PUBLIC

2024-08-30

SAP BTP Configuration Guide

SAP Subscription Billing
© 2024 SAP SE or an SAP affiliate company. All rights reserved.

THE BEST RUN

Content

1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 Revision History. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

3 Set Up Using Booster Automation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

4 Set Up Using Manual Steps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

4.1 Technical Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Check Successful Completion of Provisioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Add Administrators to Global Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Create Subaccounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Assign Entitlements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Subscribe to SAP Subscription Billing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.2 Enable UI Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Define Subaccount Administrators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Grant Access to the SAP Subscription Billing UI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Enable Authentication and Single Sign-On for Business Users. . . . . . . . . . . . . . . . . . . . . . . . . . 26
Configure Your SAP Cloud Identity Services Tenant as Identity Provider or Proxy of Your
Subaccount. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Build Role Collections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Define Roles to Restrict Authorization by Market (Optional). . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Assign Role Collections to Users or User Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.3 Enable API Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Create a Service Instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Create a Service Binding with Client ID and Client Secret. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Create a Service Binding with Client Certificate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.4 Set Up SAP Event Broker for SAP Cloud Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Add SAP Event Broker to a Subaccount. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Subscribe to the SAP Event Broker Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Provide Authorization for the SAP Event Broker Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Register Your SAP S/4HANA Cloud System in Your Global Account. . . . . . . . . . . . . . . . . . . . . . .55
Create Formations to Define the Event Sharing Context. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Enable Event Subscriptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
4.5 Set Up SAP Event Mesh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Assign an Event Mesh Entitlement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Create an Event Mesh Instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Prepare Access to the SAP Event Mesh Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

SAP BTP Configuration Guide

2 PUBLIC Content
1 Introduction

This document guides you step-by-step process of onboarding SAP Subscription Billing including the Price
Calculation service.

Once you’ve received an email from SAP welcoming you to SAP Subscription Billing, you can start with the first
steps.

The technical setup includes the creation of a tenant. Only users with an Administrator role for the global account can
create tenants. At first, only the recipients of the welcome email have this role. If someone else needs to create a tenant,
one of the email recipients must add the relevant user as Administrator for the global account. This is described in the
section Add Administrators to Global Account [page 14].

See also the SAP Business Technology Platform (SAP BTP) documentation for an overview of all administration roles: Role
Collections and Roles in Global Accounts, Directories, and Subaccounts.

Cloud Availability

We recommend that you go to SAP for Me and add the e-mail addresses of employees of your company
whom we can contact with Cloud Availability notifications relating to SAP Subscription Billing. You do this
under Systems & Provisioning.

 Tip

Ideally, enter the e-mail addresses of your fellow employees who can work with us in critical situations
without delay. For more information, see Get Notified .

SAP BTP Environment

SAP Subscription Billing runs on the Cloud Foundry environment. For more information, see Cloud Foundry
Environment in the SAP BTP documentation.

Booster

Decide whether you want to use an automation wizard called “booster” for the onboarding of an SAP
Subscription Billing tenant, or if you want to follow a manual step-by-step guide.

 Note

The booster has some settings that need to be configured carefully, for example regarding subaccounts.
Please read the information on the booster carefully.

SAP BTP Configuration Guide

Introduction PUBLIC 3
For the next steps, see:

• Set Up Using Booster Automation [page 6]

• Set Up Using Manual Steps [page 12]

 Caution

We strongly recommend that you do not unsubscribe from the Price Calculation service once you're
actively using configured prices. Unsubscribing results in the deletion of all pricing data 1 day later which
would result in inconsistencies within SAP Subscription Billing.

SAP BTP Configuration Guide

4 PUBLIC Introduction
2 Revision History

Overview of changes to the guide in the last 12 months.

Date of Up-
date Change

2024-08-19 Information about onboarding the Price Calculation service is now included in this guide and the separate
guide SAP BTP Configuration Guide for Price Calculation is obsolete.

2024-07-24 Section Enable API Access [page 35] updated : We now recommend that service instances are created
in the runtime environment Other rather than Cloud Foundry. This reduces the number of steps, since a
space is no longer required and users no longer have to be added to a space as members. Furthermore, it
minimizes the consumed platform resources.

Section Create an Event Mesh Instance [page 63] updated since instances are no longer created in a
space when the runtime environment is Other.

2023-12-18 Section Set Up SAP Event Broker for SAP Cloud Applications [page 52] added. Either SAP Event Broker or
SAP Event Mesh can now be used to distribute events in standard integrations between SAP Subscription
Billing and SAP S/4HANA Cloud Public Edition.

2023-11-13 Section Enable API Access [page 35] enhanced with the option of creating a service key with a client
certificate.

2023-09-05 Cloud Availability notification information added in section Revision History [page 5].

 Note

Note that screenshots used in this document were taken using one of the standard SAP visual themes.
They may not look the same for you depending on your user settings.

SAP BTP Configuration Guide

Revision History PUBLIC 5
3 Set Up Using Booster Automation

A booster is a set of guided interactive steps that enable you to select, configure, and consume services on SAP
BTP to achieve a specific technical goal. Boosters automate processes that otherwise require a high number
of manual steps, such as onboarding applications like SAP Subscription Billing. The booster helps you onboard
an SAP Subscription Billing tenant in a new or existing subaccount, including services such as Event Mesh
and Price Calculation depending on the selected configuration. If you use a booster for the onboarding of SAP
Subscription Billing, most of the steps mentioned under Set Up Using Manual Steps [page 12] are performed
automatically.

The Onboard SAP Subscription Billing [page 7] booster is available for SAP Subscription Billing with and
without SAP S/4HANA Cloud integration.

 Recommendation

We recommend using the booster for non-productive tenants.

If you choose to use the booster for a productive tenant, please note the following:

• All users added with Administrator or Developer roles get full authorization for administrative
and development tasks as well as full access to the SAP Subscription Billing user interface. If
this contradicts your compliance rules for productive tenants, add users manually or remove
authorizations prior to productive use of the tenant.
• The boosters don’t support custom identity providers. The default identity provider SAP ID Service is
not recommended for productive use of SAP Subscription Billing. You can manually adapt the identity
provider settings.
• The boosters create an API client for accessing SAP Subscription Billing APIs with all API scopes. You
can manually configure API access with only selected scopes depending on your business needs.

 Caution

During the booster configuration, you must decide whether you want to create a new subaccount or select
an existing subaccount to which you want to add SAP Subscription Billing. If you make the wrong selection
for your use case, you may run into issues further in the onboarding process. For more details on which
configuration to select, see step 6 in the section Onboard SAP Subscription Billing [page 7].

After the configuration is completed and the booster is started, the booster assigns entitlements, subscribes
chosen applications, and creates the relevant service instances and the associated service keys automatically.

When the booster has finished all the processing steps, you can access the user interfaces of SAP Subscription
Billing and applications such as Event Mesh and Price Calculation, depending on your chosen configuration. In
addition, you can use the created service key to get OAuth access tokens for the created service instances.

 Note

To run the booster on an existing subaccount, make sure you have the Subaccount Administrator role
(part of the Subaccount Administrator role collection).

SAP BTP Configuration Guide

6 PUBLIC Set Up Using Booster Automation
3.1 Onboard SAP Subscription Billing

To start the onboarding of SAP Subscription Billing, follow these step-by-step instructions.

 Tip

Throughout the booster configuration, choose Next to get to the next selection screens or Previous to
adjust settings you made in the previous screens.

Step Task

1. Logon to the SAP BTP Cockpit using either of these URLs depending on your region:

• EMEA: https://emea.cockpit.btp.cloud.sap
• Americas: https://amer.cockpit.btp.cloud.sap
• Asia-Pacific, Oceania: https://apac.cockpit.btp.cloud.sap
• EU Access: https://eu-access.cockpit.btp.cloud.sap
• A logon URL in the region closest to you (to avoid latency). See Regions and Regions and API Endpoints
Available for the Cloud Foundry Environment in the SAP BTP documentation.

2. Open the global account that was used to order SAP Subscription Billing.

 Tip
To find the right global account, you can use the System & Provisioning dashboard in SAP for Me (log on
with your S-user ID). In the dashboard, you can find the global account ID under System Name & Number.

In this guide, we use “SubscriptionBilling Consulting” as the example account.

3. Choose Boosters in the navigation panel.

 Note
If you don’t see this entry in the navigation panel, you need to have the Global Account Administrator role
assigned to your user.

SAP BTP Configuration Guide

Set Up Using Booster Automation PUBLIC 7
Step Task

4. Select the tile Onboard SAP Subscription Billing from the Boosters overview page and choose Start.

The overview page displays:

• Information about the booster

• Components that are available for the booster
• Available additional resources

5. Choose Start to begin the booster process.

The booster checks the necessary prerequisites including required authorizations and entitlements.

If the prerequisites are met, choose Next.

6. Decide whether you want to create a new subaccount for SAP Subscription Billing or add it to an existing
subaccount.

 Caution
This decision has implications for the onboarding of further applications such as Event Mesh (optional).
Some applications MUST be subscribed in the same subaccount as SAP Subscription Billing.

Once you have decided, select either Create Subaccount or Select Subaccount and choose Next. Continue with
step 6a. or 6b.

SAP BTP Configuration Guide

8 PUBLIC Set Up Using Booster Automation
Step Task

6a. Create Subaccount

To create a new subaccount, enter the required information and choose Next add users. The booster prefills the
fields with suggestions you can partially change:

• Entitlements: Depending on your use case, you can delete optional entitlements of applications that you
don’t want to subscribe.
• Subaccount Name: You can change the generated name to something more relevant to your use case.
• Region: Change the region if the prefilled region is not suitable.
• Subdomain: This will be the name of your SAP Subscription Billing tenant.

You can deselect optional applications in this step by choosing the Delete action.

SAP BTP Configuration Guide

Set Up Using Booster Automation PUBLIC 9
Step Task

6b. Select Subaccount

To choose an existing subaccount for this booster, select the relevant subaccount from the list under
Subaccount.

Entitlements: Depending on your use case, you can delete optional entitlements of applications that you don’t
want to subscribe.

You can deselect optional applications in this step under Action.

7. Add additional users as Administrators or Developers. The booster will assign the relevant roles automatically.
The user who is configuring the booster is added as administrator and developer automatically.

8. Review the configuration settings you made, especially regarding the subaccount mode. When you are happy
with your choices, choose Finish.

The booster will make the settings according to your configuration.

SAP BTP Configuration Guide

10 PUBLIC Set Up Using Booster Automation
Step Task

9. When the booster configuration is complete, some settings still have to be made manually, depending on your
configuration needs:

• As the booster can only create user interface access for Administrators and Developers, business users
have to be added manually. See Enable Authentication and Single Sign-On for Business Users [page 26].
• Define Subaccount Administrators [page 25]
• Configure Your SAP Cloud Identity Services Tenant as Identity Provider or Proxy of Your Subaccount [page
28]
• Build Role Collections [page 28]
• Define Roles to Restrict Authorization by Market (Optional) [page 30]
• Assign Role Collections to Users or User Groups [page 33]
• To enable the integration of SAP Subscription Billing apps with the SAP Fiori launchpad of SAP S/4HANA
Cloud, follow the procedure described under Integration with the SAP Fiori Launchpad of SAP S/4HANA
Cloud in the Setup and Administration Guide.

 Note
API scopes for recently deployed features may not be up to date when you run the booster for the initial
onboarding. Missing API scopes need to be added manually. For more information, see Create a Service
Instance [page 36].

SAP BTP Configuration Guide

Set Up Using Booster Automation PUBLIC 11
4 Set Up Using Manual Steps

The manual steps that you need to perform to set up SAP Subscription Billing depend on whether you did the
initial setup using a Booster.

4.1 Technical Setup

4.1.1 Check Successful Completion of Provisioning

Log on to the SAP BTP cockpit to check that SAP Subscription Billing is available for your account.

Step Task

1. Log on to the SAP BTP Cockpit using either of these URLs depending on your region:

• EMEA: https://emea.cockpit.btp.cloud.sap
• Americas: https://amer.cockpit.btp.cloud.sap
• Asia-Pacific, Oceania: https://apac.cockpit.btp.cloud.sap
• EU Access: https://eu-access.cockpit.btp.cloud.sap
• A logon URL in the region closest to you (to avoid latency). See Regions and Regions and API Endpoints
Available for the Cloud Foundry Environment in the SAP BTP documentation.

2. Open the global account that was used to order SAP Subscription Billing.

 Tip
To find the right global account, you can use the System & Provisioning dashboard in SAP for Me (log on
with your S-user ID). In the dashboard, you can find the global account ID under System Name & Number.

In this guide, we use “SubscriptionBilling Consulting” as the example account.

SAP BTP Configuration Guide

12 PUBLIC Set Up Using Manual Steps
 Step Task

3. Choose Entitlements Service Assignments in the navigation panel.

 Note
If you don’t see this entry in the navigation panel, you need to have the Global Account Administrator role
assigned to your user.

4. In the service overview, search for "SAP Subscription Billing". The service with the technical name revenue-
cloud is for the application user interface. The other service is for the use of APIs.

Now search for "Price Calculation". The service with the technical name price-management
is for the application user interface. The other service is for the use of APIs.

 Note
If the service isn’t displayed, please report this to your local SAP contact.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 13
4.1.2 Add Administrators to Global Account

To enable further users to create a tenant, one of the recipients of the welcome email must add the relevant
user as a global account administrator. You add administrators by assigning them a predefined role collection.

For more information on the default role collections for administrators, see Role Collections and Roles in Global
Accounts, Directories and Subaccounts in the SAP BTP documentation.

Step Task

1. In your global account, choose Security Users in the navigation panel.

2. Select Create to add the user who you want to make administrator.

3. 1. Enter the user name and email address of the user.

2. The identity provider must be Default identity provider.
3. Select Create.

4. Optional: If the user isn’t part of the identity provider, you’re asked to add the user. Complete this action.

5. In the overview of users, open the new user. Then, under Role Collections, select Assign Role Collection.

SAP BTP Configuration Guide

14 PUBLIC Set Up Using Manual Steps
 Step Task

6. Assign the role collection Global Account Administrator.

7. The user has now administrative access to the global account.

4.1.3 Create Subaccounts

Subaccounts on SAP BTP are required for deploying applications and using services. When you create a
subaccount and subscribe to SAP Subscription Billing and Price Calculation, tenants are created.

You need one subaccount for each tenant to which you are entitled. A tenant for SAP Subscription Billing and a
corresponding tenant for Price Calculation must be created in the same subaccount. Repeat the steps below to
create each subaccount.

Step Task

1. In the navigation panel of your global account, choose Account Explorer.

2. Select Create Subaccount .

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 15
Step Task

3. Define the subaccount:

1. Specify a display name and short description.

2. In the Region list, scroll to the provider “Amazon Web Services (AWS)” and select your region:
1. Europe (cf-eu10)
2. Europe EU Access (cf-eu11) (Restricted to EU only contracts.)
3. US East (cf-us10)
3. Enter a name for your subdomain.

 Caution
The subdomain is the tenant name used for login. Once defined, you can’t change it later.

The subdomain also becomes part of the application URL for SAP Subscription Billing according to this
pattern: <subdomain>.<region>.revenue.cloud.sap

The subdomain can contain only letters, digits and hyphens. Hyphens aren’t allowed in the beginning or
at the end. The subdomain must be unique across all accounts in the same region of the Cloud Foundry
environment of SAP BTP.

You can use upper case and lower case letters; however, they can’t be used to differentiate subdomains
(“SUBDOMAIN” and “subdomain” are considered the same).

4. For productive subaccounts, don’t select Enable beta features.

5. Select Create.

SAP BTP Configuration Guide

16 PUBLIC Set Up Using Manual Steps
 Step Task

4. You see a tile for your subaccount on the Subaccounts tab. Wait for the onboarding process to finish before ac-
cessing the subaccount.

 Note
You are automatically assigned to the subaccount as administrator. To learn how to add other users as
subaccount administrators, see Define Subaccount Administrators [page 25].

4.1.4 Assign Entitlements

You need to assign entitlements if you want to use SAP Subscription Billing including Price Calculation and
their APIs.

Your SAP BTP global account has entitlements to use resources, such as services and memory. Distribute
quotas of these entitlements to your individual subaccounts (tenants) to define the maximum consumption for
each subaccount.

 Note

The total entitlements that you have available to distribute are:

• For SAP Subscription Billing: 10 entitlements across a maximum of 10 tenants

• For Price Calculation: 10 entitlements across a maximum of 10 tenants

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 17
Step Task

1. In your subaccount, choose Entitlements in the navigation panel.

You see the table of subaccount assignments and service plans.

2. Select Edit.

3. To open the list of resources that you’re entitled to use, choose Add Service Plans.

SAP BTP Configuration Guide

18 PUBLIC Set Up Using Manual Steps
 Step Task

4. Search for "SAP Subscription Billing".

You see a service for the application and a service for the API.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 19
Step Task

5. Select the service SAP Subscription Billing (for the application), and select the service plan default
(Application).

Next, select the service SAP Subscription Billing API (for API calls), and select the service plan default.

SAP BTP Configuration Guide

20 PUBLIC Set Up Using Manual Steps
 Step Task

6. Search for "Price Calculation", select it, then select the service plan default (Application).

Optionally, select the service plan standard if you need to get access to the Price Calculation APIs.

Then choose Add Service Plans to add all the service plans that you previously selected.

7. Save the entitlements.

Note that 1 quota unit is assigned to the plan for the SAP Subscription Billing API service.

8. Optional:

If you want to develop your own applications or process extensions on SAP BTP Cloud Foundry, repeat these
steps for the entitlement Cloud Foundry Runtime with the service plan “MEMORY”.

You can adjust quotas for only one subaccount at a time. To adjust quotas for multiple subaccounts, complete
these steps for each subaccount.

If you have distributed the maximum of your purchased quotas, you can’t increase it further. However, you can
move quotas between subaccounts in the same global account.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 21
4.1.5 Subscribe to SAP Subscription Billing

To use SAP Subscription Billing, you must subscribe to the corresponding application, and also to the Price
Calculation application, in the same subaccount.

Step Task

1. Go to your subaccount and choose Services Service Marketplace in the navigation panel.

2. You see all the services that are available to you. Search for the service "SAP Subscription Billing" and select it.

3. Under Application Plans, display the action menu of the plan for which you want to create a subscription and
choose Create.

4. Check the basic info and then choose Create.

SAP BTP Configuration Guide

22 PUBLIC Set Up Using Manual Steps
 Step Task

5. The creation process starts. Choose View Subscription to switch to the Instances and Subscriptions screen.

6. You’re subscribed to the SAP Subscription Billing application.

With this step, your SAP Subscription Billing tenant is created.

 Tip
The tenant ID is the SAP BTP subaccount ID, the tenant name is the SAP BTP subaccount name (subdo-
main).

7. Now subscribe to the Price Calculation service.

Choose Services Service Marketplace in the navigation panel.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 23
Step Task

8. You see all the services that are available to you. Search for the application Price Calculation and select it.

9. Under Application Plans, display the action menu of the plan

for which you want to create a subscription and choose Create.

10. Check the basic info and then choose Create.

11. The creation process starts. Choose View Subscription to switch to the Instances and Subscriptions screen.

SAP BTP Configuration Guide

24 PUBLIC Set Up Using Manual Steps
 Step Task

12. You’re subscribed to the Price Calculation application.

With this step, your Price Calculation tenant is created.

 Tip
The tenant ID is the SAP BTP subaccount ID, the tenant name is the SAP BTP subaccount name (subdo-
main). Therefore, the SAP Subscription Billing and Price Calculation tenants have the same tenant ID and
name.

 Caution

We strongly recommend that you do not unsubscribe from the Price Calculation service once you're
actively using configured prices. Unsubscribing results in the deletion of all pricing data 1 day later which
would result in inconsistencies within SAP Subscription Billing.

4.2 Enable UI Access

This chapter describes how to configure authentication and authorization for the users of your application.
Thus, you can enable them to log on to the SAP Subscription Billing user interface and get access to the
appropriate apps and data.

4.2.1 Define Subaccount Administrators

To configure authentication and authorization for business users, you need a SAP BTP user with the role
User and Role Administrator which is part of the Subaccount Administrator role collection. When you create a
subaccount, SAP BTP automatically grants this role to your user.

If you want to enable other users to configure authentication and authorization, you can assign the role by
adding the users to your subaccount and assigning the role collection Subaccount Administrator or another
role collection with the User and Role Administrator role. Role collections are assigned to users as described in
the section Assign Role Collections to Users or User Groups [page 33].

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 25
4.2.2 Grant Access to the SAP Subscription Billing UI

To give yourself access to the SAP Subscription Billing UI, you need to do the following:

1. Build at least one role collection, as described in the section Build Role Collections [page 28].

 Recommendation

For the initial setup phase, we recommend the role ui_applications_all, which provides you with
the complete set of authorizations and allows you to test all apps.

2. Assign at least one role collection to your user, as described in the section Assign Role Collections to Users
or User Groups [page 33].
3. Log on to the SAP Subscription Billing application.
4. To enable UI access for further users, repeat steps 1 and 2 for these users to assign the appropriate role.

You find more information on authentication and single sign-on of business users in the sections Enable
Authentication and Single Sign-On for Business Users [page 26].

4.2.3 Enable Authentication and Single Sign-On for Business

Users

Overview

SAP Subscription Billing relies on the user management features of SAP Business Technology Platform (SAP
BTP). For the business user access to SAP Subscription Billing, you maintain the users in the SAP BTP
subaccount where SAP Subscription Billing is subscribed.

Users are stored in identity providers. For each user that you want to enable to log on to SAP Subscription
Billing, a copy user called shadow user is created in the subscribed SAP BTP subaccount. The authentication
of business users to access the SAP Subscription Billing user interface is delegated to the original identity
provider, and users can log on with the mechanisms and credentials defined there, for example, with their email
address and password. The authorizations of the users are defined with the assignment of role collections to
the shadow user in the SAP BTP cockpit. See Working with Users in the SAP BTP documentation.

For more background information, see SAP Authorization and Trust Management Service.

Note: This documentation mainly concentrates on the role of the SAP BTP business user. For information
about platform users, see Platform Users in the SAP BTP documentation.

Identity Providers for User Authentication

You enable authentication and single sign-on for business users by establishing a trust relationship between
your SAP BTP accounts and your identity provider.

SAP BTP Configuration Guide

26 PUBLIC Set Up Using Manual Steps
For more information, see Trust and Federation with Identity Providers and Setting Up Authentication in the
SAP BTP documentation.

 Recommendation

We recommend that you always use SAP Cloud Identity Services - Identity Authentication as single identity
provider for SAP BTP. If you use corporate identity providers, connect them to your Identity Authentication
tenant, which then acts as a proxy.

For SAP ID service, trust is preconfigured on SAP BTP by default, however we don’t recommend that you
use SAP ID service for your business users for productive scenarios of SAP Subscription Billing.

The SAP-administered SAP ID service doesn't support administrative access and has the following
restrictions:

• User registration works through self-service: You can’t provision users to SAP ID service, you can’t lock
users (for example, if their responsibility within the company changes or if they leave the company).
• You can’t create user groups to simplify the assignment of role collections.
• You can’t configure single sign-on to work with other applications controlled by your own identity
provider. In other words, you can’t configure identity provider proxying with the SAP ID service.

Based on this recommendation, a typical setup could look like this:

• The initial users for setting up and configuring SAP Subscription Billing are provided by the SAP ID
service including preconfigured trust. Further business users with an account in SAP ID service (https://
accounts.sap.com/ ) can be authorized for the initial configuration.
• The initial users configure trust to a SAP Cloud Identity Services – Identity Authentication tenant. A
separate tenant is used for the subaccount where you run SAP Subscription Billing productively.
• If you use corporate identity providers, connect them to your Identity Authentication tenant. This way,
these identity providers remain the origin of the identity information and your business users can log in to
SAP Subscription Billing with their respective credentials or with single sign-on.

Managing Users in the SAP BTP Subaccount

There are different options to create shadow users in your SAP BTP subaccount:

• SAP BTP automatically creates the user in the global account or in the subaccount when a user-related
action happens. This automatic creation of shadow users is switched off by default for the default identity
provider. See Switch Off Automatic Creation of Shadow Users in the SAP BTP documentation.
• You can manually create users on the user interface in the SAP BTP cockpit. See Create Users in the SAP
BTP documentation.
• You can use SAP Cloud Identity Services – Identity Provisioning to maintain users.

 Tip

For more information on user creation in integration scenarios with S/4HANA Cloud, see Integration
with the SAP Fiori Launchpad of SAP S/4HANA Cloud in the section Creation of Business Users.

For information on user deletion from SAP BTP, see Delete Users in the SAP BTP documentation.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 27
4.2.4 Configure Your SAP Cloud Identity Services Tenant as
Identity Provider or Proxy of Your Subaccount

If you use the Identity Authentication service in SAP BTP, you can find more information in the SAP BTP
documentation under Establish Trust and Federation Between SAP Authorization and Trust Management
Service and SAP Cloud Identity Services.

4.2.5 Build Role Collections

You need to define role collections to control user authorization for the SAP Subscription Billing apps and data,
including Price Calculation.

Step Task

1. In your global account, open the subaccount. In the navigation panel, choose Security Role Collections .

2. To create a new role collection, choose Create.

3. Name your role collection and choose Create. In this guide, we use “My Role Collection” as the example name.

4. Select the role collection that you just created.

5. In the detail view of the role collection, choose Edit to open the screen in edit mode.

6. Under Roles Role Name , choose the icon of the input field to open the role selector.

SAP BTP Configuration Guide

28 PUBLIC Set Up Using Manual Steps
 Step Task

7. In the field Application Identifier, choose the identifier that begins with “revenue-cloud” to filter the available
roles for SAP Subscription Billing.

8. In the Roles table, you can further filter by roles and templates to reduce the number of rows. Then select the
roles that you want in your collection.

 Note
You can find information about the available role templates under Build Role Collections in the Setup and
Administration Guide:

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 29
Step Task

9. Once you have selected all the roles for the collection, confirm the selection by choosing Add.

The screenshot shows the role “ui_applications_all”, which provides the complete set of authorizations, as an
example.

For productive use, we recommend that you configure suitable roles for your users.

10. Repeat steps 7.- 9. to add roles for the Price Calculation apps.

In the field Application Identifier, choose the identifier that begins with “price-management”.

 Note
You can find information about the available role templates under Build Role Collections in the Setup and
Administration Guide.

11. Choose Save to close the edit mode.

12. Now your role collection shows the assigned roles. Repeat these steps if you want to add further roles to the
collection.

 Note
Optionally, you can create role collections to restrict a specific market for a user, as described in Define
Roles to Restrict Authorization by Market (Optional) [page 30].

4.2.6 Define Roles to Restrict Authorization by Market

(Optional)

You can restrict user access to data that is associated with certain markets. For example, a user can be allowed
to only display billing data for subscriptions or to view or edit the data of a lookup table in a particular market.

You restrict the markets for which users have authorization by assigning them a role collection that contains at
least one role based on the role template “ui_market_restriction”. The role for market authorization restriction
doesn’t determine whether the user has permission to view or manage data for an object type. Therefore,
in the relevant role collections you need to combine the market restriction role with the functional roles (view/
manage) for object types.

Users without a role that restricts market authorization have access to data for all markets.

SAP BTP Configuration Guide

30 PUBLIC Set Up Using Manual Steps
To understand which data is visible to users who are authorized only for certain markets, see Build Role
Collections in the Setup and Administration Guide.

To understand which data is visible to users who are authorized only for certain markets, see the Setup and
Administration Guide:

• Build Role Collections: SAP Subscription Billing

• Build Role Collections: Price Calculation

Step Task

1.
In the navigation panel, choose Security Roles .

2. Enter “market” in the search field to find the role that restricts authorization for markets.

3. In the row that contains the role template “ui_market_restriction”, choose Create Role to create a role based on
the current role template.

4. Follow the guided steps to create a new role with one or several market values.

Enter a name and description for the role. Make sure that you clearly identify the markets for which the role
restrict s authorization.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 31
Step Task

5.
Under Configure Attributes Values , enter the IDs of the markets for which the role grants authorization
(press Enter after entering an ID). Leave the source set as Static.

 Note
Make sure that you enter the market IDs exactly as they are defined in Business Configuration.

6. We recommend that you use separate role collections for market restrictions, rather than using collections that
combine market and functional roles (view/manage).

By keeping the role types separate, you have more transparency.

You can skip this step and create a new role collection for market authorization afterwards.

7. Review the role data and finish the creation process.

8. Repeat the steps above for the role template “ui_market_restriction” belonging to the price-management
application.

To create a new role collection for market authorization and assign the roles for markets, follow the steps in the
section Build Role Collections [page 28].

SAP BTP Configuration Guide

32 PUBLIC Set Up Using Manual Steps
4.2.7 Assign Role Collections to Users or User Groups

To provide users with authorization, you assign them to role collections in either of the following ways. Both
approaches result in the same outcome, so choose whichever is more convenient:

• Add New or Existing Users to Role Collections [page 33]

• Create Users and Assign them with Role Collections [page 34]

Add New or Existing Users to Role Collections

Step Task

1. In your global account, open the subaccount. In the navigation panel, choose Security Role Collections .

2. Create or search for and open a role collection, then choose Edit.

3. Under Users, enter the ID of the user and choose the identity provider. If the user only exists in a connected
identity provider, choose the identity provider and type in the e-mail address. Then choose + (Add User).

The user is created and added.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 33
Step Task

4. Repeat the previous steps to add further users to the role collection.

5. Choose Save.

Create Users and Assign them with Role Collections

The following description shows how to assign collections to individual users with the example identity provider
that we set up in the section Configure Your SAP Cloud Identity Services Tenant as Identity Provider or Proxy of
Your Subaccount [page 28] in this guide.

Step Task

1.
In your subaccount, navigate to Security Users .

SAP BTP Configuration Guide

34 PUBLIC Set Up Using Manual Steps
 Step Task

2. To create a new user, choose Create and enter the required data. Alternatively, select an existing user from the
list in the overview.

3. Choose the user to open the details page. In the details under Role Collections, choose Assign Role Collection.

4. Search for the role collection you want to assign, select the role collection, and choose Assign Role Collection.

5. Now the user has at least one role collection assigned.

4.3 Enable API Access

API access to SAP Subscription Billing is based on the OAuth 2.0 specification, implemented by the SAP
Authorization and Trust Management service in the Cloud Foundry Environment on SAP Business Technology
Platform (SAP BTP). For API access to SAP Subscription Billing and, optionally, Price Calculation, you create
service instances that represent the OAuth client. By providing relevant scopes via a JSON parameter, you
define which functions and data the OAuth client can retrieve. For more information, see SAP Authorization and
Trust Management Service in the SAP BTP documentation.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 35
For the service instances, you create service bindings, which contain the relevant information for retrieving
access tokens for the API access. There are two different ways in which a client can authenticate against the
token server to retrieve the access token:

• Using client ID and client secret from the service binding

• Using a client certificate from the service binding
This option is supported by the SAP Subscription Billing API service only, not by the Price Calculation
service.

If you use a client certificate you provide an “external” certificate when creating the service binding. In case of
an integration with SAP S/4HANA Cloud, we recommended you use the Client Default certificate provided to
the respective tenant. In other cases you bring your own external X.509 certificate.

When using X.509 client certificates from the service binding, access tokens are retrieved with Mutual
Transport Layer Security (mTLS). This is considered more secure than a combination of client ID and client
secret. Unlike retrieving the access token with client ID and client secret, no secret is shared between calling
application and the service instance of the SAP Authorization and Trust Management service. See Retrieving
Access Tokens with Mutual Transport Layer Security (mTLS) in the SAP BTP documentation.

The sections Create a Service Binding with Client ID and Client Secret [page 42] and Create a Service Binding
with Client Certificate [page 44] describe the setup and the two different options for the service bindings.

 Note

To view the service credentials, users require the role Subaccount Service Auditor (part of the default role
collection Subaccount Viewer).

4.3.1 Create a Service Instance

When you create a service instance, you provide a set of scopes that define which of the APIs can be called and
which activities can be done using service bindings created for the instance.

To enable integration and use of SAP Subscription Billing APIs, you must create an instance of the SAP
Subscription Billing API service. Optionally, if you want to use the Price Calculation APIs, you can create an
instance of the Price Calculation service.

To create an instance, you require the Subaccount Service Administrator role. When you create a subaccount,
SAP BTP automatically grants this role to your user.

SAP BTP Configuration Guide

36 PUBLIC Set Up Using Manual Steps
 Step Task

1. In your subaccount, choose Services Service Marketplace in the navigation panel.

2. You see all the services that are available to you. Search for and select the service SAP Subscription Billing API.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 37
Step Task

3. Under Service Plans, display the action menu of the plan for which you want to create an instance and choose
Create.

In this guide, we use the default plan for the example.

4. Check that the runtime environment Other is selected, enter a name for the instance and choose Next.

In this example, we used “INSTANCEDEMO” as the instance name:

SAP BTP Configuration Guide

38 PUBLIC Set Up Using Manual Steps
 Step Task

5. To define the relevant scopes, specify a JSON file or specify parameters in JSON format.

For an up-to-date list of scopes with their descriptions, see SAP Subscription Billing API Scopes in the API Guide.

The example JSON file contains all the available API scopes. Adjust the file to restrict access according to your
requirements. For testing purposes, you may want to start with a complete set up scopes for restricted users.

6. After providing the instance parameters, choose Next.

7. Check that everything is correct and choose Create.

8. The creation process starts. Choose View Instance to view the service instance on the Instances and
Subscriptions page.

9. Your instance is created.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 39
Step Task

10. Repeat the steps above if you want to create an instance for the Price Calculation service.

• In step 4. make sure the standard plan is selected to create an instance. In this example, we used “DE-
MOPCS” as the instance name:

• In step 5. you don't need to define the relevant scopes by specifying a JSON file or parameters in JSON
format. Instances of the Price Calculation service automatically have all API scopes included.

SAP BTP Configuration Guide

40 PUBLIC Set Up Using Manual Steps
 Step Task

You can create multiple instances to provide different sets of scopes to different users. If you want to consume
new APIs or new functionality of SAP Subscription Billing that require further scopes, you can also update an
existing service instance and upload a new JSON file.

 Note

If you create an additional service instance in the same subaccount, you must use a different value for
the attribute xsappname in the JSON file that contains the scopes. The xsappname value must be unique
within the subaccount.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 41
4.3.2 Create a Service Binding with Client ID and Client
Secret

To work with APIs, technical users need a service binding containing the relevant information to get an access
token. One way of authenticating against the token server to retrieve the access token is by using the client
ID and client secret from the service binding. The following steps explain how to create this type of service
binding.

Service bindings enable access to APIs with the set of scopes defined in the service instance. If you need API
access with different sets of scopes, please create separate instances for it.

 Note

"Service binding" and "service key" are used synonymously in SAP BTP.

Step Task

1. On the Instances and Subscriptions screen, under Instances, display the action menu of the instance and choose
Create Service Binding.

SAP BTP Configuration Guide

42 PUBLIC Set Up Using Manual Steps
 Step Task

2. In the New Binding view, follow these steps:

1. Enter a name under Binding Name.

2. Under Service Binding/Key Type, keep the selection Client ID/Secret.
3. Choose Create.

3. To see the newly created service binding, display its action menu and choose View.

 Note
To view the service credentials, users require the role Subaccount Service Auditor (part of the default role
collection Subaccount Viewer).

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 43
Step Task

4. The details of the service binding are displayed.

The service binding contains the information needed to generate an access token to access the APIs.

For information on generating a token, see Generate an Access Token in the API Guide.

If you need more details, including explanations of the SAP BTP concepts, refer to the documentation Getting
Started with an Enterprise Account in the Cloud Foundry Environment, where you can use the interactive
graphics to navigate to more information.

4.3.3 Create a Service Binding with Client Certificate

 Note

This method is not available for the Price Calculation service.

To work with APIs, technical users need a service binding containing the relevant information to get an access
token. One way of authenticating against the token server to retrieve the access token is by using an X.509
client certificate from the service binding. The following steps explain how to create this type of service
binding.

The alternative way of authenticating is to retrieve the access token is by using a client certificate from the
service binding (see Create a Service Binding with Client ID and Client Secret [page 42]).

Service bindings enable access to APIs with the set of scopes defined in the service instance. If you need API
access with different sets of scopes, please create separate instances for it.

 Note

"Service binding" and "service key" are used synonymously in SAP BTP.

SAP BTP Configuration Guide

44 PUBLIC Set Up Using Manual Steps
 Step Task

To create a service binding, you need to bring an X.509 client certificate.

For API access from SAP S/4HANA Cloud (communication scenario SAP_COM_0642), we recommend using the Client
Default certificate from the SAP S/4HANA Cloud tenant. For any other integration you bring your own external certificate.

The following steps 1-4 describe how the Client Default certificate can be exported from SAP S/4HANA Cloud.

1. Log on to your SAP S/4HANA Cloud system with the Administrator role.

2. Go to the Maintain Client Certificates app.

3. In the Actions column, download the Client Default certificate to your local machine by selecting Export
Certificate.

This certificate is provided by SAP for SAP S/4HANA Cloud tenants.

The validity of the certificate is displayed in the Valid To column.

 Note
Make sure to renew the certificate before it expires and update the service binding with a new certificate it in
case of a configuration update.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 45
Step Task

4. Export the Base-64-encoded X.509 certificate (.crt) and open the downloaded “.crt” file in a text editor.

The following steps describe service binding creation in the SAP BTP cockpit.

5. On the Instances and Subscriptions screen, under Instances, display the action menu of the instance and choose
Create Service Binding.

SAP BTP Configuration Guide

46 PUBLIC Set Up Using Manual Steps
 Step Task

6. In the New Binding view:

1. Enter a name for the binding.

2. Under Service Binding/Key Type, select X.509 Certificate.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 47
Step Task

7. Paste the entire content of the ".crt" file that you opened in the text editor into the Certificate field.

SAP BTP Configuration Guide

48 PUBLIC Set Up Using Manual Steps
 Step Task

8. You can switch to the JSON tab in the view to check the format of the form.

 Caution
Don't make any manual changes to the JSON as this might invalidate the certificate and can lead to failures
when creating the service binding.

9. Choose Create.

 Note
For one external certificate, you can only create one service binding per service instance. If you try to create
an additional binding, the creation fails.

The following steps are relevant in case you want to configure API access for the integration of SAP Subscription Billing with
SAP S/4HANA Cloud using communication scenario SAP_COM_0642.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 49
Step Task

10. Using the Administrator role, log on to your SAP S/4HANA Cloud system and go to the Communication System
app.

11. Create a communication system as described under Create Communication System for SAP Subscription Billing
- API Integration in the Setup Instructions for Scope Item 57Z or Setup Instructions for Scope Item 5IK .

In the OAuth 2.0 Settings, enter the URLs using these patterns:

• Authorization Endpoint: <certurl>/authorize

• Token Endpoint: <certurl>/oauth/token

 Tip
You can find the url and certurl properties inside the uaa object in the service binding that you created
for the service SAP Subscription Billing (API Service). To enter the endpoints correctly, remove https://
from the URL and add /authorize or /oauth/token at the end, as shown above.

If you need to create a communication arrangement, follow the procedure described under Create
Communication Arrangement for SAP Subscription Billing - API Integration (SAP_COM_0642) in the Setup
Instructions for Scope Item 57Z or Setup Instructions for Scope Item 5IK .

SAP BTP Configuration Guide

50 PUBLIC Set Up Using Manual Steps
 Step Task

12. Create a new Outbound User for communication scenario SAP Subscription Billing - API Integration
(SAP_COM_0642).

Make the following settings:

1. Authentication Method: OAuth 2.0

2. OAuth 2.0 Client ID: Copy the value from the service binding you created earlier. You can view the service
binding in the SAP BTP cockpit or download it. You find the relevant value under clientid.

3. Client Authentication: mTLS

4. Client Certificate: Client Default

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 51
Step Task

13. Choose Create.

 Note

To view the service credentials, users require the role Subaccount Service Auditor (part of the default role
collection Subaccount Viewer).

4.4 Set Up SAP Event Broker for SAP Cloud Applications

Complete the setup described in this section if you are integrating SAP Subscription Billing with SAP S/4HANA
Cloud Public Edition and want to use SAP Event Broker for SAP cloud applications to distribute events.

Business events are used to replicate subscriptions and billing forecasts in SAP Subscription Billing as
provider contracts and forecast billing plans respectively in SAP S/4HANA Cloud. You can choose which event
distribution service to use for this. Refer to the information on the SAP Discovery Center help you decide:

• SAP Event Broker for SAP cloud applications

• SAP Event Mesh

 Note

With SAP Event Broker for SAP cloud applications, the scenario is preconfigured and managed by SAP. With
SAP Event Mesh, the scenario is configured in a customer-managed way, so you need to define the queue
and event topics that are required for the integration, and register the queue in SAP S/4HANA Cloud.

The steps in this section guide you directly through the required setup of SAP Event Broker. If you want to learn
more about the service, refer to the SAP Event Broker Service Guide.

SAP BTP Configuration Guide

52 PUBLIC Set Up Using Manual Steps
4.4.1 Add SAP Event Broker to a Subaccount

Add your entitlement for the standard application plan of SAP Event Broker for SAP cloud applications to either
your SAP Subscription Billing subaccount or another subaccount.

Prerequisite

You have Subaccount Administrator authorizations at a minimum.

Procedure

Step Task

1. In the subaccount where you want to add your entitlement, choose Entitlements in the navigation panel.

2. To start, choose Edit.

3. Now choose Add Service Plans.

4. Under Entitlements, search for Event Broker, select the service, then select the standard (Application) service
plan.

5. Confirm the change by choosing Add 1 Service Plan.

6. Assign the quota and choose Save to finish.

7. Verify that the application plan displays in the table of entitlements.

4.4.2 Subscribe to the SAP Event Broker Application

To enable access to the SAP Event Broker application, subscribe to the standard application plan. You'll use the
application further on in the setup to enable preconfigured subscription content.

Prerequisite

• You have Subaccount Administrator authorizations at a minimum.

• You have added your entitlement for SAP Event Broker for SAP cloud applications to a subaccount (see
Add SAP Event Broker to a Subaccount [page 53]).

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 53
Procedure

Step Task

1. In the subaccount in which you added SAP Event Broker, choose Instances and Subscriptions in the navigation
panel.

2. Choose Create.

3.
Scroll through the service list or type in Event Broker and select SAP Event Broker for SAP cloud
applications and the standard application plan.

4. Choose Create.

The subscription is activated and the Go to Application link becomes available in the subscription details.

 Note
To access the application, you need to apply roles to your user, which you do in the next activity.

4.4.3 Provide Authorization for the SAP Event Broker

Application

You need to assign role-based permissions to each user who needs access to the SAP Event Broker application
to enable preconfigured subscription content.

Prerequisite

• You have Subaccount Administrator authorizations at a minimum.

• You have subscribed to the SAP Event Broker standard application plan (see Subscribe to the SAP Event
Broker Application [page 53]).

Procedure

Step Task

1. In the subaccount in which you added SAP Event Broker, choose Security Users .

2. Choose a user row.

The table opens a new column to the right and exposes the role details.

SAP BTP Configuration Guide

54 PUBLIC Set Up Using Manual Steps
 Step Task

3. Under Role Collections, choose Assign Role Collection (if you're working on a small screen, you can find the
option by choosing the three dots that represent the options menu).

4. Choose the role collection Event Broker Integration Administrator then choose Assign Role Collection.

5. Verify that the role collection appears in the list for the user.

Results

Once role permissions are assigned to users, they can access the SAP Event Broker application using the link in
the row for the subscribed application plan.

4.4.4 Register Your SAP S/4HANA Cloud System in Your

Global Account

To connect an SAP S/4HANA Cloud system with a global account in SAP BTP, you need to register the system
in the corresponding global account.

Prerequisites

• For the steps in SAP BTP, you are an administrator of the global account where you want to register your
SAP S/4HANA Cloud system.
• For the steps in SAP S/4HANA Cloud, you are an administrator of the SAP S/4HANA Cloud tenant.

Context

The registration process is based on a registration token that is used for the pairing of the SAP S/4HANA Cloud
system and the corresponding global account. You create the token in the global account, and then the tenant
administrator of the respective SAP S/4HANA Cloud system uses the token to start the automated registration
process on the SAP S/4HANA Cloud system side.

 Note

• When registering SAP S/4HANA Cloud systems, you can have up to 1000 tokens per global account
ready to be used. Tokens that are already used to register an SAP S/4HANA Cloud system are not
included in this number.
This means that you cannot have more than 1000 systems in the Systems list of type SAP S/4HANA
Cloud with an empty status and generated token that is not used yet.
• You cannot migrate the registered SAP S/4HANA Cloud systems between global accounts.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 55
 If you want to start using another global account, you will have to register your SAP S/4HANA Cloud
systems again.
• When registering a system or creating a formation, the data you provide in the given input fields is not
encrypted with your customer managed key. The data you enter is only encrypted at rest.

Procedure

1. In the cockpit, navigate to your global account, and then choose System Landscape Systems .
2. On the Systems page, choose Add System.
a. Enter a name for the system you want to register.

 Note

Use only printable ASCII characters.

 Tip

We recommend that you indicate the type of the system when specifying the system name. For
example, <mysystem>-S/4HANA-cloud. This helps you identify the system type when assigning
systems to a formation.

b. In the Type dropdown list, select SAP S/4HANA Cloud.

c. Choose Add.
d. In the Communication Scenario Groups dropdown menu, select Eventing Between SAP Cloud Systems
to allow the automatic enablement of the SAP_COM_0892 communication scenario in SAP S/4HANA
Cloud.
e. Choose Get Token.

The system generates the registration token.

f. Copy the registration token and send it to the tenant administrator for the respective SAP S/4HANA
Cloud system. You need it for configuring the integration on the extended SAP S/4HANA Cloud system
side.

You can also get the registration token later, once the system appears in the list on the Systems page.

The registration token is valid for 7 days after it has been generated. When a token is not used within its
validity period, it is no longer valid and cannot be used for registering an SAP S/4HANA Cloud system.
If the validity of the token expires before you use it to configure the integration on the SAP S/4HANA
Cloud system side and complete the registration, you need to get a new token. You can then copy it
and use it to complete the registration.

 Note

A registration token can be used only once, for registering a single SAP S/4HANA Cloud system.

g. Close the wizard.

The SAP S/4HANA Cloud system appears in the list of systems on the Systems page. Its Status field is
empty because the registration process is not yet completed.

SAP BTP Configuration Guide

56 PUBLIC Set Up Using Manual Steps
 3. Start the automated registration process on the SAP S/4HANA Cloud system side. To do so, proceed as
described in as described below under Trigger the Registration in the SAP S/4HANA Cloud Tenant.

 Note

You can register a system with the same name only once per global account. Once you have started
a registration process for a system with a specified name you can no longer register a system with
the same name and connect it with the same global account, unless you delete the corresponding
extension in the Maintain Extensions on SAP BTP in the SAP S/4HANA Cloud tenant. If the registration
process fails, you need to delete the failed extension from the SAP S/4HANA Cloud tenant and create
a new integration token in the cockpit for the corresponding system to be able to start the automated
registration process again.

4. Check the status of the registration process. To do so, in the cockpit navigate to your global account, and
on the Systems page, check if the status of the SAP S/4HANA Cloud system has changed to Registered.

If you are already on the Systems page, refresh the page to check if the status has changed.

For information about registration statuses and about deregistering systems, refer to the generic SAP BTP
documentation Register an SAP S/4HANA Cloud System in a Global Account in SAP BTP.

Trigger the Registration in the SAP S/4HANA Cloud Tenant

Use this procedure to trigger the registration process for an SAP S/4HANA Cloud system that you want to pair
with your global account in SAP BTP.

Prerequisites

You are an SAP S/4HANA Cloud tenant administrator.

Procedure

1. Log on to the SAP S/4HANA Cloud tenant, go to Administration Communication Management , and
then open the Maintain Extensions on SAP BTP app (or search for the app using the app search) .
2. In the Maintain Extensions on SAP BTP app, choose New.
3. In the Integration Token field, enter the content of the registration token from the SAP BTP cockpit.
4. Choose Save. A new entry appears in the Extensionslist with status Enabling.
5. After the integration has finished successfully, you can refresh the list.

The status of the integration should have changed to Enabled.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 57
Results

Your SAP S/4 HANA Cloud system is now registered in your SAP BTP global account.

4.4.5 Create Formations to Define the Event Sharing Context

When SAP Event Broker distributes events between SAP Subscription Billing and SAP S/4HANA Cloud, the
data is handled in a secure manner. A formation enforces customer tenant data segregation, or the sharing
context, for these applications when they are registered as SAP systems.

Prerequisites

• You have Global Account Administrator or System Landscape Administrator authorizations.

• You have subscribed to the SAP Event Broker application (see Subscribe to the SAP Event Broker
Application [page 53]).
• You have registered your SAP S/4HANA Cloud system in your global account (see Register Your SAP
S/4HANA Cloud System in Your Global Account [page 55]).

Procedure

 Note

The subaccount where SAP Event Broker is subscribed can only be part of one formation in a global
account.

SAP systems can only be added to one formation of type Eventing Between SAP Cloud Systems in a global
account.

Step Task

1. In your global account, navigate to System Landscape.

2. On the Formations tab, choose Create Formation.

3. Follow the guided steps to enter all the required information for your formation:

1. Add a name that helps you identify your formation.

2. In the Formation Type dropdown menu, select Eventing Between SAP Cloud Systems.
3. In the Subaccount dropdown menu, select the subaccount where SAP Event Broker is subscribed.
4. Select the systems that you want to include in the formation.
For SAP Subscription Billing, systems are tenants.
5. Review your selections and choose Create to create the formation.

SAP BTP Configuration Guide

58 PUBLIC Set Up Using Manual Steps
Next Steps

You now need to configure communication in your SAP S/4HANA Cloud system. You can find a description of how to
do this in the setup instructions for scope item 57Z (Subscription Management with Sales Billing) or 5IK (Subscription
Management with Convergent Invoicing).

In your SAP S/4HANA Cloud system, you create communication arrangements based on the following communication
scenarios:

• SAP_COM_0892 (SAP Event Broker for SAP Cloud Applications Integration)

• SAP_COM_0884 (SAP Subscription Billing - Event Consumption Integration)

Once you've done that configuration, continue in the current guide with the activity Enable Event Subscriptions [page 59].

Removing a System from the Formation

After you have created a formation, you can edit it and change the included systems. If you want to remove
an SAP system from a formation of type Eventing Between SAP Cloud Systems, make sure that all active event
subscriptions are disabled first in SAP Event Broker. You can check your subscriptions in the SAP Event Broker
application on the Subscriptions page.

Deleting Formations

When you delete a formation, the systems are excluded from the formation, the subaccount is unassigned, and
finally, the formation is deleted from the formations list completely.

To restore a deleted formation, first you must create it anew, and then, include all of its systems again, one by
one.

4.4.6 Enable Event Subscriptions

Event subscriptions identify the publishing application, the subscribing application, and the type of events that
can flow between them. When the event subscription becomes active, the subscribing application immediately
begins consuming events.

Prerequisites

• You have Event Broker Integration Administrator authorizations.

• You have subscribed to the SAP Event Broker standard application plan (see Subscribe to the SAP Event
Broker Application [page 53]).

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 59
• A formation of type Eventing Between SAP Cloud Systems was created and includes the subaccount
where the SAP Event Broker application is subscribed (see Create Formations to Define the Event Sharing
Context [page 58]).
• You have created communication arrangements based on the following communication scenarios in SAP
S/4HANA Cloud:
• SAP_COM_0892 (SAP Event Broker for SAP Cloud Applications Integration)
• SAP_COM_0884 (SAP Subscription Billing - Event Consumption Integration)

Procedure

Step Task

1.
In the subaccount in which you added SAP Event Broker, choose Services Instances and Subscriptions in
the navigation panel.

2. In the Subscriptions table, choose the link next to SAP Event Broker.

The SAP Event Broker application displays.

3. After signing in, choose Subscriptions.

4. From the table of event subscriptions, choose the tab All Available Subscriptions and select the subscription
Replication of Subscriptions and Billing Forecasts from SAP Subscription Billing to SAP S/4HANA Cloud.

 Note
If you can't select the row because it's grayed out, then you have an overlapping event subscription enabled.
Refer to the Lifecycle section of Event Subscriptions in the SAP BTP documentation to see a list of situations
when event subscriptions overlap.

5. Select the red status indicator to enable the event subscription.

Results

The Status indicator turns green, which indicates that the event subscription is active. The event subscription
also displays in the My Subscriptions tab. Subscribing applications begin consuming events immediately.

 Note

In some cases, you could experience a slight delay in connectivity while the subscriber associated with the
event subscription is activated. Any delays are automatically resolved.

SAP BTP Configuration Guide

60 PUBLIC Set Up Using Manual Steps
4.5 Set Up SAP Event Mesh

Complete the setup described in this section if you want to implement a customer-defined process extension,
or if you are integrating SAP Subscription Billing with SAP S/4HANA Cloud Public Edition and want to use SAP
Event Mesh to distribute events.

Events are messages that can be sent to notify a consumer about life cycle changes to an object, such as
creation, update, or a status change. For an overview of the different ways that events can be used with SAP
Subscription Billing, see Integration Using Events in the Integration Guide.

 Note

You need to purchase a separate license to use the SAP Event Mesh service.

If you're integrating SAP Subscription Billing with SAP S/4HANA Cloud Public Edition, you can choose
which event distribution service to use. Refer to the information on the SAP Discovery Center help you
decide:

• SAP Event Broker for SAP cloud applications

• SAP Event Mesh

With SAP Event Broker for SAP cloud applications, the scenario is preconfigured and managed by SAP. With
SAP Event Mesh, the scenario is configured in a customer-managed way, so you need to define the queue
and event topics that are required for the integration, and register the queue in SAP S/4HANA Cloud.

 Caution

During setup:

• Entitlements to the SAP Event Mesh service must be provisioned in the same SAP BTP global account
as SAP Subscription Billing.
• The SAP Event Mesh instance must be created in the same subaccount in which you subscribed to SAP
Subscription Billing.

For more information, see Initial Setup in the SAP Event Mesh documentation.

4.5.1 Assign an Event Mesh Entitlement

You need to assign entitlement quotas to your subaccount.

 Caution

Entitlements to the SAP Event Mesh service must be provisioned in the same SAP BTP global account as
SAP Subscription Billing.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 61
Step Task

1. In your subaccount, choose Entitlements in the navigation panel.

 Note
You must use the same subaccount as the one in which you subscribed to SAP Subscription Billing.

2. To start, choose Edit.

3. Now choose Add Service Plans.

SAP BTP Configuration Guide

62 PUBLIC Set Up Using Manual Steps
 Step Task

4. Search for Event Mesh, choose the service, and enable the service plan default.

 Tip
If you don’t see this entitlement in the list, then either you still need to purchase a license, or all the
purchased entitlements are used up.

5. Confirm the change by choosing Add 1 Service Plan.

6. Assign the quota and choose Save to finish.

4.5.2 Create an Event Mesh Instance

 Tip

For the consumption of events, the prices set in the SAP Event Mesh price list apply.

You can create a new Event Mesh instance by using the SAP BTP cockpit or by using the Cloud Foundry
Command Line Interface. In this section, we provide instructions for the SAP BTP cockpit.

 Note

Entitlements to the SAP Event Mesh service must have been provisioned in the same SAP BTP global
account as SAP Subscription Billing (in Assign an Event Mesh Entitlement [page 61]).

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 63
Step Task

1.
In your subaccount, choose Cloud Foundry Spaces in the navigation panel.

 Caution
You must use the same subaccount as the one in which you subscribed to SAP Subscription Billing.

2. Open the space in which you want to create a service instance.

3. Choose Services Service Marketplace in the navigation panel.

SAP BTP Configuration Guide

64 PUBLIC Set Up Using Manual Steps
 Step Task

4. You see all the services that are available to you.

Search for and select the service Event Mesh.

5. Under Service Plans, display the action menu of the plan for which you want to create an instance and choose
Create.

 Note
Your user must be a member of the space and have the role Space Developer assigned. If not, you won’t see
the button Create.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 65
Step Task

6. Name the instance and choose Next.

 Tip
In this guide, we use “DEMOSUBACC01” as the example name for the instance.

SAP BTP Configuration Guide

66 PUBLIC Set Up Using Manual Steps
 Step Task

7. Upload a JSON file or specify the parameters in JSON format.

{
"emname": "<yourmessageclientname>",
"namespace": "<yourorgname>/<yourmessageclientname>/<uniqueID>",
"version": "1.1.0",
"options": {
"management": true,
"messagingrest": true,
"messaging": true
},
"rules": {
"queueRules": {
"publishFilter": [
"${namespace}/*"
],
"subscribeFilter": [
"${namespace}/*"
]
},
"topicRules": {
"publishFilter": [
"${namespace}/*"
],
"subscribeFilter": [
"sap/billing/sb/*"
]
}
}
}

Provide the parameters for which the placeholders are highlighted in yellow: name of message client, name-
space, and connection rules for the message client.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 67
Step Task

 Tip
The namespace must contain alphanumeric characters with 3 segments (a/b/c) and have a maximum
length of 24 characters. Don’t use the term “sap” in your namespace because it’s reserved for SAP applica-
tions.

For more information, see Syntax for Service Descriptor in the SAP Event Mesh documentation.

To receive events from SAP Subscription Billing, you must define a subscribeFilter rule as highlighted
in green in the service description. With this configuration, you specifically subscribe to the topics for SAP
Subscription Billing.

8. After providing the parameters, choose Next.

9. Check that everything is correct and choose Create.

10. The creation process starts. Choose View Instance to switch to the Instances screen.

11. Your instance is created.

4.5.3 Prepare Access to the SAP Event Mesh Application

SAP Event Mesh is a software as a service (SaaS) application that allows your authorized business users to
manage queues and webhooks. It also allows them to view the connection rules and service descriptor that you
provided when you created a service instance. For more information, see Using Event Mesh in the SAP Event
Mesh documentation.

 Tip

Only a security administrator of the subaccount can perform the steps in this section. For detailed
information on defining your security administrators, see the section Define Subaccount Administrators
[page 25] in this guide.

SAP BTP Configuration Guide

68 PUBLIC Set Up Using Manual Steps
 Step Task

1. Subscribe to the Event Mesh application:

Go to the subaccount in which you subscribed to SAP Event Mesh and SAP Subscription Billing. Choose

Services Service Marketplace in the navigation panel.

2. You see all the services that are available to you.

Search for and select the service Event Mesh.

3. Under Application Plans, display the action menu of the plan for which you want to create a subscription and
choose Create.

 Note
In this guide, we use the standard plan for the example.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 69
Step Task

4. Check the basic info and then choose Create.

5. The creation process starts. Choose View Subscription to switch to the Instances and Subscriptions screen.

6. You’re subscribed to the Event Mesh application.

7. Now give your users access to the application:

In your subaccount, choose Security Role Collections in the navigation panel. Then filter by “Enterprise
Messaging” (former name of Event Mesh).

You see the standard role collections for Event Mesh.

For details on the Event Mesh roles, see Assign Roles to Users in the SAP Event Mesh documentation.

SAP BTP Configuration Guide

70 PUBLIC Set Up Using Manual Steps
 Step Task

8. Assign your users to the standard role collections according to the necessary authorizations.

For example, assign administrators to the collection “Enterprise Messaging Administrator".

9. Follow the steps described in Assign Role Collections to Users or User Groups [page 33].

If the standard collections are not sufficient, you can also create your own role collections for Event Mesh. See
Build Role Collections [page 28] for instructions.

10.
To access the application, return to the overview of your subaccount and choose Services Instances and

Subscriptions . In the list of subscriptions, choose the Go to Application icon of Event Mesh.

 Note
Only the business users that you authorized in the previous step can access the application.

11. The SAP Event Mesh application displays.

You will see a tile for each Event Mesh instance of plan DEFAULT from your subaccount.

To continue, select the tile for your messaging client.

You will see the settings for this messaging client. You can then define queues or webhook subscriptions and
display further details.

You need a webhook subscription if you want to receive the events via a push mechanism. The Event Mesh
service calls your registered endpoint (webhook URL) via a HTTP post request with the event payload.

SAP BTP Configuration Guide

Set Up Using Manual Steps PUBLIC 71
Important Disclaimers and Legal Information

Hyperlinks
Some links are classified by an icon and/or a mouseover text. These links provide additional information.
About the icons:

• Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your
agreements with SAP) to this:

• The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information.

• SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any
damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.

• Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering an SAP-hosted Web site. By using
such links, you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this
information.

Videos Hosted on External Platforms

Some videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any
advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within
the control or responsibility of SAP.

Beta and Other Experimental Features

Experimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by
SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use
the experimental features in a live operating environment or with data that has not been sufficiently backed up.
The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your
feedback (e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP.

Example Code
Any software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax
and phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of
example code unless damages have been caused by SAP's gross negligence or willful misconduct.

Bias-Free Language
SAP supports a culture of diversity and inclusion. Whenever possible, we use unbiased language in our documentation to refer to people of all cultures, ethnicities,
genders, and abilities.

SAP BTP Configuration Guide

72 PUBLIC Important Disclaimers and Legal Information
SAP BTP Configuration Guide
Important Disclaimers and Legal Information PUBLIC 73
www.sap.com/contactsap

© 2024 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form

or for any purpose without the express permission of SAP SE or an SAP
affiliate company. The information contained herein may be changed
without prior notice.

Some software products marketed by SAP SE and its distributors

contain proprietary software components of other software vendors.
National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for

informational purposes only, without representation or warranty of any
kind, and SAP or its affiliated companies shall not be liable for errors or
omissions with respect to the materials. The only warranties for SAP or
SAP affiliate company products and services are those that are set forth
in the express warranty statements accompanying such products and
services, if any. Nothing herein should be construed as constituting an
additional warranty.

SAP and other SAP products and services mentioned herein as well as
their respective logos are trademarks or registered trademarks of SAP
SE (or an SAP affiliate company) in Germany and other countries. All
other product and service names mentioned are the trademarks of their
respective companies.

Please see https://www.sap.com/about/legal/trademark.html for

additional trademark information and notices.

THE BEST RUN