In Public Cloud you generally can’t put the system behind your own VPN the way you would with an IaaS/private landscape. SAP manages the environment and network edge, so you don’t get a customer-controlled network firewall/VPN termination in front of the tenant
IP-based restriction directly in SAP Cloud Identity Services (IAS) using Risk-Based / Conditional Authentication. IAS supports policies that can use IP ranges as conditions for allow/deny or step-up
SAP community guidance for Public Cloud calls out using IP-range risk-based authentication for this kind of restriction
If the requirement is users must be on company network implement:
Corporate IdP Conditional Access (preferred, centralized) or
IAS Risk-Based/Conditional Authentication with IP allowlist + default denny and require VPN for offsite users so their egress IP matches the allowed range
Bluesky
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.