SAP Customer Identity and Access Management (SAP CIAM), formerly Gigya and SAP Customer Data Cloud, is a multi-tenant SaaS customer identity platform on SAP Business Technology Platform. It covers registration and login (password, social, passwordless with FIDO passkeys, phone, email OTP, and magic links), two-factor and risk-based authentication, consent and preference management, and B2B contact and partner management. SAP CIAM can act as an OpenID Connect provider (authorization code, implicit, hybrid, client credentials, device, and token exchange flows) and relying party, and as a SAML identity provider and service provider. Sites are hosted in United States, European Union, Australian, or Chinese data centers, with global site groups for cross-region SSO. Pricing is subscription-based per block of 10,000 monthly active users, with optional enhanced security and consent add-ons.
Features
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for SAP CIAM’s OpenID Connect protocol compatibility? View SAP CIAM on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does SAP CIAM support Username and Password authentication method?
SAP CIAM supports Username and Password authentication method. Login, registration, and password management are included in the B2C Core plan. Read more
Does SAP CIAM support Social Sign-in authentication method?
SAP CIAM supports Social Sign-in authentication method. Social Login lets users identify with their social networks; custom OpenID Connect and SAML providers can also be added as login buttons in screen-sets. Read more
Does SAP CIAM support Passkey authentication method?
SAP CIAM supports Passkey authentication method. FIDO authentication is offered as a passwordless login method on mobile devices and common desktop browsers; the accounts.auth.fido.login method supports conditional mediation for discoverable credentials. Read more
Does SAP CIAM support Email Passwordless authentication method?
SAP CIAM supports Email Passwordless authentication method. Email OTP login sends a one-time code to the user by email; it requires email as the site login identifier. Read more
Does SAP CIAM support Phone Passwordless authentication method?
SAP CIAM supports Phone Passwordless authentication method. Phone Number Login provides passwordless authentication with a one-time code sent to the mobile phone; an SMS provider must be configured. Read more
Does SAP CIAM support Magic Link authentication method?
SAP CIAM supports Magic Link authentication method. Magic Link login emails a link that signs the user in; it is driven by the accounts.auth.magiclink.email.send and login APIs and requires a trusted landing page URL and a magic link email template. Read more
Does SAP CIAM support Time-based One-Time Password (TOTP) MFA?
SAP CIAM supports Time-based One-Time Password (TOTP) MFA. An authenticator app can be enabled as a two-factor verification method in the console, and selected through risk-based authentication rules. Read more
Does SAP CIAM support Email Code MFA?
SAP CIAM supports Email Code MFA. After the login and password are entered, a code is sent by email to complete two-factor authentication. Read more
Does SAP CIAM support Phone Code MFA?
SAP CIAM supports Phone Code MFA. After the login and password are entered, a code is sent by SMS or voice message to complete two-factor authentication; an SMS provider must be configured. Read more
Does SAP CIAM support Push Notification MFA?
SAP CIAM supports Push Notification MFA. Push authentication is a verification method that requires a configured Firebase application and a push-based risk-based authentication rule set. Read more
Does SAP CIAM support Adaptive / Risk-Based MFA MFA?
SAP CIAM supports Adaptive / Risk-Based MFA MFA. Risk-Based Authentication rules decide which verification method (email, phone, TOTP, or push) applies to a session, and can trigger reCAPTCHA based on a risk score. Read more
Does SAP CIAM support Step-Up Authentication MFA?
SAP CIAM partially supports Step-Up Authentication MFA. Two-factor verification is documented for both user logins and profile updates, with the method driven by the auth level of the configured risk-based authentication rules. Read more
Does SAP CIAM support OpenID Connect (OIDC) integration protocol?
SAP CIAM supports OpenID Connect (OIDC) integration protocol. The platform can act as an OpenID Connect provider (authorization code, implicit, and hybrid flows) and as a relying party for third-party providers. Read more
Does SAP CIAM support SAML 2.0 integration protocol?
SAP CIAM supports SAML 2.0 integration protocol. The web browser SSO profile is supported with HTTP POST and HTTP Redirect bindings; the platform can act as a SAML identity provider for any number of service providers, or as a SAML service provider. Read more
Does SAP CIAM support Machine-to-Machine (M2M) Authentication integration protocol?
SAP CIAM supports Machine-to-Machine (M2M) Authentication integration protocol. The OIDC provider supports the client credentials grant, and server-to-server REST calls can use OAuth 2.0 access tokens. Read more
Does SAP CIAM support OpenID Connect (OIDC) Federation identity federation?
SAP CIAM supports OpenID Connect (OIDC) Federation identity federation. The site can be configured as an OIDC relying party to authenticate users through third-party OpenID Connect providers. Read more
Does SAP CIAM support SAML 2.0 Federation identity federation?
SAP CIAM supports SAML 2.0 Federation identity federation. The platform can act as a SAML service provider for external identity providers, and as a SAML identity provider for external service providers. Read more
Does SAP CIAM support User Account Linking user management?
SAP CIAM supports User Account Linking user management. Identities can be linked through the accounts.linkAccounts API and by adding connections for social, SAML, and OIDC identities when multiple identities are allowed by policy. Read more
Does SAP CIAM support Organizations (Multi-Tenancy B2B) user management?
SAP CIAM supports Organizations (Multi-Tenancy B2B) user management. CIAM for B2B manages businesses, their members, and the relationships between them, with a group model that can be managed in the console. Read more
Does SAP CIAM support Progressive Profiling / Forms user management?
SAP CIAM supports Progressive Profiling / Forms user management. Progressive Profiling is documented as a Customer Identity capability for gathering first-party profile data over time. Read more
Does SAP CIAM support Fine-Grained Authorization (FGA / ReBAC) access control?
SAP CIAM supports Fine-Grained Authorization (FGA / ReBAC) access control. CIAM for B2B provides fine-grained authorization based on smart policies, combined with authentication and identity management. Read more
Does SAP CIAM support API Authorization (Scopes / Permissions) access control?
SAP CIAM partially supports API Authorization (Scopes / Permissions) access control. Permission scopes (prefixed perm:) can be assigned per OIDC relying party to control which Customer Data Cloud API endpoints an access token may call, limited to the platform's own account APIs. Read more
Does SAP CIAM support Security Center (Threat Monitoring Dashboard) security feature?
SAP CIAM supports Security Center (Threat Monitoring Dashboard) security feature. The enhanced option adds a centralized security dashboard alongside AI/ML-based security and account takeover detection. Read more
Does SAP CIAM support Bot Detection security feature?
SAP CIAM supports Bot Detection security feature. Google reCAPTCHA v2 (invisible and checkbox), v3 as a risk-based authentication rule, and reCAPTCHA Enterprise are supported to block automated attacks. Read more
Does SAP CIAM support Brute Force Protection security feature?
SAP CIAM partially supports Brute Force Protection security feature. A CAPTCHA challenge is required once the failed-login threshold set in the site policy is reached; broader lockout behavior is not described. Read more
Does SAP CIAM support Breached Password Detection security feature?
SAP CIAM supports Breached Password Detection security feature. Passwords are validated against the Have I Been Pwned database to detect or block compromised passwords, enabled in the console password settings. Read more
Does SAP CIAM support Hosted / Universal Login Page branding feature?
SAP CIAM supports Hosted / Universal Login Page branding feature. Hosted Pages provide login, registration, and device registration pages backed by screen-sets, including a central login page. Read more
Does SAP CIAM support Embedded / Native Login Components branding feature?
SAP CIAM supports Embedded / Native Login Components branding feature. The Web SDK renders screen-sets inside a container on the site's own pages. Read more
Does SAP CIAM support Prebuilt UI Components (SDK) branding feature?
SAP CIAM supports Prebuilt UI Components (SDK) branding feature. Default screen-sets such as Default-RegistrationLogin are provided out of the box and can be customized in the UI Builder. Read more
Does SAP CIAM support Consent Management compliance?
SAP CIAM supports Consent Management compliance. Customer Consent captures and versions consent and preferences, with audit-ready records; the consent option adds unlimited terms of service and privacy policies, subscription and communication preference management, and a 7-year audit vault. Read more
Does SAP CIAM support Region Deployment compliance?
SAP CIAM supports Region Deployment compliance. Sites are created in the United States, European Union, Australia, or China data centers, with user data stored in the data center of the site; global site groups store user data by residency. Read more
Does SAP CIAM support SDK Coverage developer integration?
SAP CIAM supports SDK Coverage developer integration. A JavaScript Web SDK and REST APIs are provided; native mobile use is also documented. Read more
Does SAP CIAM support Management API developer integration?
SAP CIAM supports Management API developer integration. The Accounts REST API and the FIdM OIDC REST APIs cover account management and OIDC provider and relying party configuration. Read more
Does SAP CIAM support Custom Domain developer integration?
SAP CIAM supports Custom Domain developer integration. A CNAME with SSL can be set up so that login pages and redirect URIs use the customer's own domain. Read more
Does SAP CIAM support Universal Login / Hosted Login Page Customization developer integration?
SAP CIAM supports Universal Login / Hosted Login Page Customization developer integration. Login and registration screens are customized through screen-sets and hosted pages. Read more
Does SAP CIAM support Email Templates developer integration?
SAP CIAM supports Email Templates developer integration. Email templates, including the magic link template, and SMS templates can be configured in the console. Read more
Does SAP CIAM support Custom OIDC Claims / Token Enrichment developer integration?
SAP CIAM supports Custom OIDC Claims / Token Enrichment developer integration. When acting as an OIDC provider, group information from the group and relationship schemas can be mapped into the OIDC settings, and custom scopes such as perm: scopes are supported. Read more
Does SAP CIAM support Identity Verification / Document Proofing feature?
SAP CIAM supports Identity Verification / Document Proofing feature. ID verification is included in the B2C Core plan. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.