Role collections in SAP BTP, which grant users authorizations for applications like SAP Build Work Zone, can be assigned through several methods. Administrators can perform manual assignments directly in the SAP BTP subaccount cockpit. For automated, large-scale user management, the recommended approach is to map role collections to user groups from a federated Identity Provider (IdP). Programmatically, the SCIM API provided by the Digital Workplace Service (the foundation of SAP Build Work Zone, advanced edition) allows for managing users and groups, which are in turn mapped to role collections, thus automating user provisioning and authorization.

A. SAP Build Work Zone Content Manager: This tool is used to manage content visibility by assigning roles (not role collections) to pages, apps, and widgets. It does not assign role collections to users.

C. Authorization & Trust Management Service API: While this low-level platform API can technically assign role collections, the service-specific SCIM API (B) and IdP mapping (E) are the standard and recommended methods for programmatic and automated assignments in this context.

---

1. SAP Help Portal

SAP Business Technology Platform

Assigning Role Collections: This document explicitly details the two primary methods for assignment.

For option D (BTP Cockpit): "You can assign role collections to users or user groups in the SAP BTP cockpit." (Section: Assign Users or User Groups to a Role Collection in the Cockpit)

For option E (IdP Mapping): "We recommend that you manage users and their authorizations by mapping role collections to user groups on the level of the identity provider." (Section: Map Role Collections to User Groups in Your Identity Provider)

2. SAP Help Portal

SAP Build Work Zone

advanced edition

User and Group Management with the SCIM API: This document confirms the use of the service-specific SCIM API for managing groups that are mapped to role collections.

For option B (SCIM API): "The SCIM V2.0 API allows you to manage users and groups in the Identity Directory... You can map these groups to role collections in your subaccount on the SAP BTP." (Introduction section)

3. SAP Help Portal

SAP Build Work Zone

advanced edition

About Roles and Authorizations: This document clarifies the distinction between platform-level role collections and roles managed within the Content Manager.

For option A (Content Manager): It describes how administrators use the Content Manager to "assign roles to the content that you create" to control visibility

which is distinct from assigning platform-level role collections to users. (Section: Roles)