Risk
An inappropriate account type or external administrative identity makes access control harder.
ABAPBTP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | PRGN_CUST · REF_USER_CHECK | E Assign only Reference (L) users as reference users. |
| BTP Standard | Platform users and business users | Custom identity provider Centralizes control over identity sources. |
| BTP Critical | Administrators from default IdP with external email domains | No unauthorized assignments Also covers administrative Cloud Foundry organization and space roles. |
| BTP Standard | Viewers from default IdP with external email domains | Restrict unwanted access Includes Org Auditor and Space Auditor. |
| BTP Critical | Neo · platform P-users | Do not use Public accounts must not serve as platform administrators. |
| BTP Critical | Business users from default IdP | No C, D, I or P classes or external domains Controls the origin of business identities. |
How to verify
- Check account types and REF_USER_CHECK.
- Review identity sources separately for platform and business users.
- Assess roles in the global account, subaccounts and Cloud Foundry.
- Retain a controlled emergency account as defined in IDPROV.