Setup of User Provisioning from SAP Marketing Cloud to SAP Analytics Cloud

This blog post will explain how to use the SAP Identity Provisioning Service (IPS) to automatically provision users from SAP Marketing Cloud (SMC) Standard, Professional and Enterprise Edition to SAP Analytics Cloud (SAC).

As a prerequisite you have to setup user provisioning from SAP Marketing Cloud to SAP Identity Authentication Service as explained in this blog post.

Setup in SAP Analytics Cloud

The following steps show the setup in an SAC system version 2020.2.0 with screenshots. You find the official documentation here.

1. Logon to your SAC system with a user that has administration authorization.
2. Go to  (Main Menu)   System   Administration  App Integration.
3. Under Configured Clients, select Add a New OAuth Client.
4. In the dialog, add a Name and an OAuth client ID. Select API Access as Purpose and User Provisioning as Access. In the security part select Client Credentials and mark confidential. Maintain a secret. You will need the OAuth client ID and secret later on the in the IPS setup.
   
5. After saving keep the OAuth Client Token URL in the upper part in mind for setting up SAC in Identity Provisioning Service.
   

Setup SAC in IPS

The following steps show the setup in an IPS system 2019 with screenshots. You find the official documentation here.

1. Logon to your IPS system. Open the tile “Target Systems”.
   
2. Create a new target system. Save the following coding as json file and upload the file under Define from File. In the coding you will have to exchange <<SAC Host Name>> with your SAP Analytics Cloud Host Name and <<SAC Token URL>> with your OAuth Client Token URL.

   {
     "connectorType": "SAP_ANALYTICS_CLOUD",
     "accessMode": "WRITE",
     "relatedSystems": [
       "SAP Marketing Cloud"
     ],
     "name": "SAP Analytics Cloud",
     "state": "ENABLED",
     "properties": {
       "Type": "HTTP",
       "User": null,
       "Authentication": "BasicAuthentication",
       "OAuth2TokenServiceURL":<<SAC Token URL>>,
       "csrf.token.path":"/api/v1/scim/Users?count=1",
       "ProxyType": "Internet",
       "ips.trace.failed.entity.content": "true",
       "URL": "<<SAC Host Name>>",
       "scim.api.csrf.protection":"enabled"
     },
     "encryptedProperties": {
       "Password": null
     }
   }
   

   After the upload the Properties Tab shows a red mark:
   

   Switch to the properties tab and enter the OAuth Client ID as user name and secret as password which you have defined in the SAC system for IPS.
   

   Save your system.