Add users in SAP BTP Cockpit

Because SAP BTP separates external corporate identities from platform permissions, you must add authorized users in the BTP Cockpit before they can sign in.

Note:

This is a mandatory step. Users who aren't added to the BTP Cockpit won't be able to sign in, even after SSO is configured.

Sign in to the SAP BTP Cockpit as a Global Account Administrator.
In the left navigation, go to Security > Users.
Click Create and configure the new user record:
- Username/Email: Enter the user's Okta corporate email address (for example, user@company.com).
- Identity Provider: Select your custom SAP IAS tenant from the dropdown menu. Don't select the default SAP ID Service.
Click Save.
Select the newly created user row, click the Role Collections tab, and assign the required role collections.

Next step

Verify SP-initiated Single Sign-On (SSO)