Comprehensive and Detailed Explanation

Authorization flow in SAP BTP:

Scopesare defined in XSUAA.

Scopes are grouped intorole templates.

Role templates becomerolesin the subaccount.

Roles are assigned tousers.

Role collections group roles for easier assignment.

If a user cannot access an app:

The most common cause is:

C – Roles aren’t assigned to the user

Without receiving the required role, the user’s JWT tokendoes not contain the required scopes.

Even if:

Scopes exist

Role templates exist

Role collections exist

…the user mustexplicitlyhave the role (or role collection) assigned.

Why the Others Are Incorrect:

A:Client applications don’t require role assignments.

B:Role collections may be assigned, butroleassignment is the critical missing piece in this scenario.

D:Client applications do not need role collections.