## 7.1.9   Security Recommendations for SAP Authorization and Trust Management Service
This service contributes to a central list of security recommendations for SAP BTP.
See the list of security recommendations for the SAP Authorization and Trust Management service.
The following sections present an overview of these recommendations according to your role.
## Account Administrators
Account administrators manage access to SAP BTP for their organization. They also manage the apps to which their organization is subscribed.
Security Recommendations for Account Administrators
| Summary                                                                                     | Recommendation   |
|---------------------------------------------------------------------------------------------|------------------|
| Use custom identity providers for better integration and pol- icy enforcement.              | BTP-UAA-0008     |
| Check your custom identity providers.                                                       | BTP-UAA-0015     |
| Synchronize the user data with a provisioning service.                                      | BTP-UAA-0016     |
| Check which users have critical roles.                                                      | BTP-UAA-0017     |
| Check that only administrators have acccess to REST APIs.                                   | BTP-UAA-0022     |
| Remove users who haven't logged on for a long time.                                         | BTP-UAA-0010     |
| Implement a data deletion strategy.                                                         | BTP-UAA-0011     |
| Check the validity configuration for access tokens.                                         | BTP-UAA-0005     |
| Rotate the signing keys for access tokens.                                                  | BTP-UAA-0019     |
| Rotate the signing keys for the SAML protocol.                                              | BTP-UAA-0020     |
| Ensure understandable links for identity providers on logon pages.                          | BTP-UAA-0018     |
| Archive audit log entries.                                                                  | BTP-UAA-0012     |
| Integrate the audit log with your corporate event manage- ment system.                      | BTP-UAA-0013     |
| If you embed the login page of this service, check where you allow the page to be embedded. | BTP-UAA-0001     |
| Train business users how to handle session timeouts                                         | BTP-UAA-0023     |
## Developers
Developers create new applications for their organization.
Security Recommendations for Developers
| Summary                                                                 | Recommendation   |
|-------------------------------------------------------------------------|------------------|
| Enable individual secrets for each binding of a service in- stance.     | BTP-UAA-0003     |
| Set the redirect-uris parameter to restrict access as much as possible. | BTP-UAA-0002     |
## Summary
## Recommendation
| Check your custom code for updates to client libraries of- fered by SAP in your dependencies.   | BTP-UAA-0021   |
|-------------------------------------------------------------------------------------------------|----------------|
## Platform-as-a-Service Operators
Platform-as-a-service operators manage applications developed by their organization.
Security Recommendations for Platform-as-a-Service Operators
## Summary
Recommendation
Automate your deployment process to cope with the lifetime of the X.509 certificates. BTP-UAA-0014