Skip to Content
Technical Articles
Author's profile photo Alexei Dugarov

Getting started with SAP Analytics Cloud, Embedded Edition (BTP service). Part I


I am a Customer Engagement Partner who helps SAP client to adapt our P&T cloud solutions. So I faced with the Client’s request about implementing this service. Here is my experience to roll-out the service with the connection to SAP HANA Cloud. Previously I’ve been an Analytics & EPM presale expert. So I have a great experience working with standalone SAP Analytics Cloud since 2017 and it was very interesting to find all necessary information and validate it. Hope this article will help you to avoid some troubles and save your precious time.

This is my the very first blog post and I dedicate it to SAP Analytics Cloud, embedded edition which is available as a service on SAP BTP platform. Link to the service page on SAP Discovery Centre.


What is SAP Analytics Cloud, embedded edition?

At first we should answer the question what is the difference between “SAP Analytics Cloud, embedded edition” “SAP Analytics Cloud embedded functionality”. The last one is commonly used to position SAC as a single analytical solution and its ability to embed dashboards into different SAP LoB Solutions (SuccessFactors, Ariba, CX… ) or standalone applications with the help of SAC URL API.

The “SAP Analytics Cloud, embedded edition” service is available since February 2019 (by Aaron Graber) and positioned as a solution to enable BI capabilities inside business applications (“microservice for application developers”).

For the whole process and success you will use SAP BTP Platform cockpit, SAP Analytics Cloud, embedded edition, SAP Business Application Studio, SAP HANA Cloud and Postman.

Also I will try to keep names, IDs and passwords for you to better understand which one and where is used. But they will not accessible cause the service will be deleted till the time when this post is published.

Comparing to well-known SAP Analytics Cloud which is available by a subscription SAP Analytics Cloud, embedded edition available only for SAP BTP customers with CPEA and PAYG contracts. The price can be found on the next tab in Discovery Center. As you can see it has a limit of 150 CS (concurrent sessions) and charges by hours (and you can’t start/stop it but only delete/create service from your BTP subaccount).

SAP Analytics Cloud, embedded edition has reduced scope and functionality. That’s why the most of backend setup is made by API and not via well-known user interface. This is actual for both Security/Users and Connections sections.

Talking about data sources: SAP Analytics Cloud, embedded edition can only has live-connection to SAP HANA Cloud. But as you will see later, it doesn’t support native “SAP HANA Cloud” connection type which is available for SAP Analytics Cloud (as for now, August 2021). So the only option for you will be the usage of HANA Analytics Adapter (HAA) and there is also some difference and updates comparing the blog posts about HAA.

So let’s get started. The plan of this Part I has the next steps:

  1. Create a service
  2. Theoretical part. Difference between SAP Analytics Cloud, embedded edition and SAP Analytics Cloud.
  3. Install Postman and SAP Analytics Cloud, embedded edition API tenant management
  4. Create a user via API and user management
  5. Access to SAP Analytics Cloud, embedded edition tenant in Chrome browser

The other steps will be described in Part II blog post.

1. Creating SAP Analytics Cloud, embedded edition service in SAP BTP cockpit (Feature B)


  • You have SAP BTP contract by CPEA or PAYG commercial models.
  • You have created a subaccount in one of the following regions: AWS: Australia (Sydney), Brazil (São Paulo), Europe (Frankfurt),  Japan (Tokyo), Singapore, US East (VA)
  • Your profile has an authorization to provide Entitlements for subaccount on GA (Global Account) level or your GA administrator have entitled SAP Analytics Cloud, embedded edition service for you subaccount and you are subaccount administrator.
  1. Log in into your Global Account cockpit
  2. Open Account Explorer and Create a new subaccount and select desired region on AWS landscape.

  3. Go to Entitlements->Entity Assignments, select your subaccount and press Go.
  4. Press Configure Entitlements and then Add Service PlansNew window opens

    Find or filter SAP Analytics Cloud Embedded Edition, select Plan and click Add Service Plan

    Don’t forget to Save your changes
  5. Navigate to your subaccount via Account Explorer or just click on the link on the page
  6. Check that SAP Analytics Cloud, embedded edition is available in Entitlements. Enable Cloud Foundry (if not done before).

    Create Space (if not done before) and name it as you want.
  7. Create Quota Plan and assign it to your Space

  8. Go to Instances and Subscription and Create a new SAP Analytics Cloud, embedded edition instance

  9. After instance has been created (it takes a while) go to parameters

  10. Click on the service and generate Service Keys.

  11. Save created Service Key as a file. We will use this data to setup our SAP Analytics Cloud, embedded edition tenant in chapter 3.
    You should have something like that:
  12. If you try to access “sac_embedded_edition_service” URL and try to logon with existing user it will say you don’t have an access. Here is a important note: you may try to access to this SAP Analytics Cloud, embedded edition tenant by your standard e-mail and password as you know that a single account of SAP Identity Service is used (by default for every and each SAP Analytics Cloud tenant). But even you have created the service (with the same SAP BTP e-mail account) SAP Analytics Cloud, embedded edition tenant have not yet your account pre-configured.

Note (thanks to Piotr, Tesny for comment below):
1. I will use an email which already has an access to a separate SAP Analytics Cloud instance.
2. In case you have no access to any SAP Analytics Cloud tenant after provisioning a user you should click on “Forgot Password” and receive a link on e-mail to setup a password.
3. If you have configured your own IdP tenant (MS AD, SAP IAS and etc.) for SAML authorization you need to manage new users in that IdP.

So SAP Analytics Cloud redirects us to SAP Identity Service login page
But we cant access it yet

2. Theoretical part. Difference between APIs for SAP Analytics Cloud, embedded edition and SAP Analytics Cloud

Here is a scheme which shows the difference in workflow between full-use Analytics Cloud and it’s reduced version. PDF file are available for printing here. Also some elements on these schemas have links to SAP Help.


High-level comparison of two different products and APIs available

As we can see the main differentiators are:
– we have additional tenant REST API endpoints
– there is no UX unavailable for some capabilities
– there is no some technical capabilities at all (data acquisition and so on)

There is a few UI access and you can log in only after a proper tenant setup and creating the first user (actually by default a system owner is being created but you can’t access it cause it is SAP technical user). So we will proceed and here is the scheme of our next actions.

SAP Analytics Cloud, embedded edition Setup Workflow

Here time comes to refer the blog post SAP Analytics Cloud User and Team Provisioning SCIM API Best Practices and Sample Scripts where Matthew Show discloses best practices for SAC. I appreciate Matthew very much for his work. Based on it I was able to learn Postman and adapted his scripts for SAP Analytics Cloud, embedded edition. Also at the end I’ve decided to keep the same variable names to make Matthew’s Sample Scripts compatible with the environment we will use for SAP Analytics Cloud, embedded edition setup and management.

Please go to Setup section on SAP Wiki and install Postman according User’s Guide. You can download Matthew’s Sample Scripts, but you don’t need them now. Let’s proceed with tenant management (this part is not available for SAP Analytics Cloud enterprise/standalone).

3. Install Postman and SAP Analytics Cloud, embedded edition API tenant management

Here we will use Help v.1.1. Managing, Configuring, and Monitoring the SAP Analytics Cloud Tenant but in the right order of steps. Be careful if you go to help from product’s page as it forward you to Help page v.1.0.

In this case select the latest one in drop-down option

So the Help’s structure look like this. And we will perform actions in the next order:

Lets start with Postman and then go to setup process via API.

  1. Install Postman according the User Guide mentioned before
  2. Save Collections and Environment for SAP Analytics Cloud, embedded edition (it is also described in User’s Guide) from Github (a correct version has been updated 02/09/2021). Then import them to Postman. Open the Environment. Values are empty now (except 2 which inherited for compatibility).
  3. Lets open the file we saved on the 1st step and setup our environment.
  4. Make the next mapping of the fields and fill out the Postman’s environment with values by copy-paste
  5. So you should get something like this in Postman:

    Save it an Close it to avoid conflict when new values will be received while your open window will still has empty value.
  6. Open imported collection “0001. SAC Embedded Tenant Management” and lets look what we have

    1. Token creation – this step in official help documentation called Authentication in section so now you can understand what URL and credentials you should take.
    2. OAuth addition – this step in official help documentation also called Authentication (in section Provision and Manage User Accounts…) You need to create it to have an access to user management APIs.
    3. Tenant configuration – it is an Endpoint to manage tenant (Help link) and receive ClientID and ClientSecret for OAuth Client.
      These are the steps to implement our plan:
  7. Click Run Collection.

    In opened window select the Environment and press Run.
  8. What is going on in background if you look at Help’s structure:

    1. Token creation – returns tenantaccesstoken to manage your tenant. Can be used for each /Tenant endpoint.
    2. OAuth addition – you create an OAuthClient to your SAP Analytics Cloud, embedded edition tenant which authorized to create users by API.
    3. Tenant configuration – you request configuration of your SAP Analytics Cloud, embedded edition tenant, where ClientID and ClientSecret for API access is generated and save these values to the Environment.
      Here I used the variables names as they are used in Matthew’s SCIM API Sample Scripts. In fact they are named CliendID and ClientSecret in response for tenant’s configuration.
  9. The result of these requests is visible in Environment where Username/Password was filled with value, tenantaccesstoken was created and filled with value.

  10. Also in Postman you can open the Console and review log

  11. This is it for initial setup. Now you can access Endpoints for /Tenant management and /User and /Group management which will be described below.

4. Create a user via API and user management

Here will use Help v.1.1. Provision and Manage User Accounts and Teams for the SAP Analytics Cloud Tenant. The same warning – use the latest version for now it is v.1.1.
Now we will proceed with the steps we made before and we get an accesstoken to be used for SCIM API management according the endpoints for SAP Analytics Cloud, embedded edition. The right step order are following:

  1. We already created an OAuth Client. It was made in the Step 2 of previous collection.
  2. We create another accesstoken. We can’t go directly to SAP Analytics Cloud, embedded edition endpoints cause we don’t have accesstoken to SCIM API.
  3. We use API endpoints to create a user.

SAP Analytics Cloud, embedded edition help (this page has links to SAP Analytics Cloud API endpoints) but doesn’t say you need to get the token which is different from tenantaccesstoken.

How to read the references and the help documantation:

Let’s go to Postman and create a user with Admin BI role.

  1. Open the next collection “0002. SAC Embedded Create User”

    1. OAuth token create – create a new accesstoken
    2. Get Fetch – We got new x-csrf-token
    3. /User create – We created a new user
    4. /User GET – We requested info about existing users in the tenant
  2. Make changes to the body of the GET request “/Create User”:

    1. UserName – mandatory field. In my example I use an email. System automatically changes it to GivenName&familyName concatenation. You can create any name according to your template/ID.
    2. Email – mandatory field.
    3. Role – you have 2 options according the help page Assigning Roles to Users and Groups:
      1. PROFILE:sap.epm:Embedded_BI_Admin
      2. PROFILE:sap.epm:Embedded_BI_User
  3. Save and Run collection. You might want to select “Save response” to review them it in Console.
  4. Here what we see in Console.
    1. We got new accesstoken
    2. We got new x-csrf-token
    3. We created a new user
    4. We requested info about existing users in the tenant
  5. (Optional) Review response from the last request
    We created user named ALEXEYDUGAROV with the role BI Admin. To manage this user via Endpoint /USER/<ID> you need to send request to this location.

    Also there is a system owner (as in standard SAP Analytics Cloud tenant) which can’t be changed
  6. To maintain any parameters to Users or Groups please learn mentioned blog post SAP Analytics Cloud User and Team Provisioning SCIM API Best Practices and Sample Scripts by Matthew Show

5. Access to SAP Analytics Cloud, embedded edition in Chrome browser

You should take your “sac_embedded_edition_service” URL (we’ve saved “Service Keys”) and paste to Chrome. Here is the same page we’ve tried to enter.
The difference is we are able to log in!

Here I would like to stop.

What you have learned in Part I:

  1. How to use SAP BTP cockpit to create service (in our example it was SAP Analytics Cloud, embedded edition)
  2. How workflow look like when you are working with SAP Analytics Cloud, embedded edition. What APIs are available
  3. How to setup SAP Analytics Cloud, embedded edition tenant via Postman.
  4. How to create a user and what users roles are available.

I plan to continue this topic so please subscribe to get a notification. The next blog post (Part II) is planned to have the next agenda:

  • Start SAP HANA Cloud service
  • Development SAP HANA objects in SAP Business Application Studio service (actually, I will provide a link to the tutorials how to do it)
    • create Table and data load
    • create Calculation View
    • create SAP HANA Analytics Adapter and configure it
  • Configure SAP HANA Cloud user access and setup SSO
  • Create a live connection to SAP HANA
  • Create a Model based on live-connection.

Thanks for reading! Please comment below or contact me if you find any mistakes or errors or issues with an access to files.

Here is Getting started with SAP Analytics Cloud, Embedded Edition (BTP service). Part II

Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Henry Banks
      Henry Banks

      Thanks Alexey Dugarov ! Absolutely brilliant piece of work, and paves the way for many BTP customers to use this option. Keep up the great work! cheers, H

      Author's profile photo Piotr Tesny
      Piotr Tesny

      Hello Alexey,

      thanks for the very comprehensive tutorials on SACEE.

      However I have a small comment regarding section 1.12 onwards with regard to adding users that are able to login to a SACEE tenant.

      The SACEE user provisioning method you describe does work but under the implicit condition that the user(s) you are adding to the SACEE tenant is (are) already known to the SAML SSO IDP the SACEE tenant happens to be hooked with (like the SAP HANA Cloud Services identity tenant from your screenshot).

      Please also note that SAP HANA Cloud Services identity provider is different from the BTP platform SAP ID.

      For instance, a while ago, I happened to create a service instance of SACEE in a region where my SAP user (email address) was not registered with the IDP of the SACEE tenant. In that case the only thing that can be done is to assign to your SACEE some IDP you have control of.

      And crazy as it seems it is a common situation many non-SAP partners/customers may face...

      On a side note SACEE documentation stresses a lot on the need to switch to your own managed SAML SSO IDP (SAP IAS, AzureAD, etc...) where you can have full control on users identities.

      kind regards




      Author's profile photo Alexei Dugarov
      Alexei Dugarov
      Blog Post Author

      Hi Piotr!

      Thanks for your comment! You are absolutely right, that this user is different to SAP BTP user. I will add a note about this.

      Also situation will become more difficult when in the "Part II" I'm describing how to organize connection between SAP Analytics Cloud, SAP BTP and SAP HANA Cloud :). This all has different users and we can only provide trust if not using single IdP (Identity Provider) service.
      By the way, if you have no user but it was created by API, you can retrieve password by clicking "remind password" in logon screen 🙂 Then follow the link in email and setup a new password. While in Enterprise SAP Analytics Cloud email is received automatically if the user was created in web UI.

      Author's profile photo Freeter Xie
      Freeter Xie

      Very informative blog! Thanks.

      Author's profile photo Fernando Cornes
      Fernando Cornes



      Can you calrify what mean when says "As you can see it has a limit of 150 CS (concurrent sessions) and charges by hours (and you can’t start/stop it but only delete/create service from your BTP subaccount)."? limit of hours is relaed to processing or availability?



      Author's profile photo Alexei Dugarov
      Alexei Dugarov
      Blog Post Author



      You pay only for active hours when your tenant and service is activated in your BTP Account.

      There is no start/stop button - you should deactivate a service in your subaccount when it is unused.

      Author's profile photo Kanyin Cai
      Kanyin Cai

      Hi Alexey,

      thanks for this very helpful blog!

      I got an error "Tenant UUID may not be valid or you don't have permission" in Postman collection 0001. OAuth addition, after I had got the tenantaccesstoken successfully. The tenant UUID is correct, I copied it from service key file.

      Any idea what is the root cause? Just for info, I am using the sap internal canary BTP.


      Best regards


      Author's profile photo Vijay Yadav
      Vijay Yadav

      Hi Alexey,

      Thanks for the insightful blog, I found it very clear, concise and crisp. One can easily follow the steps given here and create their own embedded SAC on BTP.

      But as Kanyin has mentioned I am also getting the error"Tenant UUID may not be valid or you don't have permission" in Postman collection 0001,  for tenant_uuid even though the tenant_uuid is passed correctly.


      Could you please let know what could be the root cause for that?




      Author's profile photo Lei Liu
      Lei Liu

      Are you able to solve this problem?

      I have the same problem and I wonder why it is still not addressed.

      Author's profile photo Eli Montero Vargas
      Eli Montero Vargas

      Hi Alexei

      I doing all you explained in this blog but I'm getting the following error: Missing required creator property 'idpCertificate' and also I'm getting the same issue while I'm trying to use the API to get Tenant information.




      Thanks in advance for any clue on what is happening


      Author's profile photo Augusto Kelsch
      Augusto Kelsch

      Hello Eli,

      thank you for letting us know. Always follow the internal process and raise an incident on LOD-ANA-OEM-CP, so the Support Team can check for further analysis.

      For your information, this issue was already identified and fixed.

      Augusto K.