## 5.2.3  Enable Authentication and Single Sign-On for Business Users
## Overview
SAP Subscription Billing relies on the user management features of SAP Business Technology Platform (SAP BTP). For the business user access to SAP Subscription Billing, you maintain the users in the SAP BTP subaccount where SAP Subscription Billing is subscribed.
Users are stored in identity providers. For each user that you want to enable to log on to SAP Subscription Billing, a copy user called shadow user is created in the subscribed SAP BTP subaccount. The authentication of business users to access the SAP Subscription Billing user interface is delegated to the original identity provider, and users can log on with the mechanisms and credentials defined there, for example, with their email address and password. The authorizations of the users are defined with the assignment of role collections to the shadow user in the SAP BTP cockpit. See Working with Users in the SAP BTP documentation.
For more background information, see SAP Authorization and Trust Management Service.
Note : This documentation mainly concentrates on the role of the SAP BTP business user. For information about platform users, see Platform Users in the SAP BTP documentation.
## Identity Providers for User Authentication
You enable authentication and single sign-on for business users by establishing a trust relationship between your SAP BTP accounts and your identity provider.
For more information, see Trust and Federation with Identity Providers and Setting Up Authentication in the SAP BTP documentation.
##  Recommendation
We recommend that you always use SAP Cloud Identity Services - Identity Authentication as single identity provider for SAP BTP. If you use corporate identity providers, connect them to your Identity Authentication tenant, which then acts as a proxy. For more information, see Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services.
For SAP ID service, trust is preconfigured on SAP BTP by default, however we don't recommend that you use SAP ID service for your business users for productive scenarios of SAP Subscription Billing.
The SAP-administered SAP ID service doesn't support administrative access and has the following restrictions:
- User registration works through self-service: You can't provision users to SAP ID service, you can't lock users (for example, if their responsibility within the company changes or if they leave the company).
- You can't create user groups to simplify the assignment of role collections.
- You can't configure single sign-on to work with other applications controlled by your own identity provider. In other words, you can't configure identity provider proxying with the SAP ID service.
Based on this recommendation, a typical setup could look like this:
- The initial users for setting up and configuring SAP Subscription Billing are provided by the SAP ID service including preconfigured trust. Further business users with an account in SAP ID service (https:/ / accounts.sap.com/ ) can be authorized for the initial configuration.
- The initial users configure trust to a SAP Cloud Identity Services - Identity Authentication tenant. A separate tenant is used for the subaccount where you run SAP Subscription Billing productively.
- If you use corporate identity providers, connect them to your Identity Authentication tenant. This way, these identity providers remain the origin of the identity information and your business users can log in to SAP Subscription Billing with their respective credentials or with single sign-on.
## Managing Users in the SAP BTP Subaccount
There are different options to create shadow users in your SAP BTP subaccount:
- SAP BTP automatically creates the user in the global account or in the subaccount when a user-related action happens. This automatic creation of shadow users is switched off by default for the default identity provider. See Switch Off Automatic Creation of Shadow Users in the SAP BTP documentation.
- You can manually create users on the user interface in the SAP BTP cockpit. See Create Users in the SAP BTP documentation.
- You can use SAP Cloud Identity Services - Identity Provisioning to maintain users.
 Tip
For more information on user creation in integration scenarios with S/4HANA Cloud Public Edition, see Integration with the SAP Fiori Launchpad of SAP S/4HANA Cloud Public Edition in the section Creation of Business Users .
For information on user deletion from SAP BTP, see Delete Users in the SAP BTP documentation.