SAP BTP Cockpit supported features

This table lists the features and functionality that are available with an SAP BTP Cockpit integration.

Feature Description
Push new users
  • Users created in Okta are initially created in SAP Cloud Identity Services. A user can sign in to SAP BTP Cockpit only after they're added to a user group that's mapped to a role collection in SAP BTP Cockpit.
  • Roles can't be directly assigned to individual users in SAP BTP. Access is managed by adding user groups to role collections in the BTP Cockpit.
  • Once a user is in SAP Cloud Identity Services and assigned to a group that's mapped to a role collection, they can sign in using their Cloud Identity Services credentials.
  • As an alternative, a user can sign in after they're added to the Identity Service and mapped to the BTP Global Account.
  • Enterprise SCIM attributes (department, costCenter, division, organization, manager) and the SAP extension attributes mailVerified and sendMail are now included when creating a user. Supported only on non-government SAP BTB instances.
Push profile updates
  • Updates to the Okta user profile are pushed to SAP Cloud Identity Services. Only first name and last name updates are reflected in SAP BTP Cockpit.
  • Updating the username isn't recommended. If a username update is required, both the username and email address fields must be updated simultaneously.
  • The first name and last name fields can't be empty.
  • Profile updates are visible in SAP BTP Cockpit only after the user re-authenticates.
  • Enterprise SCIM attributes (department, costCenter, division, organization, manager) are now included when pushing profile updates. Supported only on non-government SAP BTB instances.
Push user deactivation Deactivating a user or disabling their access to the app in Okta also deactivates or disables the user in SAP Cloud Identity Services and SAP BTP Cockpit.
Import new users
  • Users created in the Cloud Identity Services admin console are imported into Okta. All user attributes and organizational data are maintained during import.
  • Imported users are mapped with the SAP Enterprise SCIM attributes (department, costCenter, division, organization, manager) and the SAP extension attributes (mailVerified and sendMail) to Okta SCIM. Supported only on non-government SAP BTB instances.
Import profile updates Updates made to a user's profile in Cloud Identity Services are downloaded and applied to the profile fields in Okta.

Syncing behavior for custom attributes depends on where the updates originate. Modifying an attribute directly in the Admin Console flags it with ADMIN mapping (sourceType: ADMIN), which locks the field and prevents incoming imports from overwriting it. Attributes that are imported without prior Admin Console edits retain their default ISV/APP mapping and continue to sync updates automatically. To resolve stuck values, you can manually reset the locked fields in Okta to restore automated profile mastering.
Reactivate users Reactivating or enabling a user in Okta also reactivates or enables them in SAP Cloud Identity Services and SAP BTP Cockpit.
Push password updates Changes to a user's password in Okta are automatically synchronized to SAP BTP Cockpit.
Import user schema
  • The user schema from SAP BTP Cockpit is downloaded into Okta.
  • The schema now includes the Enterprise SCIM attributes department, costCenter, division, organization, manager, along with the SAP extension attributes (mailVerified and sendMail) . Supported only on non-government SAP BTB instances.
Entitlement Management
  • You can manage app entitlements for SAP BTP Cockpit in Okta. If the app supports Okta Identity Governance, then you need to enable it to manage entitlements.
  • Roles are maintained by assigning users to user groups. These user groups are then mapped to role collections in SAP BTP Cockpit to control user access levels.
Push groups
  • Groups and their members can be pushed to integrated apps. See Manage Group Push.
  • Group members can be added or removed at any time.
  • The display name can be updated at any time.
  • If the description field is updated to an empty value in Okta, the integration sets the description to null in SAP BTP Cockpit. All other text-based updates to the description field are pushed as entered.