access‑control model that combines RBAC, ABAC, and Groups. RBAC will define business roles and the precise permissions each role grants (the what a user can do). ABAC will add fine‑grained, context‑aware rules that filter data by attributes such as Nationality, location, company code, region, business unit, asset, or document owner (the which records a role can act on and under what conditions). Groups—managed centrally in the IdP—will streamline assignment and lifecycle (the who gets which roles), support separation of duties, and simplify provisioning and reviews. Together, this model delivers defence‑in‑depth: roles gate capabilities, attributes constrain data scope, and groups keep access manageable, auditable, and adaptable as the organization changes.

Other Controls

Operation Architecture

Change and Configuration Management

In SAP IAG, the configuration and integration of target applications must be carried out manually across all landscapes, including Development, Quality, and Production systems.

Business Rules and Business Roles will be set up in the Development system and then transported by exporting the configurations from Development and importing them into the Quality and Production systems.

Monitoring

Sizing

High Availability & Disaster Recovery

The Availability SLAs provided by SAP for the components of the SAP Cloud Identity suite are as follows: 

Backup/Restore

• Platform-managed: For SAP-managed BTP services(SAP IAG), backups are handled by SAP; restore is service-specific and generally not customer-operated. Guidance is outlined in the BTP admin help (“Data Backups Managed by SAP”). 

• Audit evidence: BTP Audit Log Service stores subaccount audit data for 90 days by default; export/forward logs if longer retention is needed. 

Maintenance Plan

Even though IAG is cloud-managed, there is still a “maintenance plan” that Syensqo using IAG must follow internally to stay secure, compliant, and effective. Key responsibilities:

• Tenant & subscription management. When subscribing to IAG,  set up sub-accounts/tenants on SAP BTP (test vs. production), assign entitlements, and manage role collections for administrators. refer to the link https://help.sap.com/docs/SAP_CLOUD_IDENTITY_ACCESS_GOVERNANCE/e12d8683adfa4471ac4edd40809b9038/f16bc311b1d544d3a0687e7c453a49ec.html?state=DRAFT&version=2205

• Integration and connectivity maintenance. To connect IAG to on-premise systems, cloud apps, or other SAP services (e.g. via cloud connectors, provisioning),  must ensure connectivity, destination configuration, and correct provisioning setup.

• User/role lifecycle and governance operations. Even though IAG provides features like Access Request, Role Design, Access Certification, and Privileged Access Management —  need to keep the user/role data up to date, run periodic reviews (e.g. access recertification), manage segregation-of-duties (SoD) rules, mitigation controls, and ensure correct workflow configuration. 

• Audit logging & compliance reporting. While IAG logs events, access changes and so on, the organization needs to define and enforce retention policies as well as regularly review logs, reports, and audit data, to comply with internal or external regulations.

• Planning for changes & revalidations. If business processes change — e.g., new applications, changed workflows, additional risk rules, integrations —  must periodically review and adjust the IAG configuration (roles, connectors, policies) accordingly.

 SAP Cloud Service – Maintenance Window for SAP Cloud Identity Access Governance

Exceptions

See also

SyWay Security Approach

Network and Infrastructure Architecture DD-TEC-070

Terminology

Change log