1. Problem Description
After switching the CIM application in SAP Cloud Identity Services (CIS) to use Microsoft Entra ID (formerly Azure Active Directory) as the identity provider, users reported error messages when trying to access the Ariba Invoicing module. Authentication via the Microsoft login page succeeded, but the application subsequently failed with errors.
User authenticates successfully via Microsoft Entra ID (including 2-Factor Authentication / MFA), but receives an error upon reaching the CIM Accounting module. The session cannot be established correctly for the application.
2. Root Cause
When an external Identity Provider (IdP) such as Microsoft Entra ID is configured in SAP Cloud Identity Services, the Identity Federation settings determine how SAP IAS (Identity Authentication Service) handles the authenticated user session.
By default, the Identity Federation configuration is inherited from the parent application. In this case, the inherited settings did not include “Use Identity Authentication user store” — meaning SAP IAS passed the Entra ID token to CIM without resolving the user against its own user store. As a result, CIM could not find a matching user record and returned an error in the Accounting module.
3. Authentication Flow (Before & After Fix)
Before the fix (broken flow)
MFA / 2FA
no user store lookup
✗ Error
After the fix (working flow)
MFA / 2FA
user store lookup ✓
✓ Success
4. Solution: Step-by-Step Configuration
Log into SAP Cloud Identity Services (CIS) as an administrator and follow the navigation path below:
Navigate to your SAP Cloud Identity Services admin console (e.g., https://<tenant>.accounts.ondemand.com/admin) and sign in with administrator credentials.
In the left-hand menu, clickApplications & Resources→Applications.
Search for or scroll to theCIMapplication in the list and click on it to open its settings.
Within the CIM application settings, select theConditional Authenticationtab.
Click onIdentity Federationwithin the Conditional Authentication section.
Under Configuration Source, change from the inherited value toCustom. This overrides the parent application settings for CIM specifically.
Check theUse Identity Authentication user storecheckbox. This is the critical fix. Leave Allow Identity Authentication users only and Apply Application Configurations unchecked.
Save the configuration and ask the affected user to log in again via Microsoft Entra ID to confirm the fix.
5. Why This Is the Correct Solution
SAP Cloud Identity Services supports Identity Federation: an external IdP (such as Microsoft Entra ID) handles the primary authentication including MFA/2FA, while SAP IAS acts as a broker connecting the authenticated identity to SAP application user records.
The setting “Use Identity Authentication user store” controls whether SAP IAS performs a user lookup in its own user store after receiving the federated assertion from Entra ID:
Setting Behavior Result| Disabled (inherited / unchecked) | SAP IAS forwards the Entra ID token to CIM without user store resolution. CIM receives only raw Entra ID attributes. | CIM cannot find a matching user → Error |
| Enabled (checked — after fix) | SAP IAS looks up the user in its own store (matching by email). The full IAS user profile (including roles and group memberships) is forwarded to CIM. | CIM receives enriched user context → Success |
When Entra ID is configured as a Corporate Identity Provider in SAP IAS, it acts as an upstream IdP. The Identity Federation settings determine how the downstream application (CIM) receives user information. Enabling the IAS user store lookup ensures that attributes stored in IAS (roles, groups, application assignments) are correctly propagated to CIM — which is essential for module-level authorization such as access to the Accounting module.
6. Configuration Settings Reference
Setting Value (After Fix) Explanation| Configuration Source | Custom | Overrides parent application defaults with settings specific to CIM. Prevents unintended inheritance of restrictive parent configuration. |
| Use Identity Authentication user store | ✓ Enabled | After Entra ID login, IAS matches the user to an existing IAS record. User profile data and application attributes are forwarded to CIM. |
| Allow Identity Authentication users only | ✗ Disabled | If enabled, only users with a native IAS account (not federated via Entra ID) would be allowed. Leaving disabled permits Entra ID federated users. |
| Apply Application Configurations | ✗ Disabled | Leave unchecked unless CIM-specific conditional authentication rules need to be applied on top of the federation settings. |
7. Resolution Confirmation
After applying the above configuration, the user confirmed successful login via Microsoft Entra ID (including 2-Factor Authentication) and unimpeded access to the CIM Accounting module. (Confirmed November 6, 2026)