SAP HANA Cloud
SAP HANA Cloud User Management: Users, Roles, and Access Control
Learn how SAP HANA Cloud user management works, including users, roles, privileges, authentication, administration tools, and practical security controls.
What SAP HANA Cloud User Management Covers
SAP HANA Cloud user management controls who can connect to a database, which actions they can perform, and which data they can access. The model is based on database users, roles, privileges, authentication settings, and secure operational procedures.
A sound design separates everyday business access from administrative access. It also follows least privilege: each identity receives only the permissions required for its responsibilities. This limits the impact of compromised credentials and reduces accidental changes.
Users and Authentication
A user is a database identity that can authenticate to SAP HANA Cloud. User records can support password-based authentication and, depending on the landscape and configuration, other enterprise authentication options. The exact authentication design should align with the organization’s identity and access policies.
Avoid sharing named user credentials. Personal accounts improve accountability, while dedicated technical users can support application connections when their credentials are protected and their permissions are narrowly scoped. Disable or remove identities that are no longer needed, and review inactive accounts regularly.
Password policies, authentication configuration, and user lifecycle processes should be managed consistently. Account provisioning should include an owner, a business purpose, an approval path, and a planned review date.
Roles and Privileges
Roles group privileges so that access can be assigned consistently. A privilege grants permission to perform an operation or access a securable object. Common examples include permissions related to schemas, tables, views, procedures, system activities, and administration tasks.
Use technical roles to represent job functions, such as reporting, application runtime, or database operations. Grant roles to users rather than repeatedly assigning large collections of individual privileges. This makes access easier to review and reduces configuration drift.
Prefer narrowly scoped object privileges over broad system privileges. Administrative roles should be limited to trusted operators, and powerful permissions should not be granted to application runtime users unless they are genuinely required.
Administrative Tools for SAP HANA Cloud
SAP HANA Cloud Central is used for service-level tasks such as accessing the database service and managing the cloud resource. SAP HANA database explorer is used for database-oriented work, including SQL execution, inspecting database objects, and managing users and roles when the connected account has the required permissions.
SAP HANA cockpit is an administration tool for SAP HANA on-premise. It is not the administration, monitoring, or alerting tool for SAP HANA Cloud. For cloud services, use SAP HANA Cloud Central and SAP HANA database explorer according to the task and assigned permissions.
For a related overview, see SAP HANA Cloud Central and SAP HANA Cloud database explorer.
A Practical User Provisioning Process
A repeatable process helps prevent excessive access and orphaned accounts.
- Identify the person, application, or service that needs access.
- Define the business purpose and required database operations.
- Select or create a role that matches those operations.
- Create or configure the user through an approved administrative workflow.
- Assign the smallest suitable role set.
- Test expected access and confirm that unauthorized operations fail.
- Record the owner, approval, scope, and review date.
- Reassess access after role changes, project completion, or personnel changes.
Application users should generally receive permissions needed by the application rather than broad permissions intended for administrators. Separate development, test, and production identities whenever possible.
Access Reviews and Secure Operations
Access reviews should verify both the identity and the permission path. Check direct grants, inherited role privileges, high-impact system privileges, inactive accounts, technical users, and users with administrative capabilities.
A review is more effective when it asks practical questions: Does the account still have a valid owner? Is the role still required? Are privileges broader than the application’s behavior? Can a lower-privilege role meet the same need? Are emergency or temporary grants still active?
Combine user management with audit and operational monitoring. For broader privilege concepts, see SAP HANA user privileges. Keep credentials out of source code, restrict administrative access, and use secure secret-management practices for technical connections.
Common User Management Mistakes
Shared named accounts
Shared accounts make it difficult to identify the person responsible for an action. Use individual accounts for people and narrowly scoped technical users for applications.
Broad administrator grants
Giving administrative roles to simplify troubleshooting creates unnecessary risk. Create task-specific roles and grant elevated access only for approved operational needs.
Direct privilege accumulation
Repeatedly granting individual privileges can create an access model that nobody fully understands. Prefer documented roles with clear owners and periodic review.
Missing offboarding
An account can remain active after a person changes responsibilities or leaves a project. Include database access in joiner, mover, and leaver procedures.
Confusing service administration with database administration
Cloud resource administration and database authorization are related but distinct. Use SAP HANA Cloud Central for the cloud service context and SAP HANA database explorer for supported database tasks; do not treat SAP HANA cockpit as the SAP HANA Cloud administration tool.
A Secure Baseline
A practical baseline includes named personal accounts, controlled technical users, role-based access, least privilege, documented approvals, periodic reviews, secure credential handling, and appropriate auditing. The baseline should be tested against real application and operational workflows rather than assumed from role names alone.
When access requirements change, update the role design and its documentation together. This keeps authorization decisions understandable and makes future reviews faster. SAP HANA Cloud user management is most effective when it is treated as an ongoing governance process instead of a one-time setup task.