SAP ID service manages customers S-User. Currently SAP ID service cases gets opened wrongly in BC-IAM-IDS and also gets transferred from other components in the BC-IAM-IDS component. Therefore, to address this scenario and help our customers to address them to the fast resolution, we have created the following blog to provide the correct steps to follow.
Any inquiries related to S-users, P-Users, T-user or cloud users. For example:
- The customer has question/query/update request for their S-user and P-User for SAP ID Service (IDS) and there is a need to know the right area who supports these issues
- Multi-factor authentication questions
- Did not receive password reset email
- Trouble resetting password
- Disable/deactivate Two-Factor Authentication / TFA / 2FA / MFA for a user
Confirm your scenario:
- Cloud Portal (ycloud.accounts.ondemand.com).
- SAP ID Service (accounts.sap.com).
- Custom IAS tenant (tenantid.accounts.ondemand.com - except ycloud).
Note: SAP ID Service and custom IAS tenant are not the same.
- SAP ID Service (accounts.sap.com): By default, the SAP BTP cockpit and console client are configured to use SAP ID Service as the platform identity provider. SAP ID Service, however, uses the SAP user base (providing, for example, your s- or p-user)
- Custom IAS tenant (tenantid.accounts.ondemand.com - except ycloud): If you want to have subaccount members from your custom user base and use custom security configuration (such as two-factor user authentication, or corporate user store, for example), you can switch to a custom Identity Authentication tenant as a platform identity provider
Here is a list of SAP Cloud products, the related URL to access the product and the SAP Support component that covers it at:
Also, you may have heard about SAP Universal ID. SAP Universal ID provides easier access to SAP sites. With SAP Universal ID, you have one single SAP account for life. It gives you the ability to log in once and choose between your S/P-user IDs, enabling you to easily switch between users and manage your account profile. Review the documentation at:
https://www.sap.com/account/universal-id.html.
Support channels are different for the SAP ID Service and the Identity Authentication Service.
- If you are using the SAP ID Service, then the URL will be: https://accounts.sap.comEnd User Support is done by the respective Service Provider.
For SAP ID Service Error messages you must email directly the SAP IDS team at sso@sap.com (18x7 CET).
BC-IAM-IDS does not handle these issues anymore.
Review the following KBA for a list with possible issues and detailed steps and information:
- If you are using SAP Universal ID, the issues will be covered by SAP ID Service team (check previous point).
- If you are using a custom IAS tenant, then you will have the following URLs:
PROD: *.accounts.ondemand.com / QA: *.accounts400.ondemand.com
Issues are handled by component BC-IAM-IDS
- If you are using Cloud Portal (https://ycloud.accounts.ondemand.com) and want to report an issue about deactivation of the Two-Factor Authentication / TFA / 2FA / MFA for a user, then you need to report an incident on component CEC-HCS-CCAZ-CSO
