---
title: "Identity Provider, Single Sign-On and Sign Out"
description: "Users sign in through your subaccount's identity provider; map its groups to role collections; Sign Out ends the session in MDM, the subaccount and the provider."
source: "https://help.rikaiso.com/public-cloud/2026.2/identity-provider"
edition: "public-cloud"
editionLabel: "S/4HANA Public Cloud"
version: "2026.2"
latest: true
language: "en"
section: "Information for Administrators > Users, Roles and Role Collections"
updated: "2026-11-05"
---

# Identity Provider, Single Sign-On and Sign Out

> Users sign in through your subaccount's identity provider; map its groups to role collections; Sign Out ends the session in MDM, the subaccount and the provider.

> **Draft brief for authors.** Replace with the final text; keep the task-page structure.

**Page type:** Task · **Audience:** Identity administrator

**Contains:** the trust between the subaccount and your identity provider (SAP Cloud Identity Services or another OpenID Connect provider); groups mapped to role collections; the e-mail address as the key that user propagation to SAP relies on; what Sign Out ends; sessions of AI clients.

**Related information:** `custom-role-collections`, `sap-business-users`, `security-and-data-protection`.

**Source in the product repository:** `docs/identity-architecture.md`, customer guide §4a.