Microsoft Entra (previously Azure AD) or other IdPs can be integrated to SAP Cloud Identity Services directly. This support a direct authentication, when you do not need AWS IAM Identity Center (i.e. no requirement to run a multi account strategy that utilizes AWS Organizations).
Authentication flow
-
User accesses SAP Fiori via an Internet browser.
-
SAP Fiori will redirect SAML request back to the internet browser.
-
Internet Browser relays the SAML request to SAP Cloud Identity Services.
-
SAP Cloud Identity Service delegate authentication request to IdPs.
-
User is authenticated by IdP and SAML response is provided to the internet browser with user identity information.
-
User can access to SAP S/4HANA in RISE with SAP VPC.
For more information on how to do this, you can refer to Enable SSO between Azure AD and SAP Cloud Platform using Identity Authentication Service
