## 6.1.3.5.6 Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant
SAP BTP supports identity federation. Its concept is to reuse the user bases of identity providers. To use a custom identity provider, your global account or subaccount in SAP BTP must have a trust relationship to the identity provider you want to use.
<!-- image -->
##  Note
We recommend that you always use SAP Cloud Identity Services as a single identity provider for SAP BTP. If you use corporate identity providers, connect them to your SAP Cloud Identity Services tenant, which then acts as a hub.
## Prerequisites
- You have a tenant of SAP Cloud Identity Services. For more information, see Tenant Model and Licensing in the documentation for SAP Cloud Identity Services.
- The SAP Cloud Identity Services tenant is associated with the customer IDs of the relevant global account of SAP BTP. For more information, see Reuse SAP Cloud Identity Services Tenants for Different Customer IDs in the documentation for SAP Cloud Identity Services.
- Make sure that the email addresses of all users in your identity provider are unique and correct.
##  Note
We recommend that you request your own SAP Cloud Identity Services tenant (see Getting a Tenant).
## Managing Trust Configurations
##  Tip
All of these commands can be executed in the global account or in a subaccount. To choose the level, use the btp target command. See Set a Target for Subsequent Commands with btp target [page 2425].
To manage trust with your identity provider, use the following commands.
btp create security/trust --idp my-tenant --subaccount my-subaccount-id --name my-trust-configuration --description "My Trust Configuration"
See Trust and Federation with Identity Providers [page 2280].
| Task                                                                                                                                                         | Run the command...        | Command help                |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------|-----------------------------|
| List all trust configurations that are configured for your global ac- count or subaccount tenants to which you can connect this global account or subaccount | btp list security/trust   | btp list secur- ity/trust   |
| Get details about a trust configu- ration                                                                                                                    | btp get security/trust    | btp get secur- ity/trust    |
| Establish trust from a global ac- count or subaccount to an SAP Cloud Identity Services tenant to which you can connect this global account or subaccount    | btp create security/trust | btp create se- curity/trust |
| Update a trust configuration of a global account or subaccount                                                                                               | btp update security/trust | btp update se- curity/trust |
| Task                                                                                                                                                | Run the command...         | Command help                 |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|------------------------------|
| Delete a trust configuration from a global account or subaccount                                                                                    | btp delete security/trust  | btp delete se- curity/trust  |
| Migrate from SAML trust to OpenID Connect trust                                                                                                     | btp migrate security/trust | btp migrate se- curity/trust |
| Roll back the migration of an ex- isting SAML trust with any iden- tity provider to OpenID Connect trust with an SAP Cloud Identity Services tenant | btp restore security/trust | btp restore se- curity/trust |
## Finding Available SAP Cloud Identity Services Tenants
| Task                                                                                                           | Run the command...                                                                              | Command help                       |
|----------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|------------------------------------|
| List all SAP Cloud Identity Services                                                                           | btp list security/available-idp                                                                 | btp list secur- ity/available- ipd |
| Get details about an SAP Cloud Identity Services tenant that is available for a global account or a subaccount | btp get security/available-idp To see available tenants, run btp list security/available- idp . | btp get secur- ity/available- ipd  |
Parent topic:
Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Setting Entitlements Using the btp CLI [page 2438]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Working with External Resource Providers Using the btp CLI [page 2441]
Managing Users and Their Authorizations Using the btp CLI [page 2445]
Managing Signing Keys for Access Tokens [page 2447]
Managing Security Settings [page 2448]
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]