User provisioning is the process of automatically creating, updating, and deleting user accounts and access across multiple systems, based on a central source system. The source and target systems can be either on-premise or cloud-based.

For example , when a new employee joins a company and is onboarded in the SAP SuccessFactors (SAP SF) system, their details (such as name, email, role, and department) are entered into SAP SF. Through SAP Identity Provisioning Service (SAP IPS), this information is automatically synchronized across multiple systems such as Microsoft Azure AD, Fieldglass, SAP on-premise, and other third-party applications . This seamless provisioning ensures that the employee gains immediate access to all the required systems, reducing manual effort and improving productivity from day one.

SAP Cloud Identity Services – Identity Provisioning (IPS) helps you manage user identities and their access rights across various cloud and on-premise business applications. It enables seamless data exchange across different systems using SCIM (System for Cross-domain Identity Management) standards.

SCIM is a protocol that standardizes how identity information is exchanged between one entity and another. It’s an open standard and is widely used to simplify the process of granting people or groups access to cloud-based applications.

The key to understanding the purpose of SCIM is in its name:

• System —SCIM creates a common format for how identity data is exchanged.
• Cross-domain —SCIM securely communicates identity data across platforms.
• Identity Management —SCIM automates the flow of information between an identity provider or  identity and access management (IAM) system  and cloud-based applications.

Advantages of IPS:

• Efficient Data Management: User roles are automatically removed when someone leaves, ensuring everything stays compliant.
• Automation & Efficiency: It removes the need for manual onboarding and offboarding, saving IT teams a lot of time.
• Enhanced Security & Compliance: Role-based access control (RBAC) improves security and helps comply with data protection laws like GDPR and SOC 2.
• Seamless Integration: Works with various SAP applications, including SuccessFactors, S/4HANA, and Fieldglass, and provides a smooth login experience through SSO.
• Centralized Access Control: It allows you to manage user access from a single point, ensuring consistent and secure permission across systems.

In this blog, I will demonstrate how to use SAP Cloud Identity Services – Identity Provisioning (IPS) to synchronize user data from SAP CUA to Fieldglass , based on specific business roles assigned to users in source system “SAP CUA”.

Setting Up SAP CUA as a Source System in IAS(SAP Identity Authentication):

1. Log in to your IAS tenant .
2. Navigate to Identity Provisioning → Source Systems , then click Add to configure SAP CUA as a source system.

3. You will get multiple option to select “Type” of source system. In our scenario, we will select “SAP application server ABAP”

4. Enter System name . If your source system is on-premise system , then you need to create destination in BTP and refer that in Destination Name .

5. In the Properties section, you will find multiple standard property options that allow you to define criteria for polling user details from the source system.  In our scenario, I used the property:“abap.user.membership.filter”. Using this condition, I was able to retrieve all users who were assigned theFG rolein SAP CUA.  

    Additionally, other properties, shown in the screenshot below, can be used to enable trace logging when an error occurs or to set up notification emails etc. For a deeper dive into these properties, visit the official SAP documentation page   .

6. When you click Save , the Transformations tab will be updated with the standard SCIM mapping. You can modify the mappings for specific fields according to your requirements.

          For example, in the screenshot below, you can enable value mapping logic for certain fields.

Setting Up Fieldglass as a Target System in IPS

7. Go to Identity Provisioning → Target Systems and click on “Add” to set up FieldGlass as the target system.

8. Enter System Name , Description and Source System name

9. In the Properties section, add all the required connection details to connect to the target system, enable trace logging, and configure other settings. For more information on other properties, check out SAP page .

10. When you click Save , the Transformations tab will be updated with the standard SCIM mapping. You can modify the mappings for specific fields according to your requirements.

11. IPS also gives you option to have error notification email , for that you need to click on “Subscribe me” . If you want to add other people as well then click on “Subscribe others” and add their emails.

Below is sample email notification for errors.

12. To view the job logs in more detail, go to “Provisioning Logs” and search for your source system.

This way you can sync user data from SAP CUA to SAP FG.

Conclusion

Integrating SAP CUA with Fieldglass using SAP IPS for user provisioning is a smart, automated way to manage identities. With SCIM-based provisioning, companies can boost security, cut down on manual work, and make user management across SAP systems much smoother.