Page tree
Skip to end of metadata
Go to start of metadata

This article is introduced by a blog providing an overview and summary.
This article was updated in December 2021 and the updates summarised in this blog post.



Licenses Available

  • Licenses currently available *:

    LicenseNamed or Concurrent
    Analytics HubNamed user *
    Business IntelligenceNamed user
    Business IntelligenceConcurrent session *
    Planning StandardNamed user
    Planning ProfessionalNamed user

    * Concurrent session licenses are no longer available to purchase

    * Analytic Hub licenses are no longer available to purchase


  • Each license can be consumed on its own:


  • Currently, only the “Business Intelligence” license offers the concurrent session licenses

Combining licenses

  • A single user can consume more than 1 license type, however some licenses includes others:
    • A Planning Professional license includes a Planning Standard license
    • A Planning Standard license includes a Business Intelligence ‘named user’ license
    • And a user can only consume one of the Business Intelligence licenses: ‘named user’ or ‘concurrent session’

  • It means the possible combinations are as shown:
    • A Planning license (Standard or Professional) can not consume a Business Intelligence concurrent session license
    • Or, if you like, a Business Intelligence concurrent session license can not consume a Planning license
  • Typically it is ‘User G’ we need to consider as it is only this user that combines both named user with concurrent session

Roles and licenses

  • A single role can consume only 1 of these license types:
    • Analytics Hub
    • Business Intelligence
    • Planning Standard
    • Planning Professional


  • Importantly! The role does NOT define if the license is ‘concurrent session’ or ‘named user’

    • There is no concept of a ‘concurrent session role’ or ‘named user role’

    • (though Planning Roles will enforce a ‘named user’ license)

  • Licenses are assigned to users by the roles they are a member of
  • This means if a user wishes to consume more than 1 license then either:
    • They directly consume more than 1 role (like User J)
    • Or they consume roles indirectly through a team, as a team can be a member of one or multiple roles, even roles that consume different license types (like User K)
  • Users J and K both enjoy Analytics Hub and Business Intelligence licenses
  • Importantly! Like a role, a team does NOT define if the license is ‘concurrent’ or ‘named’
    • There is no concept of a ‘concurrent session team’ or ‘named user team’

How to apply Business Intelligence concurrent session licenses

  • How can a user consume a ‘concurrent session’ or a mix of Analytics Hub ‘named user’ and BI ‘concurrent session’ licenses (like User C and User G) ?
  • The property that defines if the ‘Business Intelligence’ license is ‘named user’ or ‘concurrent session’ is a user property
    • Access this user property on the ‘Security / Users’ screen, via the ‘Roles’

  • Simply change this property and press ok
    • There is no need to change the roles selected
    • There doesn’t even need to be any roles selected
        • since roles can be inherited via a team the user is a member of
  • The ‘Concurrent Session License’ setting is only remembered (respected) when:

    • There are no roles directly applied to the user (roles may be inherited instead via team membership)

    • Or, when any roles directly applied to the user are either Business Intelligence roles or Analytics Hub roles


  • The ‘Concurrent Session License’ setting is not remembered (not respected) when:

    • The user only has Analytic Hub roles assigned without any other roles assigned

    • The user has any Planning role assigned (Planning Standard or Planning Professional)


  • Means for the setting to be remembered, you will need to remove any Planning roles that are directly assigned to the user, if the user has such roles directly assigned

    • After making changes to a users role, you can check the license type that is accepted and assigned by re-opened the dialogue shown, it will show either ‘user license’ or ‘concurrent session license’

  • The property only changes the ‘Business Intelligence’ license between ‘named user’ and ‘concurrent session’, it has no impact on any other license

  • Can also use an API to programmatically change this user property:

Assigning Business Intelligence ‘Concurrent Session’ licenses and optionally combining with Analytics Hub ‘Named User’ licenses

  • There are 3 primary workflows for applying licenses to achieve this:
  1. Selecting a user and assigning roles directly to the user (via Menu-Security-Users)
  2. Selecting a role and assigning a role to 1 or many users/teams (via Menu-Security-Roles) then using workflow 1 to set the users’ concurrent setting
  3. Assign a default role and setting it as ‘default’ (Via Menu-Security-Roles-Role Configuration)

Workflow 1 – Security-Users

  • 1. Select Menu-Security-Users
  • 2. Click to open the ‘Select User Roles’ dialogue
  • 3. Select any Analytics Hub Role(s) and/or BI Role(s)
  • 4. Once you select the option ‘Concurrent Session License’ the dialogue will show a message: “An Analytics Hub role cannot be assigned as a Concurrent Session License. It will be assigned as a User License
  • This means
    • if any Analytics Hub role is assigned to the user, the user will consume an Analytics Hub ‘named user’ license
    • if any Business Intelligence role is assigned to the user, the user will consume a Business Intelligence ‘concurrent session’ license
      • The roles could be assigned directly to the user (as we are doing here), or indirectly via a team since a team can be a member of a role (see Best Practice later)
  • The user will consume an ‘Analytics Hub named user’ AND/OR a ‘Business Intelligence concurrent session’ license
  • You could, incorrectly think, any role you select here is a ‘Concurrent Session’ role. This is not the case. All you are doing is changing a user property, so the ‘Business Intelligence’ license is ‘concurrent session’ for that user.

Workflow 2 – Security-Roles

  • Assign ‘Analytics Hub Roles’ (if required):
  • 1. For the ‘Analytics Hub’ role, click ‘Assign Users’ to open the ‘Assign Role to User’ dialogue
    • The dialogue enables you to assign both users and teams

  • 2. Select the Teams and Users you wish to grant ‘Analytics Hub Named User’ licenses to
    • If assigning Users directly (User J) to an Analytics Hub Role any Business Intelligence license will be set as ‘named user’ but this is resolved in subsequent steps
      • i.e. the Business Intelligence license will be set to ‘named user’ even for those users that are already set as ‘concurrent’

  • 3. Press OK
    • At this point the users will be assigned the Analytics Hub ‘named user’ license

  • Assign ‘Business Intelligence Roles’:
  • 4. For the ‘Business Intelligence’ role, click ‘Assign Users’ to open the ‘Assign Role to User’ dialogue
    • The dialogue (with ‘User License’ selected by default) enables you to select both users and teams
    • The information “This role will be assigned to the selected members from both the User License and Concurrent Session License tabs.” is saying you can assign, to this role, both ‘Named User’ and ‘Concurrent Session License’ at the same time.

    • It means User F could be assign ‘Named User’ and User G could be assigned ‘Concurrent Session’ using this dialogue (and switching between the two radio buttons ‘user license’ and ‘concurrent session license’ as we shall see next) and following these steps 4, 5, 6 and 7


  • 5. Optionally, select Users you wish to have a Business Intelligence ‘Named User’ licenses (like for User F)
    • Users listed/selected will have/be assign the role and assigned a Business Intelligence ‘Named User’ license
    • The users listed will be users that already have a ‘Business Intelligence named user’ license assigned. You can still search for other users (that have a concurrent session license) and add them to the ‘Selected Users’. All ‘Selected Users’ will be assigned a ‘Business Intelligence named user’ license


  • 6. (Whilst still on the ‘User License tab’) Select the Teams you’d like to assign the ‘Business Intelligence’ role to:
    • Any Teams listed/selected does not change the Team memberships’ Business Intelligence licence type
    • i.e. it does NOT mean, Team members will be assigned a ‘Business Intelligence named user’ license
    • Team members could still be assigned a ‘Business Intelligence Concurrent Session’ license even though the ‘User License’ tab is selected after you press OK
    • You could, incorrectly think, any Teams you select are ‘named user’ teams. This is not the case. All you are doing on this tab, is specifying which users, by being a member of a Team, should consume a Business Intelligence Role. Teams you pick here do not impact the license type of users within those Teams, unless the users are directly selected as in step 5
    • At the end of this step, the users of the Team will not yet be assigned any particular Business Intelligence license. Their license is assigned in later steps, 9 to 12

  • 7. Select the ‘Concurrent Session license’ radio button
    • Only a list of users will be shown (and any users listed will be ones already assigned a concurrent license)
    • Teams will not be shown once ‘Concurrent Session License’ has been selected
  • 8. Select Users to be assigned a ‘Business Intelligence Concurrent Session’ license (like User J)
    • If you selected a User (under the ‘Concurrent Session License’) and a Team (under ‘User License’) where the User is also in the Team, the User will given a ‘Concurrent Session’ License. i.e. it requires the User to be specifically selected under the ‘Concurrent Session License’ tab for them to be assigned the ‘Business Intelligence Concurrent Session’ license

  • Steps 9 to 12 are to set the Business Intelligence license to ‘concurrent session’ for the following users:
    • Users in a Team, where the Team is a member of a Business Intelligence Role
    • Users NOT explicitly and directly assigned the Business Intelligence Role
    • i.e. Users like User K



  • 9. Select Menu-Security-Users
  • 10. For each user edit the ‘Roles’ to open the ‘Select User Roles’ dialogue
  • 11. Change the ‘Assign as:’ to ‘Concurrent Session License’
    • This changes only the ‘Business Intelligence’ license to concurrent session
    • There is no need to change the roles selected
    • There doesn’t even need to be any roles selected
  • 12. Press OK

Workflow 3 – Default Roles

  • 1. Select Menu-Security-Roles
  • Steps 2 to 5 are optional and only needed if you wish to assign Analytics Hub licenses
  • 2. Open the appropriate Analytics Hub Role
  • 3. Click on Role Configuration
  • 4. Optionally select ‘Use as Default Role’
    • This will means when a new user is created they will be assigned this Analytics Hub Role
  • 5. Optionally select ‘Enable Self-Service’
    • This means users who do not currently enjoy this Role, can request it and obtain it once approved

  • These steps are needed to assign Business Intelligence ‘concurrent session’ licenses
  • 1. Open the appropriate Business Intelligence Role
  • 2. Click on Role Configuration
  • 3. Select ‘Use as Default Role’
    • This will means when a new user is created they will be assigned this Business Intelligence Role
  • 4. For ‘Assign as:’ select ‘Concurrent Session License’
    • This will means when a new user is created they will be assigned the Business Intelligence ‘concurrent session’ license
  • 5. Optionally select ‘Enable Self-Service’
    • This means users who do not currently enjoy this Role, can request it and obtain it once approved. However this will not change the Business Intelligence license type for that user, their Business Intelligence license type will remain unchanged

Managing license gotcha’s

Gotcha’s for Workflow 2 (Menu-Security-Roles)

  • Assigning an Analytics Hub role directly to a user changes the Business Intelligence license type (‘Named user’ or ‘Concurrent Session’), if the user has one, to ‘Named user’
    • Unlike assigning an Analytics Hub role indirectly to a user via a Team

    • Or, if you like, assigning an Analytics Hub Role to a Team will not change any of the Teams’ members Business Intelligence license type (if they have one)

  • Removing the Business Intelligence Role, changes the license to ‘named user’:
    • If you remove the Business Intelligence Role from a user (either directly, or indirectly by removing the Team(s) they are a member of) from the Business Intelligence Role(s), then the user property about their ‘Business Intelligence’ license type (‘named’ or ‘concurrent’) will be changed to ‘named user’

    • There is no warning or indication when this occurs

  • Assigning a Planning role (standard or professional) directly to a user changes the Business Intelligence license type (‘Named user’ or ‘Concurrent Session’), if the user has one, to ‘Named user’
    • There is no warning or indication when this occurs
    • The user will be shown as consuming a ‘Planning Standard’ or a ‘Planning Professional’ license
      • This makes sense, since a Planning license can not be of type ‘concurrent session’, only Business Intelligence licenses can be
  • Removing all Planning Roles, changes the license to ‘named user’:
    • If you remove all the Planning Roles from a user (either directly, or indirectly by removing the Team(s) they are a member of), then the user property about their ‘Business Intelligence’ license type (‘named’ or ‘concurrent’) will be set to ‘named user’ and not ‘concurrent’
    • Any default role, regardless of how it is configured, does not change this

  • Analytic Hub Roles will not list users with a Business Intelligence ‘concurrent session’ license under ‘Selected Users’, even when they are granted the role!
    • The list will not list yourself as you cannot assign yourself a role

    • The number of users and teams will be correct but the number of users will exclude those users in Teams

Best Practice

General Best Practices for Managing Roles

For those not using a User Provisioning Solution:

  • Use a SAML2 Identity Provider (IdP) to declare which teams a user should be a member of
  • Consider enabling ‘dynamic user creation’ on SAP Analytics Cloud setup with the IdP
  • Map SAML2 User Attributes to SAP Analytics Cloud Teams
  • Use Teams to group roles together
  • If a user isn't assigned any Roles (directly or indirectly via a Team) the user will not consume a license
  • The users’ membership to Teams and Roles will be updated upon their next logon
    • Means changing the IdP users attribute for their Team/Role membership will only take effect upon the users next logon and not before
    • In turn, this means, any change to the license consumption is delayed until that point
      • Unless using the SCIM API, when updating the Teams/Roles assignment is immediate
      • If a user is deleted (or denied the SAP Analytics Cloud application) in the IdP, then the Team/Role assignment in SAP Analytics Cloud remains unchanged

  • If you need to assign Business Intelligence ‘concurrent session’ licenses then

    • Define a default role (workflow 3) and set it to switch the users license type to ‘concurrent’ at time of user creation

    • The default role will then be assigned directly to a user

    • This is only needed to enable the ‘default’ role to switch the license type at the time of user creation

    • Once the license type has been set correctly, there’s no reason to maintain this directly assigned role

    • The direct role assignment (dotted in diagram) can optionally be removed after the user has been created

    • Assign users to ‘other’ roles via team membership and do not directly assign other roles to the user


  • As all new users will be assigned Business Intelligence ‘concurrent session’ license you need to use workflow 1 for each user that should be assigned Business Intelligence ‘named user’:

    • In workflow 1 select ‘user license’ instead of ‘concurrent session’


    • However, there is no need to do this if any of these users are assigned a Planning Role, since Planning Roles includes a Business Intelligence ‘named user’ role automatically overriding any ‘concurrent session’ license setting. It makes no difference if the Planning Role is assigned directly to a user, or indirectly via a Team.

    • The planning role could be assigned via a ‘request role’ and if the request is approved, the license type for the user will change to ‘named’


  • Analytic Hub Roles:

    • Do not add Users directly into Analytic Hub Roles as this will change their Business Intelligence ‘concurrent session’ license to ‘named user’ (User J)

    • Only add Teams into Analytic Hub Roles (User K)

      • It makes no difference if you add the User to the Team first, or the Team to the Role first


  • Team membership can be the same for ‘named user’ and ‘concurrent session’


For those that are using a User Provisioning Solution:

  • Create users with the right ‘Business Intelligence’ license type to start with
    • Avoid creating users to then only update each users ‘Business Intelligence’ license type
  • Use Teams to group roles together
    • Assign users to teams, and assign teams to roles
    • There should be no need to assign roles directly to a user
  • Avoid the use of default roles and request roles
    • Most user provisioning solutions operate a pure ‘push’ model and will not want to read the current users’ role assignment before updating a user. It typically causes ‘roles’ to be dropped from a user since such solutions are not aware of which ‘default’ or ‘request’ roles where added to the user. Avoiding default roles and request roles resolves this problem. For more details please refer to the SCIM API best practices
    • This is especially true if you wish to update a users’ ‘Business Intelligence’ license type as the roles assigned to the user must be known at the time of updating the user
  • As mentioned before, if a user isn't assigned any Roles (directly or indirectly via a Team) the user will not consume any license


Summary – Switching Business Intelligence licenses

  • Actions that change a Business Intelligence license from ‘concurrent session’ to ‘named user’:

  1. Changing the user property via Security-Users-Roles-Assign As (Workflow 1)
  2. Adding the user directly to an Analytic Hub Role (via the user interface)
  3. Removing all Business Intelligence roles directly from a user (via the user interface)
  4. Granting the user any Planning Role (by any means – including via a request role)
  5. Using the SCIM API
  6. Using the Menu-Security-Users-Export and Import from file option
  • Actions that change a Business Intelligence license from ‘named user’ to ‘concurrent session

  1. Changing the user property via Security-Users-Roles-Assign As (Workflow 1)
  2. Assigning the user directly to an Business Intelligence role under the ‘Concurrent Session’ tab (Workflow 2)
  3. Defining a Business Intelligence Role as a default role and setting the ‘Assign As’ as ‘concurrent session’(only for new users) (Workflow 3)
  4. Using the SCIM API
  5. Using the Menu-Security-Users-Export and Import from file option
  • Other than the means above, there is no way to define a group of users to consume a Business Intelligence ‘concurrent session’ license
  • For those not using a user provisioning solution but require an automated means of assigning ‘concurrent session’ licenses use Workflow 3

Changing license type via SCIM API sample scripts

  • Sample scripts, written in Postman, provide a means to automate the update of users license type
  • These scripts are freely available with comprehensive user instructions and introduced via this blog which also shows a demonstration of sample script 451.
  • Sample script 401 reads a very simple .csv file and updates the users’ BI license type according to the ‘true’ or ‘false’ value as shown:

  • Sample script 451 reads a very simple .csv file and updates all the users of a team with the BI license type according to the entry in the file:

  • For example all members of Team1 will be assigned a ‘concurrent’ license type, whilst Team2 will be assigned named user


Changing license type via export/import users file

Using the Menu-Security-Users-Export and Import from file option (changing to concurrent)

  • Step 1: Select Menu-Security-Users
  • Step 2: Select ‘Export’ and open the csv file that is downloaded (doc link)
  • Step 3: Remove rows for users that you don’t wish to update
  • Step 4: Change the column ‘IS_CONCURRENT’ value from 0 to 1
    • for those users that you wish to assign a concurrent session license to users
    • You can update other columns, for example ‘ROLES’ to update which roles are directly assigned to the user
  • Step 5: Save the csv file you’ve just updated
    • Its important NOT to remove any columns from the file as these hold properties about the users profile
    • If these are lost, the user may find it a little annoying
  • Step 6: Select Import Users (doc link)
  • Step 7: Select Source File and select the csv file you saved in step 5
  • Step 8: Select Create Mapping and press OK
  • Step 9: Select Import

Best Practices with the file import option (step 6):

  • Update no more than around 1,000 users at a time
  • If you have 10,000 users, then split the file into 10 ‘chunks’ each of 1,000 users
  • Import each file, of 1,000 users, at a time
  • If you import more than ~3,000 users at a time, some users may not be updated
    • Continuous re-attempts of the import will eventually update all users
  • This best practice only applies to updating users, not for creating new users (where the best chunk size is ~10,000)


Using the Menu-Security-Users-Export and Import from file option (changing to named user)

  • Step 1: Select Menu-Security-Users
  • Step 2: Select ‘Export’ and open the csv file that is downloaded (doc link)
  • Step 3: Remove rows for users that you don’t wish to update
  • Step 4: Change the column ‘IS_CONCURRENT’ value from 1 to 0
    • for those users that you wish to assign a named user license to users
    • You can update other columns, for example ‘ROLES’ to update which roles are directly assigned to the user
  • Step 5: Save the csv file you’ve just updated
    • Its important NOT to remove any columns from the file as these hold properties about the users profile
    • If these are lost, the user may find it a little annoying
  • Step 6: Select Import Users (doc link)
  • Step 7: Select Source File and select the csv file you saved in step 5
  • Step 8: Select Create Mapping and press OK
  • Step 9: Select Import

Best Practices with the file import option (step 6):

  • Update no more than around 1,000 users at a time
  • If you have 10,000 users, then split the file into 10 ‘chunks’ each of 1,000 users
  • Import each file, of 1,000 users, at a time
  • If you import more than ~3,000 users at a time, some users may not be updated
    • Continuous re-attempts of the import will eventually update all users
  • This best practice only applies to updating users, not for creating new users (where the best chunk size is ~10,000)


Removing Concurrent Session Licenses altogether from the Service

Removing Concurrent Session Licenses altogether from the Service – Contact Change only

  • There is currently an issue that once, and after, the ‘concurrent session’ license has been removed from your SAP Analytics Cloud Service, the concurrent session license is still enforced for those users that had a ‘concurrent session’ license assigned to them. This issue is planned to be resolved with SAP Analytics Cloud Wave Version 2022.3
  • Such users will experience a ‘No Sessions Available’ error at the time of logon, assuming the limit has been reached
  • This issue will only happen when there has been a contact change
  • Either:
    • Request SAP to apply a workaround solution after the licenses have been removed, as described in KBA 3126413
    • Or, apply a workaround yourself before the licenses are to be removed
  • Your workaround is to change the Business Intelligence license type from ‘concurrent session’ to ‘named user’ for all users
    You can use either:
    • The file export/import method as described above
    • Or the SCIM API
  • If you choose to use the SCIM API, then sample scripts are available to do this task:

Removing Concurrent Session Licenses altogether from the Service – NEO to CF Migration

  • If your SAP Analytics Cloud Service is to be, or has been, migrated from the NEO platform to CF platform then:
  • After the migration, the users will retain their ‘concurrent session’ license and if the new instance of your SAP Analytics Cloud Service on CF does not have any concurrent licenses, then none of your ‘concurrent session’ users will be able to logon
  • Such users will experience a ‘No Sessions Available’ error at the time of logon, even if the concurrent session limit is not reached. This issue is planned to be resolved with SAP Analytics Cloud Wave Version 2022.3
  • Either:
    • Request SAP to apply a workaround solution after the licenses have been removed, as described in KBA 3126413
    • Or, apply a workaround yourself before the migration is performed
  • Your workaround is to change the Business Intelligence license type from ‘concurrent session’ to ‘named user’ for all users
    You can use either:
    • The file export/import method as described above
    • Or the SCIM API
  • If you choose to use the SCIM API, then sample scripts are available to do this task:

Special notes for Provisioning Solutions & using the SCIM API


  • The use of ‘default’ roles are best suited when user provisioning is performed either:
    • manually via the user interface
    • Or, using SAML SSO with dynamic user creation and optionally with mapping user attributes to teams
  • Once a Provisioning Solution or use of the SCIM API is introduced, then these ‘default’ roles and ‘request’ roles may become problematic:
    • Many provisioning solutions operate on a pure ‘push’ only model
    • Such solutions don’t perform a ‘GET/PUT’ pair but expect to issue a single PATCH request
    • Means that updating a user or a team can ‘undo’ its configuration (users license type or roles can be dropped)
    • Given PATCH is not currently available (though planned) a slight adaptation is necessary
    • To resolve problems updating a user (PUT /Users/{id}):
      • Avoid the use of ‘default roles’ and ‘request roles’ as these change the roles and concurrent license type after the user is created
    • Instead
      • Create the users without any role and with the right Business Intelligence user license
      • Assign the user to teams
      • Assign the teams to roles
      • (i.e. follow standard best practice)
      • All user POSTs and PUTs would need to set these

Frequently Asked Questions

  • Q. For Business Intelligence Roles, why are no Teams listed under the ‘Concurrent Session License’ tab
  • A. In short, there is no need to list them
    • The Teams are listed under the ‘User License’
    • Simply select the Team under the ‘User License’ tab instead
    • The Business Intelligence license type will not change for Users of those Teams you select (even though it is under the ‘User License’ tab), unless the user is directly selected
    • You can still assign a Team to a Business Intelligence Role and keep the users ‘concurrent session’ license setting  unchanged

  • Q. What Business Intelligence license will new users be assigned when defining Default Roles for Analytics Hub Role AND a Business Intelligence Role (and assigning the ‘concurrent session’)
  • A. They will be assigned the Business Intelligence ‘concurrent session’ license
    • It is using the actual interface, within Analytics Hub Role assignment, that causes an update of the Business Intelligence license type to change to ‘named user’, not the combination of the two roles

  • Q. Is there any difference, from a license perspective, between the different roles of the same License Type
  • A. No
    • The ‘BI Admin’ role consumes the same license as a ‘BI Content Viewer’ role
    • The same applies for all other license types
    • A user assigned a ‘BI Admin’ role, like any other Business Intelligence role can be assigned ‘concurrent session’ license type
  • Q. Is there something special about the ‘Admin’ Roles provided by the Service
  • A. No
    • Custom roles with all rights granted is the same as the ‘Admin’ Roles provided by SAP Analytics Cloud. There’s nothing special about them



  • Q. What license type will be consumed by the ‘System Owner’
  • A. None
    • The license for this user is ‘free’ and they will not consume any particular license
    • It has no impact on the number of named or concurrent session licenses consumed
    • They will be granted all rights across all available license types
    • The System Owner is also the only user that can edit the SAML configuration

  • Q. Why is the Business Intelligence User (Concurrent Session License) Count at 0
  • A. This is the real-time value and shows the number of concurrent users using the Service right now
    • It is not showing the number of users assigned a ‘concurrent session’ license, unlike all the other ‘named user’ licenses shown


  • Q. Can you assign more named-user licenses that you actually are entitled to
  • A. Yes.
    • When you assign named-user licenses to users you can exceed your license entitlement. However you are responsible to ensure you are compliant with your license entitlement, not SAP. It means you can technically add, and assign, as many named-user licenses as you please, but you are responsible for being out of compliance.
    • The screenshot above shows 6 Analytics Hub licenses have been assigned when there is only a license for 5.
    • You can add, and assign, as many Business Intelligence concurrent licenses as you please and still be compliant, because Business Intelligence concurrent licenses are enforced at the time of login, unlike named user licenses.

  • Q. How can I see which users are members of which Teams and Roles
  • A. There are two ways to achieve this
    • Option 1) use SAC Usage Content
      Option 2) use the Administration Cockpit
      Option 3) use the User and Team Provisioning API

    • Option 1: SAC Usage Content
      • Files-Content Network-Samples-SAC Usage ContentUser Information Page
      • Can see user per team, roles per team
      • Create your own widget for Teams per user:

  • Option 3: User and Team Provisioning API
    • The API can be called via the browser returning a json response
    • Use a JSON viewer chrome extension to make the json more readable
      See next slide for examples


    • API conforms to System for Cross-domain Identity Management (SCIM 2.0) specification

    • Please refer to the documentation for more information

    • Please refer to this blog that introduces Sample Scripts and Best Practices

 



  • Q. What happens when the concurrent session license limit is reached
  • A. When a user, that is defined with a ‘Business Intelligence concurrent session’ license, ties to log-on but when all available concurrent sessions have been consumed, the user will experience an error saying "No Sessions Available. All concurrent session licences on this system are in use. Please try to log on again later, or contact your system administrator to increase the number of available sessions."

  • Q. How do you un-assign licenses
  • A. Licenses are derived from the Roles assigned to users. These Roles can be assigned either directly or indirectly via a Team, since a Team can be a member of a Role
    • So, if you would like to unassign, say the Analytics Hub license, then you must stop the user from being assigned all Analytics Hub Roles. The same applies similarly for Business Intelligence and Planning licenses
    • Sample scripts:
      • 403 – updates a users’ team membership and can be used to remove users from all teams (just use an empty array [] with the action ‘replace’) –see FAQ
      • 1x2, 2x2, 4x9 – updates users and can be used to remove all roles directly assigned to a user (just use an empty array [] with the action ‘replace’)
  • Q. Is it possible to de-activate (suspend or disable) a user
  • A. Yes. A user can be de-activated (suspended or disabled) by using the SCIM API to change the users ‘active’ property from true to false
  • Once the property is set to false, any existing user sessions are immediately terminated and the user will not be able to login again until the setting is changed back to true. If they attempt to login they will observe this error message
    “StatusCode in ResponseMessage != OK; please refer to the database trace for more information”
  • Changing this users property ‘active’ makes no difference to the license consumption in anyway. A user, even with the ‘active’ property set to false, will still consume a license as they do when the property is true. If you have any concurrent session licenses, it makes sense to assign such de-activated users with a concurrent session license to free up named-user licenses
  • From a license perspective, the answer to this question is no
  • Related Sample scripts:
    • 402 – updates the active status for users
    • 452 – updates the active status for all the users of a team
    • 405 – updates the active status and the BI license type for users
    • 455 – updates the active status and BI license type for all the users of a team
    • Scenario L01 Managers with BIconcurrent to BInamed license
    • Scenario L02 Disabled users to BIconcurrent license


  • Q. How can I easily see which users are assigned which licence
  • A. To see a list of all your users and if they have a Business Intelligence ‘named user’ or ‘concurrent user’ assigned use the drop down in Menu-Security-Users
  • The export to csv does not limit the users to the license type selected, it only limits the users that are displayed


  • Q. How do you determine who uses SAP Analytics Cloud more frequently than others
  • A1. Generate a list of user login events with 'Menu-Security-Activities'. Filter on 'Activity-Login' and a time frame and export the list. The more login events per user shows they use the Service more frequently than others. The users that login most frequently would probably be worthy of a 'named user' license, whilst perhaps the others (using it less frequently) could be assigned a 'concurrent' license.
    • The list will not show users that have not logged-on during the time selected

  • Q. Can you use SAML attribute mapping to define which user license should be used
  • A. No. The SAML attribute mapping does not support the Business Intelligence license type the user should consume, it only supports mapping of roles and/or teams (in addition to the user id, email or custom attribute you’re using to identify the user by)
  • You can still use SAML attribute mapping with a default role (and have this default role configured so when the user is created, its set a ‘concurrent’ license)
  • Any SAML attribute mapping doesn’t directly impact or change the Business Intelligence license type property


  • Q. Is it possible to create a user, without any roles and without being a member of any teams, and still set the ‘Business Intelligence’ license type to ‘concurrent’
  • A. Yes. This is possible with both the user interface and the SCIM API
  • For those that wish to use the sample scripts, then all the sample scripts that create users can do this for you


  • Q. Can I have 2 ‘default’ roles
  • A. Yes. You can have as many default roles as you would like. It means when a new user is created, they will automatically be assigned all the default roles. If any one of those default roles is set to be of type ‘concurrent session’, then the users Business Intelligence license will be set as a ‘concurrent session’
  • In turn, this means you can’t have a default role for one type of user and a different default role for a different type of user


  • Q. Are Concurrent Session licenses available
  • Concurrent session licenses are no longer available to purchase. Please contact your SAP account representative for further information


  • Q. Is it possible to set the users’ ‘Business Intelligence’ license type to ‘concurrent’ even when the SAP Analytics Cloud Service doesn’t have any ‘concurrent session’ licenses
  • A. Yes, but only via the API and even then the user won’t be able to login, of course. They will still consume a license
  • The user interface prevents the ‘concurrent session’ from being shown in such cases so the user interface options will not enable you to make any changes to the users license type. This equally applies to default roles. The concurrent session option, in such cases, will not be available as an option to change the license type of the user when defining default roles


  • Q. Can a request role be set to switch the license type to concurrent
  • A. No. A request role, once approved, will mean the role is directly assigned to the user. There is no option, as part of the request role setup, to change the Business Intelligence license type
  • However, should the role be approved, and that request role is a planning role, then the Business Intelligence license type will be set as ‘named’. This means the Business Intelligence license type will have changed from ‘concurrent’ to ‘named’, if it was already set as ‘concurrent’
  • It means a Planning request role can be used to switch the license type from ‘concurrent session’ to ‘named’. Even if the Planning request role doesn’t actually need to have any rights assigned within it, the user will still be assigned and consume a planning license


  • Q. What happens when Concurrent User licenses are removed from the Service
  • A. From SAP Analytics Cloud version 2022.3, all users that currently have a ‘concurrent session’ license will be updated to have a ‘named’ license at the time the license is removed. It means you don’t need to make any changes
  • Until then, all concurrent users must be changed to ‘named’ to avoid problems for these users when they try to log-on. For more please see earlier in this article


  • Q. Can I export a list of users that have a Business Intelligence license type set to ‘concurrent’?
  • A, Yes.
    • Select Menu-Security-Users
    • To list users of ‘named user’ or ‘concurrent sessions’ use the drop-down option
    • Export the complete list and filter on IS_CONCURRENT, 1 means concurrent, 0 means named


  • Q. Why can’t I change the licenses assigned
  • A. The column ‘Licenses’ isn’t editable, its derived from the roles the user is a member of
  • Roles can be assigned directly or indirectly via a team through inheritance
  • A user inherits roles through Teams as well as Roles
  • A Team can be a member of multiple Roles
  • The roles shown in the Security-Users interface are roles directly assigned, not ones inherited via a team
  • Its typical for a user to only be assigned roles via Team membership, leaving this column blank


In general, please post your comments to the blog post that introduces this wiki page rather than directly here. Thank you

  • No labels