After switching the CIM application in SAP Cloud Identity Services (CIS) to use Microsoft Entra ID (formerly Azure Active Directory) as the identity provider, users reported error messages when trying to access the Ariba Invoicing module. Authentication via the Microsoft login page succeeded, but the application subsequently failed with errors.
Error Scenario
User authenticates successfully via Microsoft Entra ID (including 2-Factor Authentication / MFA), but receives an error upon reaching the CIM Accounting module. The session cannot be established correctly for the application.
2. Root Cause
When an external Identity Provider (IdP) such as Microsoft Entra ID is configured in SAP Cloud Identity Services, the Identity Federation settings determine how SAP IAS (Identity Authentication Service) handles the authenticated user session.
By default, the Identity Federation configuration is inherited from the parent application. In this case, the inherited settings did not include “Use Identity Authentication user store” — meaning SAP IAS passed the Entra ID token to CIM without resolving the user against its own user store. As a result, CIM could not find a matching user record and returned an error in the Accounting module.
3. Authentication Flow (Before & After Fix)
Before the fix (broken flow)
User
→
Microsoft Entra ID MFA / 2FA
→
SAP IAS (CIS) no user store lookup
→
CIM Accounting ✗ Error
IAS receives federated token but cannot map user → session fails in CIM
After the fix (working flow)
User
→
Microsoft Entra ID MFA / 2FA
→
SAP IAS (CIS) user store lookup ✓
→
CIM Accounting ✓ Success
IAS resolves identity via user store → enriched user context propagated to CIM
4. Solution: Step-by-Step Configuration
Log into SAP Cloud Identity Services (CIS) as an administrator and follow the navigation path below:
Navigate to your SAP Cloud Identity Services admin console (e.g., https://<tenant>.accounts.ondemand.com/admin) and sign in with administrator credentials.
2
Navigate to Applications
In the left-hand menu, clickApplications & Resources→Applications.
3
Select the CIM Application
Search for or scroll to theCIMapplication in the list and click on it to open its settings.
4
Open Conditional Authentication
Within the CIM application settings, select theConditional Authenticationtab.
5
Open Identity Federation
Click onIdentity Federationwithin the Conditional Authentication section.
6
Set Configuration Source to “Custom”
Under Configuration Source, change from the inherited value toCustom. This overrides the parent application settings for CIM specifically.
7
Enable “Use Identity Authentication user store”
Check theUse Identity Authentication user storecheckbox. This is the critical fix. Leave Allow Identity Authentication users only and Apply Application Configurations unchecked.
8
Save and test
Save the configuration and ask the affected user to log in again via Microsoft Entra ID to confirm the fix.
Fig. 1 — Identity Federation settings in SAP CIS for the CIM application (after fix): Configuration Source set to Custom, Use Identity Authentication user store enabled.
5. Why This Is the Correct Solution
SAP Cloud Identity Services supports Identity Federation: an external IdP (such as Microsoft Entra ID) handles the primary authentication including MFA/2FA, while SAP IAS acts as a broker connecting the authenticated identity to SAP application user records.
The setting “Use Identity Authentication user store” controls whether SAP IAS performs a user lookup in its own user store after receiving the federated assertion from Entra ID:
Setting Behavior Result
Disabled (inherited / unchecked)
SAP IAS forwards the Entra ID token to CIM without user store resolution. CIM receives only raw Entra ID attributes.
CIM cannot find a matching user → Error
Enabled (checked — after fix)
SAP IAS looks up the user in its own store (matching by email). The full IAS user profile (including roles and group memberships) is forwarded to CIM.
CIM receives enriched user context → Success
Technical Background
When Entra ID is configured as a Corporate Identity Provider in SAP IAS, it acts as an upstream IdP. The Identity Federation settings determine how the downstream application (CIM) receives user information. Enabling the IAS user store lookup ensures that attributes stored in IAS (roles, groups, application assignments) are correctly propagated to CIM — which is essential for module-level authorization such as access to the Accounting module.
6. Configuration Settings Reference
Setting Value (After Fix) Explanation
Configuration Source
Custom
Overrides parent application defaults with settings specific to CIM. Prevents unintended inheritance of restrictive parent configuration.
Use Identity Authentication user store
✓ Enabled
After Entra ID login, IAS matches the user to an existing IAS record. User profile data and application attributes are forwarded to CIM.
Allow Identity Authentication users only
✗ Disabled
If enabled, only users with a native IAS account (not federated via Entra ID) would be allowed. Leaving disabled permits Entra ID federated users.
Apply Application Configurations
✗ Disabled
Leave unchecked unless CIM-specific conditional authentication rules need to be applied on top of the federation settings.
7. Resolution Confirmation
Issue Resolved
After applying the above configuration, the user confirmed successful login via Microsoft Entra ID (including 2-Factor Authentication) and unimpeded access to the CIM Accounting module. (Confirmed November 6, 2026)
SAP Cloud Identity Services — CIM Identity Feder
1. Problem DescriptionAfter switching the CIM application in SAP Cloud Identity Services (CIS) to use Microsoft Entra ID (formerly Azure Active Directory) as the identity provider, users reported error messages when trying to access the Ariba Invoicing module. Authentication via the Microsoft login page succeeded, but the application subsequently failed with errors.Error ScenarioUser authenticates successfully via Microsoft Entra ID (including 2-Factor Authentication / MFA), but receives an error upon reaching the CIM Accounting module. The session cannot be established correctly for the application.2. Root CauseWhen an external Identity Provider (IdP) such as Microsoft Entra ID is configured in SAP Cloud Identity Services, the Identity Federation settings determine how SAP IAS (Identity Authentication Service) handles the authenticated user session.By default, the Identity Federation configuration is inherited from the parent application. In this case, the inherited settings did not include “Use Identity Authentication user store” — meaning SAP IAS passed the Entra ID token to CIM without resolving the user against its own user store. As a result, CIM could not find a matching user record and returned an error in the Accounting module.3. Authentication Flow (Before & After Fix)Before the fix (broken flow)User→Microsoft Entra IDMFA / 2FA→SAP IAS (CIS)no user store lookup→CIM Accounting✗ ErrorIAS receives federated token but cannot map user → session fails in CIMAfter the fix (working flow)User→Microsoft Entra IDMFA / 2FA→SAP IAS (CIS)user store lookup ✓→CIM Accounting✓ SuccessIAS resolves identity via user store → enriched user context propagated to CIM4. Solution: Step-by-Step ConfigurationLog into SAP Cloud Identity Services (CIS) as an administrator and follow the navigation path below:CIS Admin Console→Applications→CIM→Conditional Authentication→Identity Federation1Open the CIS Admin ConsoleNavigate to your SAP Cloud Identity Services admin console (e.g., https://<tenant>.accounts.ondemand.com/admin) and sign in with administrator credentials.2Navigate to ApplicationsIn the left-hand menu, clickApplications & Resources→Applications.3Select the CIM ApplicationSearch for or scroll to theCIMapplication in the list and click on it to open its settings.4Open Conditional AuthenticationWithin the CIM application settings, select theConditional Authenticationtab.5Open Identity FederationClick onIdentity Federationwithin the Conditional Authentication section.6Set Configuration Source to “Custom”Under Configuration Source, change from the inherited value toCustom. This overrides the parent application settings for CIM specifically.7Enable “Use Identity Authentication user store”Check theUse Identity Authentication user storecheckbox. This is the critical fix. Leave Allow Identity Authentication users only and Apply Application Configurations unchecked.8Save and testSave the configuration and ask the affected user to log in again via Microsoft Entra ID to confirm the fix. Fig. 1 — Identity Federation settings in SAP CIS for the CIM application (after fix): Configuration Source set to Custom, Use Identity Authentication user store enabled.5. Why This Is the Correct SolutionSAP Cloud Identity Services supports Identity Federation: an external IdP (such as Microsoft Entra ID) handles the primary authentication including MFA/2FA, while SAP IAS acts as a broker connecting the authenticated identity to SAP application user records.The setting “Use Identity Authentication user store” controls whether SAP IAS performs a user lookup in its own user store after receiving the federated assertion from Entra ID:Setting Behavior Result Disabled (inherited / unchecked)SAP IAS forwards the Entra ID token to CIM without user store resolution. CIM receives only raw Entra ID attributes.CIM cannot find a matching user → ErrorEnabled (checked — after fix)SAP IAS looks up the user in its own store (matching by email). The full IAS user profile (including roles and group memberships) is forwarded to CIM.CIM receives enriched user context → SuccessTechnical BackgroundWhen Entra ID is configured as a Corporate Identity Provider in SAP IAS, it acts as an upstream IdP. The Identity Federation settings determine how the downstream application (CIM) receives user information. Enabling the IAS user store lookup ensures that attributes stored in IAS (roles, groups, application assignments) are correctly propagated to CIM — which is essential for module-level authorization such as access to the Accounting module.6. Configuration Settings ReferenceSetting Value (After Fix) Explanation Configuration SourceCustomOverrides parent application defaults with settings specific to CIM. Prevents unintended inheritance of restrictive parent configuration.Use Identity Authentication user store✓ EnabledAfter Entra ID login, IAS matches the user to an existing IAS record. User profile data and application attributes are forwarded to CIM.Allow Identity Authentication users only✗ DisabledIf enabled, only users with a native IAS account (not federated via Entra ID) would be allowed. Leaving disabled permits Entra ID federated users.Apply Application Configurations✗ DisabledLeave unchecked unless CIM-specific conditional authentication rules need to be applied on top of the federation settings.7. Resolution ConfirmationIssue ResolvedAfter applying the above configuration, the user confirmed successful login via Microsoft Entra ID (including 2-Factor Authentication) and unimpeded access to the CIM Accounting module. (Confirmed November 6, 2026)SAP Cloud Identity Services — CIM Identity Feder Read More Technology Blog Posts by SAP articles
