## 4.1.3.6 Developing Multitenant Applications in the Cloud Foundry Environment
In the Cloud Foundry environment, you can develop and run multitenant applications, and share them with multiple consumers simultaneously on SAP BTP.
## What is Multitenancy?
SAP BTP provides a multitenant functionality that allows application providers to own, deploy, and operate tenant-aware applications for multiple consumers, with reduced costs. For example, the application provider can upgrade the application for all your consumers instead of performing each update individually, or can share resources across multiple consumers. The application consumers launch the applications using consumerspecific URLs, and can configure certain application features.
With tenant-aware applications, you can:
- Separate data securely for each tenant
- Save resources by sharing them among tenants
- Update applications efficiently, in a single step
<!-- image -->
Consumers cannot see the data of other consumers; the multitenant application maintains data separation between tenants, and SAP Customer Identity and Access Management (SAP CIAM) is kept isolated. Each consumer accesses the multitenant application through a dedicated URL.
## Multitenancy Roles
The multitenancy concept involves two main user roles:
| Application provider   | An SAP global account owner that uses SAP BTP to own, build, run, and offer custom- developed applications to its consumers.      |
|------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| Application consumer   | A consumer of the application provider, such as a department or organizational unit, whose users use the multitenant application. |
## How Does Multitenancy Work for the Application Consumer?
For a consumer to use a tenant-aware application on SAP BTP, the application owner must ensure that each consumer:
1. Has a dedicated subaccount in the application provider's global account.
2. Subscribes to the application using either the SAP BTP cockpit, SAP BTP command-line interface, or a dedicated REST API. A subscription means that there is a direct relationship between an application provider and the consumer's tenant. The application provider authorizes the consumer tenant to use the application.
3. Receives a dedicated URL so that its business users can access the application As with any application running in SAP BTP, these multitenant applications consume platform resources, such as compute units, structured and unstructured storage, and outgoing bandwidth. The costs for these consumed resources, and those of the application consumer, are billed to the provider of the multitenant application.
For more information about these consumer-related steps, see Providing Multitenant Applications to Consumers in the Cloud Foundry Environment [page 405] and Subscribe to Multitenant Applications Using the Cockpit [page 2274].
When a consumer accesses the application, the application environment identifies them by their unique tenant ID. The application distinguishes between requests from different consumer tenants based on the tenant ID, thus ensuring data isolation.
The following figure illustrates the relationship between the application provider's subaccount and consumer subaccounts (tenants) in the provider's global account. You deploy the multitenant application to the provider subaccount, and subsequently the consumer subaccounts subscribe to the deployed application. The application uses the tenant-aware approuter application and xsuaa service (with the application plan) to authenticate business users of the application at runtime. The application is then registered with the SAP Software-as-a-Service Provisioning service (technical name: saas-registry ) with the application plan, which makes the application available for subscription to consumers.
<!-- image -->
## Workflow
This is the workflow and requirements for developing and deploying a multitenant application in the Cloud Foundry environment:
1.
Develop the Multitenant Application [page 391]
In the Cloud Foundry environment of SAP BTP, you can develop and run multitenant applications that can be accessed by multiple consumers (tenants) through a dedicated URL.
2. Deploy the Multitenant Application to the Provider Subaccount [page 394] After you have developed your multitenant application and authorizations, you need to deploy the
application in a Cloud Foundry space in the provider's subaccount.
3. Configure the approuter Application [page 395] To authenticate business users of the application at runtime, use the tenant-aware approuter application and xsuaa service in SAP BTP.
4. Bind the Multitenant Application and Application Router to the xsuaa Service Instance [page 397] Bind your multitenant application and the approuter application to the xsuaa service instance, which acts as an OAuth 2.0 client to your application.
5. Register the Multitenant Application to the SAP SaaS Provisioning Service [page 398]
To make a multitenant application available for subscription to SaaS consumer tenants, you (the application provider) must register the application in the Cloud Foundry environment via the SAP Software-
as-a-Service Provisioning service (
saas-registry
).
6. Providing Multitenant Applications to Consumers in the Cloud Foundry Environment [page 405] Create a subaccount in your global account for each application consumer, subscribe each consumer subaccount to the hosted application deployed in the provider account, and then set up application roles and assign users.
## Related Information
Using SAP SaaS Provisioning Service APIs to Manage Multitenant Applications [page 407]
Data Protection and Privacy [page 3273] Using the Subscription Management Dashboard [page 412]