## 7.1.11  Limits for Technical Artifacts of the SAP Authorization and Trust Management Service
To improve the resiliency of the SAP Authorization and Trust Management service, we have introduced limitations on technical artifacts of the service.
## Limits for the Service Broker
We allow a maximum of service instances per subaccount.
There is also a maximum of service bindings and service keys in total per service instance. The service rejects attempts to add more bindings or service keys. For more information, see Service Instance Secrets [page 2371].
Limits for the Service Broker
| Service Broker Resource                                            |   Upper Limit |
|--------------------------------------------------------------------|---------------|
| Service instances per subaccount                                   |          2500 |
| Service bindings and service keys in total per service instan- ces |          1000 |
## Limits for the Application Security Descriptor
There are limits that apply when you define properties in the application security descriptor.
You define properties in the xs-security.json application security descriptor file for creating or updating service instances. Take care that you don't define more properties than specified in the table.
Limits for Properties
| Property         |   Upper Limit |
|------------------|---------------|
| attributes       |            50 |
| role-collections |           250 |
| role-templates   |           500 |
| scopes           |           500 |
| Property                                                                                                                                           | Upper Limit   |
|----------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| scopes (granted)                                                                                                                                   | 250           |
|  Note Granted means that the scope object refers to appli- cations that are specified using granted-apps or grant-as-authority-to-apps properties |               |
## Limits for the Global Account
It is possible to configure up to 3 custom identity providers for platform users in a global account.
## Limits for the Subaccount
There are limits that apply to the subaccount. Administrators can use application roles and create their own roles. They can create and manage role collections, add roles to them, and assign the role collections to business users.
For more information, see Building Roles and Role Collections for Applications [page 2361] and Working with Role Collections [page 2351].
Limits for Security Artifacts
| Security Artifact                                                                                                  | Upper Limit                                                                             |
|--------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|
| Roles created by administrators                                                                                    | 2500                                                                                    |
|  Note Roles that are automatically generated when a service instance was created or updated are not counted here. |                                                                                         |
| Role collections created by administrators                                                                         | 5000                                                                                    |
| When establishing trust, subaccount administrators must observe the limits for identity                            | When establishing trust, subaccount administrators must observe the limits for identity |
| Limits for Identity Providers Identity Provider                                                                    | Upper Limit                                                                             |
| SAML identity providers                                                                                            | 50                                                                                      |
| User attribute mappings defined in a subaccount                                                                    | 5000                                                                                    |