SAP BTP Subaccounts and Spaces

SAP BTP uses a layered structure to organize resources, control access, and enforce environment separation. Subaccounts are the primary unit of isolation — configurations, users, and services in one subaccount cannot see or affect those in another. This isolation protects production environments from development changes and allows different teams to work independently without interfering with each other.

Think of subaccounts like separate apartments in the same building. They share the building's infrastructure (global account), but each apartment has its own walls, its own keylock, and its own rules. A visitor to apartment 3A cannot walk into apartment 5B. Subaccounts provide the same kind of separation for BTP resources.

Subaccount Characteristics

Each subaccount has its own:

URL – A unique address in the BTP cockpit and for services deployed within it
Region – Fixed when created; cannot be changed later without recreation
Service subscriptions – Each subaccount subscribes independently to the services it needs
Users and roles – User access is configured per subaccount; a user must be explicitly added to each subaccount they need to access
Cloud Connector tunnel – Each subaccount has its own Cloud Connector registration
Destinations – Connection configurations stored per subaccount

Recommended Subaccount Structure for Integration Projects

GLOBAL ACCOUNT: YourCompany BTP
│
├── Subaccount: INT-DEV
│   Purpose: Development and unit testing
│   Region: EU10
│   Integration Suite: CPI DEV tenant
│   Cloud Connector: Connected to SAP DEV system
│   Users: All integration developers
│
├── Subaccount: INT-QA
│   Purpose: Integration testing and UAT
│   Region: EU10
│   Integration Suite: CPI QA tenant
│   Cloud Connector: Connected to SAP QA system
│   Users: Integration developers + business testers
│
└── Subaccount: INT-PROD
    Purpose: Live production integration
    Region: EU10
    Integration Suite: CPI PROD tenant
    Cloud Connector: Connected to SAP PROD system
    Users: Restricted to operations team only

Subaccount Settings

Each subaccount in the BTP Cockpit has a Settings section where you configure:

Display Name and Description

Name the subaccount clearly — "Production - Integration Suite EU" is better than "subaccount-3". Descriptions remind future administrators why the subaccount exists and what it contains.

Subdomain

The subdomain becomes part of your service URLs. Choose it carefully because it cannot be changed after creation. Use a naming convention: your-company-int-prod for the production integration subaccount.

Custom Identity Provider

By default, users authenticate using SAP Universal ID. Connect a custom identity provider — Azure Active Directory, Okta, SAP Identity Authentication Service — so users log in with their corporate credentials. This is mandatory for production environments in enterprise organizations.

Cloud Foundry Environment

Some BTP services run in a Cloud Foundry (CF) environment inside a subaccount. When you enable Cloud Foundry for a subaccount, it provisions a CF organization. Inside the CF organization, you create Spaces.

SUBACCOUNT: INT-PROD
│
└── CLOUD FOUNDRY ORGANIZATION: int-prod-org
    │
    ├── SPACE: backend-services
    │     (Custom applications, microservices)
    │
    └── SPACE: data-services
          (Database bindings, data pipeline apps)

SAP Integration Suite itself does not require you to manage Cloud Foundry spaces — it runs as a managed service subscription. You interact with CF spaces mainly when deploying custom applications built on CAP or when using certain BTP services that require CF binding.

Destinations

Destinations store connection configurations for external systems. They are stored at the subaccount level and accessible by services running in that subaccount, including CPI iFlows.

DESTINATION EXAMPLE: SAP_S4HANA_PROD
  Type: HTTP
  URL:  https://my-s4-virtual:443
  Authentication: BasicAuthentication
  User: CPI_SERVICE_USER
  Password: (stored securely)
  Additional Properties:
    sap-client: 100
    WebIDEEnabled: true

CPI iFlows reference destinations by name rather than configuring connection details directly in each adapter. This means all iFlows in a subaccount share the same connection configuration. Changing the SAP system URL requires updating only the destination — all iFlows automatically use the new URL without redeployment.

Role Collections and User Management

BTP uses Role Collections to group permissions. You assign Role Collections to users rather than individual roles. Standard Role Collections for Integration Suite:

PI_Integration_Developer – Can create, edit, and deploy iFlows. Cannot manage security material.
PI_Administrator – Full administrative access including security material and tenant settings.
PI_Business_Expert – Read-only access to monitoring. For operations teams and business users who need visibility without editing rights.

Add users to subaccounts through BTP Cockpit → Subaccount → Security → Users → Add User. Assign Role Collections appropriate for their role. Never assign PI_Administrator to everyone — least-privilege access applies to BTP just as to any system.

Entitlements and Quotas

The global account has a defined amount of service capacity purchased from SAP. Entitlements distribute this capacity to subaccounts. Before you can subscribe to a service in a subaccount, the global account administrator must assign an entitlement for that service to the subaccount.

GLOBAL ACCOUNT has:
  SAP Integration Suite: 2 subscriptions available

Administrator assigns:
  1 subscription → Subaccount INT-DEV
  1 subscription → Subaccount INT-PROD

INT-QA has no entitlement → Cannot subscribe to Integration Suite
  (Administrator must either buy more or reallocate)

Managing entitlements is a global account administrator responsibility. Integration developers typically do not manage entitlements — but knowing this concept explains why services sometimes seem unavailable in a subaccount even when they work in another.

Subaccount vs Directory

Large organizations with many subaccounts use Directories to organize them. A directory is a folder-like grouping in the BTP Cockpit. Directories can have their own entitlements, which child subaccounts inherit. This simplifies management for organizations running dozens of BTP subaccounts across multiple teams and geographies.

GLOBAL ACCOUNT
├── Directory: EUROPE
│   ├── Subaccount: EU-INT-DEV
│   └── Subaccount: EU-INT-PROD
└── Directory: NORTH AMERICA
    ├── Subaccount: NA-INT-DEV
    └── Subaccount: NA-INT-PROD

Previous lesson

Back to course

Next lesson