[doc issue] restricts access for non-administrator roles in managed subaccounts

[joegoerlich]

Issue description

A collection about what is the difference between regular and managed subaccounts would be highly appreciated.
On other pages, I found, for example, the limitation on API access for system mapping for POST methods with users having not the Administrator but the Associate Administrator or Subaccount Administrator role granted.

Feedback Type (Optional)

content gaps

Page Title on SAP Help Portal (prefilled)

Adding and Managing Subaccounts

Page URL on SAP Help Portal (prefilled)

https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/managing-subaccounts?locale=en-US&q=iaik

[Frank1Mueller]

Hi Joe,

thanks again for your feedback :)

We'll also look into this issue and get back to you soon.

Best regards

Frank

[Frank1Mueller]

Hi Joe,

Thanks a lot for this valuable contribution as well :)

Basically, the only difference between a standard (non-managed) subaccount and a managed subaccount is just as described: in a managed subaccount, only the Administrator role (default: sccadmin) has full configuration rights (create, update, delete operations) for this subaccount, while the (recently introduced) roles Associate Administrator (sccassocadmin) and Subaccount Administrator (sccsubadmin) have only restricted rights in this case.
The same applies to REST API operations accordingly: for (managed) subaccount-related APIs: only an Administrator can perform POST, PUT, and DELETE tasks. As you mention above, this is stated in the documentation for the respective APIs.

To be more clear about this difference, we have now added the following note to the topic Adding and Managing Subaccounts:

"In a managed subaccount, only the Administrator role (default: sccadmin) can change the configuration of a single subaccount, while in a standard (non-managed) subaccount also the roles Associate Administrator (sccassocadmin) and Subaccount Administrator (sccsubadmin) are allowed to do so.

For more information on role definitions, see also Use LDAP for User Administration.

The same applies for changes in the subaccount configuration via REST API: In a managed subaccount, only the Administrator role can perform POST, PUT, and DELETE tasks. GET tasks are not restricted.

For detailed information, see User Roles and the subaccount-related APIs in Configuration REST APIs."

Best regards

Frank