Skip to Content
Technical Articles
Author's profile photo Eileen Koehler

Setup of User Provisioning from SAP Marketing Cloud to SAP Analytics Cloud

This blog post will explain how to use the SAP Identity Provisioning Service (IPS) to automatically provision users from SAP Marketing Cloud (SMC) Standard, Professional and Enterprise Edition to SAP Analytics Cloud (SAC).

As a prerequisite you have to setup user provisioning from SAP Marketing Cloud to SAP Identity Authentication Service as explained in this blog post.

Setup in SAP Analytics Cloud

The following steps show the setup in an SAC system version 2020.2.0 with screenshots. You find the official documentation here.

  1. Logon to your SAC system with a user that has administration authorization.
  2. Go to  (Main Menu)   System   Administration  App Integration.
  3. Under Configured Clients, select Add a New OAuth Client.
  4. In the dialog, add a Name and an OAuth client ID. Select API Access as Purpose and User Provisioning as Access. In the security part select Client Credentials and mark confidential. Maintain a secret. You will need the OAuth client ID and secret later on the in the IPS setup.
  5. After saving keep the OAuth Client Token URL in the upper part in mind for setting up SAC in Identity Provisioning Service.

Setup SAC in IPS

The following steps show the setup in an IPS system 2019 with screenshots. You find the official documentation here.

  1. Logon to your IPS system. Open the tile “Target Systems”.
  2. Create a new target system. Save the following coding as json file and upload the file under Define from File. In the coding you will have to exchange <<SAC Host Name>> with your SAP Analytics Cloud Host Name and <<SAC Token URL>> with your OAuth Client Token URL.
      "connectorType": "SAP_ANALYTICS_CLOUD",
      "accessMode": "WRITE",
      "relatedSystems": [
        "SAP Marketing Cloud"
      "name": "SAP Analytics Cloud",
      "state": "ENABLED",
      "properties": {
        "Type": "HTTP",
        "User": null,
        "Authentication": "BasicAuthentication",
        "OAuth2TokenServiceURL":<<SAC Token URL>>,
        "ProxyType": "Internet",
        "ips.trace.failed.entity.content": "true",
        "URL": "<<SAC Host Name>>",
      "encryptedProperties": {
        "Password": null

    After the upload the Properties Tab shows a red mark:

    Switch to the properties tab and enter the OAuth Client ID as user name and secret as password which you have defined in the SAC system for IPS.

    Save your system.

Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Tobias Schneider
      Tobias Schneider

      Hi Eileen,

      nice blog! 🙂

      But usually we have some more users in SAP Marketing Cloud than in SAP Analytics Cloud.

      So, is it possible to create a group in IAS (let's name it SAC Users) and provision only the users in that group to SAC? What do I have to change in the "Transformation" tab in IPS to fetch only those users from IAS?

      BR Tobias

      Author's profile photo Eileen Koehler
      Eileen Koehler
      Blog Post Author

      Hi Tobias,

      you can check the role name assigned to a Marketing Cloud User to transfer only those users to SAC. You find the assigned role name with this statement: "$.user.role[*].roleName". You can use it in a condition like the start date is used in the default condition. Check the code sample in the document here.  

      Best regards,