How do you manage identity and access management across a hybrid SAP landscape?

The architectural goal is a single, federated identity source of truth that every system in the hybrid landscape trusts, rather than each system (on-premise, cloud, BTP) maintaining its own separate user directory that has to be manually kept in sync.

flowchart TB
    A[Central Identity Provider] --> B[On-Premise Systems - via trust federation]
    A --> C[SAP BTP / Cloud Extensions]
    A --> D[Third-party SaaS applications]

Practically, this typically means a central identity provider (often integrated with SAP Cloud Identity Services) federating trust to every downstream system via standard protocols (SAML, OAuth/OIDC), so a user authenticates once and that identity is trusted consistently across the hybrid estate. The alternative — separate, unsynchronized identity stores per system — creates both a poor user experience (multiple logins) and a genuine security risk, since offboarding a user requires remembering to remove access from every separate system individually rather than one central point.