The usability of the following properties has been enhanced:

• scim.user.unique.attribute
• ips.failed.request.retry.attempts
• ips.failed.request.retry.attempts.interval

To learn more, see: List of Properties

Bundle tenants can now use proxy systems to perform hybrid scenarios. See:

• Proxy Systems
• Access the Identity Provisioning UI (Bundles)
• Hybrid Scenario: SAP Identity Management

A new function, getMatchedRegexGroup, is now available. It checks whether a given string matches the provided regular expression (regex), and returns the required group.

To learn more, see: Transformation Functions → getMatchedRegexGroup

You can now use 'eq' read filters by a SCIM attribute to search for particular users. If your proxy system supports native read filtering, the Identity Provisioning service will translate the SCIM filter to the native system filter, and will consider it along with the relevant read filter property, if such is present.

This filtering is applicable to all proxy systems, except for the following ones:

• SAP Concur
• Google G Suite

To find your system, see: Proxy Systems

When you add a new Microsoft Active Directory system, the following properties are now added by default:

• ldap.attribute.user.id
• ldap.attribute.group.id
• ldap.attribute.dn

Also, the transformations are now enhanced with the use of the new getMatchedRegexGroup function. To learn more, see:

• List of Properties
• Microsoft AD (Source)
• Microsoft AD (Target)
• Microsoft AD (Proxy)

Relevant only for Identity Authentication and SAP Analytics Cloud target systems:

For systems created after 07 April 2020, the scim.user.unique.attribute property appears by default during system creation, and its value is set to userName. To learn more, see:

• List of Properties → scim.user.unique.attribute
• SAP Analytics Cloud (Target)
• SAP Cloud Platform Identity Authentication (Target)

You can use the following new properties to filter ABAP users and roles:

• abap.user.membership.filter – you can filter users by a regular expression (regex), based on their AS ABAP role memberships.
• abap.user.name.filter – you can filter user names by a regular expression (regex). This property replaces the obsolete abap.user.filter.
• abap.role.name.filter – you can filter roles by a regular expression (regex). This property replaces the obsolete abap.role.filter.

To learn more, see:

• List of Properties
• SAP Application Server ABAP (Source)
• SAP Application Server ABAP (Proxy)

You can now reset a source or a target system, which means deleting the current Identity Provisioning operating data for it. The system configurations and all existing read and provisioned entities, along with their authorizations, will be preserved.

To learn more, see: Reset an Identity Provisioning System

A new property defines whether the current roles of a user to be preserved or overwritten by the Identity Provisioning service within the proxy system in a hybrid scenario.

To learn more, see:

• List of Properties
• SAP S/4HANA Cloud (Proxy) → s4hana.cloud.user.roles.overwrite
• SAP Marketing Cloud (Proxy) → marketing.cloud.user.roles.overwrite
• SAP Cloud Platform ABAP Environment (Proxy) → a4c.user.roles.overwrite
• SAP Integrated Business Planning Cloud (Proxy) → ibp.user.roles.overwrite

A new property, aad.user.attributes.membership.active, retrieves information about the groups to which the users from a Microsoft Azure AD source or proxy system are assigned. There is also an update in the user mappings of the default transformations.

If you add a new Microsoft Azure AD system (source or proxy), the transformations will be up-to-date by default.

If you have a previously existing and customized system, and you do not want to create a new one, just add the following mapping to the user section:

{
    "sourcePath": "$.groups",
    "preserveArrayWithSingleElement": true,
    "optional": true,
    "targetPath": "$.groups"
},

To learn more, see:

• List of Properties → aad.user.attributes.membership.active
• Microsoft Azure Active Directory (Source)
• Microsoft Azure Active Directory (Proxy)

There is a change on the way a user can start operating with the Identity Provisioning admin console if they buy the service after September 1, 2020. Also, for such kind of tenants, the following systems are currently not available:

• SAP Cloud Platform Java/HTML5 Apps
• Local Identity Directory

However, if you have purchased your Identity Provisioning before September 1 but enable the service on your subaccounts after this date, these two system types will be available for you.

To learn more, see:

• Use a Standalone Tenant → section Purchases Made after September 1, 2020
• Access the Identity Provisioning UI (Standalone) → section Purchases Made after September 1, 2020
• Connecting to On-Premise Systems

A new source connector, SAP SuccessFactors LMS, is available for you. You can use it to read users from SAP SuccessFactors LMS and provision them to any target system, especially to Identity Authentication.

To learn more, see: SAP SuccessFactors LMS

A new API version (v.3) for SAP Cloud for Customer is now available. This is the default version used by the Identity Provisioning service. It corresponds to the relevant new target transformations, which allow to you provision both users and groups.

To learn more, see: SAP Cloud for Customer (Target)

If your Identity Provisioning Neo tenants reside in the Asia-Pacific region, precisely Shanghai (China), you should use the new dedicated domain: dispatcher.cn1.platform.sapcloud.cn

To learn more, see: Updating Host URLs for Shanghai Tenants

All SAP S/4HANA Cloud based target systems now support reading groups and their assignments through the "group" object in their transformations.

To learn more about that behavior, and how to preserve or overwrite existing group and user assignments, see: Extended Explanation of the *user.roles.overwrite Properties

SAP SuccessFactors source systems now have identical default transformations for both bundle and standalone Identity Provisioning solutions.

To learn more, see: SAP SuccessFactors

SAP SuccessFactors LMS source systems now support delta read mode.

To learn more, see: Manage Full and Delta Read

The Identity Provisioning admin console now supports SAP Work Zone, which you can use it as a source, target, and a proxy system. See:

• SAP Work Zone (Source)
• SAP Work Zone (Target)
• SAP Work Zone (Proxy)

The Local Identity Directory source systems now support delta read mode. That means, optimizing the amount of data retrieved from the source system reading not all entities but only such whose data have been changed since the last successful full read. To learn more, see:

• Manage Full and Delta Read
• Local Identity Directory

Effective October 20, 2020, Identity Provisioning can no longer be purchased as a standalone product! You can obtain and use it (for free) only as an integrated service in SAP cloud products, along with Identity Authentication. To check the list of the currently available products that offer Identity Provisioning, see: Obtain a Bundle Tenant

The Identity Provisioning admin console now supports SAP CPQ, which you can use as a source, target, or a proxy system. See:

• SAP CPQ (Source)
• SAP CPQ (Target)
• SAP CPQ (Proxy)