Overview

SAP Asset Performance Management (APM) is evolving to support the next generation of SAP intelligent services – starting with SAP Joule, SAP's AI copilot embedded across the SAP portfolio.

To make this possible, APM needs to shift how it manages user identity. Today, APM relies on XSUAA (SAP's traditional BTP authentication service). While XSUAA works well for existing scenarios, it is not compatible with Joule or other modern SAP AI services, which require a newer identity standard: OpenID Connect (OIDC) via IAS – SAP's Identity Authentication Service.

This migration also moves your APM subscription to Subscription Manager Service (SMS), SAP's new subscription infrastructure, which is a prerequisite for these new capabilities.

For existing APM customers, this requires a one-time migration – a guided, three-step process completed entirely inside APM Config Manager. Your users will not notice any change to their day-to-day login experience.

note: This guide is for existing APM customers already running on XSUAA/SAML. New customers are set up with OIDC from day one.

What You Need Before Starting

• Access to your BTP Cockpit (to create a destination)
• A XSUAA service instance with apiaccess plan in your subaccount (or the ability to create one)
• Access to APM Config Manager with Identity Authentication Migration enabled

The Three Steps

Step 1 – Set Up the Migration Destination

APM cannot access your XSUAA identity zone directly due to BTP's security boundaries. You grant it access by creating a destination in your subaccount.

1. In BTP Cockpit, go to Services → Instances, open your XSUAA instance (apiaccess plan), and create a Service Key. Note the clientid, clientsecret, url, and apiUrl.
2. Go to Connectivity → Destinations → New Destination and fill below Details.
3. Save and use Check Connection to verify. Then return to Config Manager tile in the APM flp of your tenant – Step 1 should show a green checkmark.

Field Value

Name	APM_IAS_MIGRATION_DESTINATION
Type	HTTP
URL	<apiUrl from service key>
Authentication	OAuth2ClientCredentials
Token Service URL	<url from service key>/oauth/token
Client ID	<clientid from service key>
Client Secret	<clientsecret from service key>

Step 2 – Migrate Your Identity Provider from SAML to OIDC

Config Manager shows a table of all identity providers in your subaccount. Active SAML IdPs have a Migrate button; already-OIDC IdPs show Complete.

1. Click Migrate on your SAML IdP.
2. Select your IAS/SCI instance from the dropdown and confirm.

 

 

 

The row updates to Complete and Step 2 turns green.No SCI instance? Create one in IAS, set up a trust configuration with OIDC protocol in your BTP subaccount, then return – Step 2 will already show as complete.

Step 3 – Move Your Subscription to SMS

⚠️ This action is irreversible. Confirm Steps 1 and 2 are complete before proceeding.

Once Step 2 is done, a “Ready to Move” button appears. Click it to move your APM subscription from SaaS Registry to SMS. When finished, the page shows “Subscription moved successfully” – your APM system is now ready for Joule.

Conclusion

Migrating to IAS is a small one-time effort that opens the door to SAP Joule and future AI-powered capabilities in APM. The three steps – setting up a destination, migrating your identity provider, and moving your subscription – take only a few minutes and require no downtime for your users.

By completing the steps in this blog, you have:

• Migrated your identity provider from SAML to OIDC – the protocol required by SAP Joule and next-generation SAP services.
• Moved your APM subscription to SAP Subscription Manager, the modern subscription infrastructure.

Once complete, your APM system is ready for what's next.

Source link