---
title: "Choosing the Identity Mode"
description: "Named user (SAP applies each person's authorizations) or integration user (SAP applies the communication user's, MDM's roles are the boundary), and the background opt-in between them."
source: "https://help.rikaiso.com/public-cloud/2026.2/identity-mode"
edition: "public-cloud"
editionLabel: "S/4HANA Public Cloud"
version: "2026.2"
latest: true
language: "en"
section: "Information for Administrators > Completing the Destinations in SAP BTP"
updated: "2026-11-05"
---

# Choosing the Identity Mode

> Named user (SAP applies each person's authorizations) or integration user (SAP applies the communication user's, MDM's roles are the boundary), and the background opt-in between them.

> **Draft brief for authors.** Replace with the final text; keep the concept-page structure. Include the decision table.

**Page type:** Concept · **Audience:** Administrator, Security officer

**Contains**

- Mode A, named user (destination with user propagation): SAP applies the person's authorizations to every change and its change documents show the person; MDM checks the user with SAP before a run; a background run pauses when the sign-in expires; such a table cannot be scheduled; integrations without a person cannot process it.
- The background opt-in (`rikaiso.backgroundIdentity = technical-user`): the person is still checked with SAP, the records of a background run are written by the communication user; scheduling and automatic resume work; what the check does not cover (per-object restrictions), whom the change documents show.
- Mode B, integration user (communication user): SAP applies the communication user's authorizations; MDM's roles and add-ons are checked first and fail closed; the history records the person; what to do (restrict the arrangement, separate users per scope, grant roles narrowly).
- Decision table and what belongs in your security concept.

**Related information:** `application-destination`, `concept-identity`, `custom-role-collections`, `sap-business-users`.

**Source in the product repository:** customer guide §3 and §5; `srv/lib/sap-identity.js` (D26, D80).