Skip to main content

Unified architecture, Unified experience, Application IAM Leading

Last updated on by sapgunnar

This is the second stage of the SAP-managed integration model. The managed experience now spans multiple SAP applications as one coherent experience — a user engages a single Joule across SAP S/4HANA, SAP SuccessFactors, SAP Ariba and others, rather than a separate scoped experience per application as in Stage 1.

The decisive characteristic of this stage is that, although the experience is unified, the individual applications' IAM remains the leading authority for identities and authorizations. SAP Cloud Identity Services unifies authentication and the engagement layer and correlates users through the Global User ID, but it does not yet act as the system of record for identity data. The source of truth is still distributed across the participating applications.

Architecture​

Component View​

The architecture diagram shows the Stage 2 setup, where the managed experience now spans multiple SAP applications as one unified experience. SAP Cloud Identity Services (Identity Authentication, Identity Provisioning, Identity Directory and Authorization Management) unifies authentication and correlates users via the Global User ID, while identity data stays led by the individual applications. In addition to the identity components, the diagram introduces the agentic layer: the Agent gateway brokers SAP and Non-SAP Agents and Applications through Agent2Agent, Agent2App and App2Agent interactions, with inbound, outbound and runtime policy checks enforced along those flows.

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

Sequence​

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

Concept​

  • The experience is unified: one engagement layer by Joule WORK, one conversation, consistent single sign-on across applications.
  • Identity data and authorizations are still led by the applications: each application remains the authority for its own users and roles.
  • SAP Cloud Identity Services provides the connective tissue — authentication, federation, and cross-application correlation via the Global User ID established.

This stage builds directly on the consolidatable users of Stage 1: because the per-application users were already linked during the consolidation and got the Global User ID of the user profile (identity) which is written back into the connected applications. The user profile (identity) can now experience an unified Joule experience across the landscape. It is recommended to reach this stage to properly govern Agent Identities and Human Identities. It allows the assignment of agent-policies properly.

Agent Identity​

With the agentic layer introduced at this stage, AI agents become first-class actors that must be identified, authenticated, and governed just like human users. The Agent Identity reference architecture describes how SAP Cloud Identity Services stores agent identities alongside human identities in the Identity Directory, giving enterprises a unified governance model across both. In that architecture the SAP Agent Gateway acts as the policy enforcement layer — brokering Agent2Agent and Agent2App interactions and validating agent identity and authorization at every hop — which is exactly the agentic layer shown in the Stage 2 component view above.

Flow​

  1. Multiple SAP applications are integrated with SAP Cloud Identity Services for a unified experience (for example a unified Joule WORK).
  2. The user authenticates once through SAP Cloud Identity Services for Joule WORK and is correlated across applications via the Global User ID.
  3. The unified engagement layer orchestrates across applications; each application continues to resolve identity and authorization against its own IAM.
  4. Authorization decisions are enforced by each application using its domain-specific roles, scoped to what the correlated user is permitted to do in that application.
  5. The user can be assigned to agents and can consume them.

Characteristics​

  • Scope: multiple SAP applications, one unified experience.
  • Users: correlated across applications via the Global User ID.
  • Lead for identity data: the individual applications (distributed source of truth).
  • Role of SAP Cloud Identity Services: unified authentication; cross-application correlation.
  • Typical use: a unified Joule WORK experience spanning several SAP solutions while each application still owns its users.

Services and Components​