The Maintain Business Users app is the central tool within SAP S/4HANA Cloud for assigning business catalogs, which contain the specific authorizations needed to access apps and perform actions like posting financial transactions. While IAS handles authentication and provisioning moves users, the business role assignment is done directly in the S/4HANA system.

The ‘Risk-Based Remediation’ app is designed for the end-to-end process of handling SoD and critical access risks. It allows you to analyze conflicts, understand the risk, and choose a remediation action, which is often implementing a mitigation control (like an additional approval step) rather than just removing necessary access. This reflects a real-world, risk-managed approach.

The Identity Provisioning (IPS) service is the standard tool for automated, scheduled user synchronization from corporate identity providers (like Active Directory) to SAP systems. It ensures users are created, updated, and deactivated based on the central source, providing scalability and reducing manual effort and errors.

This is a classic symptom of missing authorizations at the *field* or *action* level. Having the app (Fiori tile) visible requires launch authorization, but performing specific operations (like create, save, edit) requires deeper business object privileges. The investigation would start by checking the authorizations within the business catalog attached to the user’s role.

SAP S/4HANA Cloud supports time-dependent assignments in the ‘Maintain Business Users’ app. This allows you to add an additional role (like the approval role) to a user with a precise start and end date. It is the most secure, auditable, and administratively clean method for granting temporary access, as it automates the revocation.

The access request workflow in IAG is a core governance feature. It moves access provisioning away from informal requests (like emails) into a structured system with approvals, fulfillment, and an audit trail. This ensures access is granted appropriately and in compliance with policy.

SAML 2.0 is the standard protocol for federated authentication. Establishing this trust is fundamental: IAS (the IdP) asserts the user’s identity to S/4HANA Cloud (the SP). Without this configuration, the systems cannot communicate for single sign-on purposes.

In the SAP Cloud Identity Architecture, the Identity Authentication service (IAS) is the central point for authentication policies. Since IAS handles the login process, its password policy configuration (like length, complexity, and history) applies to all users authenticating through it to access connected applications like S/4HANA Cloud.

Certification reports in IAG can be configured to include contextual data like user attributes (department, location). Reviewers can quickly see if a user has moved from, for example, the procurement department to marketing but still retains procurement access, flagging this as a potential anomaly for revocation.

The Maintain Business Users app is the central tool within SAP S/4HANA Cloud for assigning business catalogs, which contain the specific authorizations needed to access apps and perform actions like posting financial transactions. While IAS handles authentication and provisioning moves users, the business role assignment is done directly in the S/4HANA system.0