How a 145-year-old mutual insurer automated identity provisioning from SailPoint to SAP Ariba via SAP Cloud Identity Services

The company was already deep into an enterprise-wide identity modernization, moving its whole user base from SailPoint IdentityIQ on-premises to SailPoint Identity Security Cloud. As that migration progressed, one integration gap stood out: SAP Ariba still relied on file-based and manual provisioning. New employees, role changes, and deactivations had to be handled by hand, which meant delays, inconsistencies, and real exposure every time someone's access status changed.

The SAP piece had to slot cleanly into an existing enterprise program. It could not be a standalone build that created its own governance overhead. And with SailPoint already chosen as the identity authority, the answer had to route through SailPoint's cloud platform, not around it.

Mindset ran a focused four-week engagement to configure SAP Cloud Identity Services as the bridge between SailPoint Identity Security Cloud and SAP Ariba. The work started with a blueprint of the current SAP and BTP architecture, then modeled the desired future state with governance recommendations, a BTP services decision-tree document, and a toolset recommendation plan.

The core integration connected three systems: SailPoint Identity Security Cloud as the identity authority, SAP Cloud Identity Services handling the provisioning pipeline through Identity Directory and Identity Provisioning Service, and SAP Ariba as the downstream target. The configuration covered the full identity lifecycle: user creation and activation, attribute and role changes, and deactivation with automated access removal. Role and entitlement provisioning into Ariba flows directly from SailPoint access requests, with no manual steps in between.

The engagement also covered broader BTP platform enablement, including sub-account structure, shared services, trust and authentication configuration, and system connections. Mindset's BTP Cost Forecasting and Consumption tool was installed to give the team visibility into platform spending. The work was delivered fully remote alongside the company's internal teams and their SailPoint resources.

Automated, closed-loop identity provisioning from SailPoint Identity Security Cloud to SAP Ariba replaced the previous file-based and manual process. The company's SAP access lifecycle now runs without manual hand-offs: user creation, role and attribute changes, and deactivation all execute automatically when SailPoint processes an access event.

The integration was designed to fit inside an existing enterprise program rather than run alongside it, so the delivery approach mattered as much as the configuration. Four weeks from kickoff to a validated, working integration gave the broader modernization effort a completed milestone without disrupting parallel workstreams.

The project builds on an earlier BTP Enablement Workshop that established the platform foundation, and the governance deliverables produced here give the company's internal team the architecture documentation and decision framework to run and extend the configuration themselves.