SAP Community - SAP BTP Security

User is unable to login to SAP Build Work Zone due to "Subaccount reached its limit" message

2026-02-24T11:45:03.342000+01:00

Hello,

I'm having an issue where our developer team is unable to login to the SAP build work zone free version. The error they are getting is - " Subaccount reached its limit. Unfortunately, we couldn't log you in because your subaccount has reached the maximum limit of a free plan. A free plan is restricted to 20 named users and 2 admin users per month per subaccount ".

My doubts are as below regarding this: -

1. Can we restrict this admin access on role collections level from security side? Please advise how this can be done

2. Can this error be reset within the day? Cause our developer team needs to check an issue.

Regards,

Arpit

SAP Security

Security breaches in FTP - SAP Communication

2026-02-27T12:55:55.268000+01:00

Hi,

I am looking for help on a partner question. If security breaches are discovered on BTP:

how are SAP are resolving them and what happens if a security issue appears, that involves customer actions?
how are we communicating them to partners? Is it only via the Monthly Security Patch Day & SAP Security Notes?
do we have any document or whitepaper explaining the process?

Thanks

Sheena

XSUAA not getting the subject name identifier as ID

2026-03-11T07:57:57.377000+01:00

Hi,

We're trying to change `req.user.id` used from xsuaa to the User ID of IAS instead of the email.

BTP is connected to IAS with OpenID Connect (so "Default Name ID Format = Unspecified" as with SAML is not available).

In the IAS logs the sub is changed to the expected value `jwtPayload="{"sub":"`.

However the req.user.id we get in CAP / JWT token remains the email.

Not sure if it's related, but adding a custom atribute in `xs-security.json` and in IAS attributes also isn't reflected in `req.user.attr`. (it only shows the default value configured in `xs-security.json`)

Anyone have some insights on how to get the id ?

SCIM3 PATCH API returning 403 Forbidden in SAP Analytics Cloud (GET works, Admin access available)

2026-03-23T06:33:35.378000+01:00

Hi folks,

I am facing an issue while using the SCIM3 API in SAP Analytics Cloud to update team members using PATCH operation.

API Details

Endpoint:

PATCH /api/v1/scim3/Groups/<TEAM_UUID>

Authentication:

Authorization Bearer Token

Headers Used

Authorization: Bearer <access_token>
x-csrf-token: <csrf_token>
x-sap-sac-custom-auth: true

Payload

"schemas": [
            "urn:ietf:params:scim:api:messages:2.0:PatchOp"
        ],
        "Operations": [
            {
                "op":"add",
                "path":"members",
                "value":[
                    {
                        "value":"d0bbac78-776890-9876hjmd",
                        "type":"User",
                        "display":"newuser",
                        "$ref":"/api/v1/scim3/Users/d0bbac78-776890-9876hjmd"
                    }
                ]
            },
            {
                "op": "replace",
            "path": "urn:ietf:params:scim:schemas:extension:sap:2.0:Group:description",
            "value": "patch test"
            }
        ]

Issue

The PATCH request consistently returns:

{
"status": 403,
"error":"Forbidden"
}

Observations

GET operations on /api/v1/scim3/Groups are working successfully.
Team UUID is retrieved correctly.
Team type is userGroup.
I have full admin access (BI_Admin role) in SAP Analytics Cloud.
OAuth Client is configured with API access with App Integration.
CSRF Token is fetched and passed correctly.
when CSRF token is removed, the API returns 401 Unauthorized.
PATCH always returns 403 Forbidden.

Questions

Are there additional permissions required specifically for SCIM3 PATCH operations ?
Does the OAuth client require explicit SCIM provisioning(write) permissions?
Are there any tenant-level restrictions for SCIM3 write operations ?

Attachments

PATCH request (headers + payload)

Response (403 Forbidden)

Any guidance would be helpful

Thanks!

Transactions in identity lifecycle management

2026-04-08T14:13:18.197000+02:00

I am new to SAP, and I have a question re this picture in one of the courses:

The best practice in cryptography is to rely on stateless workflows. That is, at the time of authentication an identity provider would issue e.g., a JWT with all authorizations for resources the user is entitled to. The token could then be used in OAuth/ zero-trust environment for transparent access to the SAP cloud on the right-hand side. I would imagine the green arrow "Identity Lifecycle Management" only injects public keys a JWT would be verified against. But because those keys are public, they would usually be pulled from PKI whenever needed, so the push model (injection) is superfluous. I suspect my understanding could be wrong - if someone could please clarify? Is this authentication/authorization workflow a common place among Cloud foundry, ABAP, and Kyma? Maybe you could point me out to a good online course for this?

Support Needed: OAuth2 SAML Bearer Destination connection to Successfactor Issue in SAP BTP

2026-04-10T09:03:17.346000+02:00

Dear Connections,

I’m reaching out regarding an issue we are currently facing with the OAuth2.0 SAML Bearer Assertion destination setup in SAP BTP for establishing a connection with SuccessFactors.

Background

We are working on integrating our CAP-based application deployed on SAP BTP with SuccessFactors using a destination configured with OAuth2SAMLBearerAssertion authentication.

Current Status

The destination works successfully with Basic Authentication
However, when switching to OAuth2.0 SAML Bearer Assertion, the connection fails

Error Details

We are encountering the error:
“No user token (JWT) has been provided. This is strictly necessary for 'OAuth2SAMLBearerAssertion'.","stacktrace":["Error: No user token (JWT) has been provided. This is strictly necessary for 'OAuth2SAMLBearerAssertion'."”

What We Have Verified

Destination is correctly configured in BTP
OAuth client is created in SuccessFactors
JWT token is available and being passed from CAP (via request headers)
User attributes (logonName) are available in the request context
CAP application is correctly bound to XSUAA and Destination services

Suspected Areas

OAuth configuration mismatch
Certificate/trust configuration between BTP and SuccessFactors
SAML assertion generation issues via XSUAA

Request

Since this setup involves multiple components (CAP, XSUAA, Destination service, and SuccessFactors), I wanted to check if anyone have experience with similar OAuth2 SAML Bearer configurations in BTP.

It would be really helpful if you could:

Suggest any checks or troubleshooting steps we might be missing

CAPM Code:

const { executeHttpRequest } = require("@sap-cloud-sdk/http-client");

const { getDestination } = require('@sap-cloud-sdk/connectivity');

module.exports = async function (request) {

let payload = request.data;

oLogger.info("Workflow Payload: " + JSON.stringify(payload));

const workflowPath = `odata/v2/upsert?workflowConfirmed=true`;

oLogger.info("Workflow Path: " + workflowPath);

payload["__metadata"] = { "uri": "Position" };

const destination = await getDestination({

destinationName: "sfAdminDestination",

userJwt

});

const workflowRes = await executeHttpRequest(

destination,

{

method: "POST",

url: "odata/v2/upsert?workflowConfirmed=true",

data: payload,

headers: {

"Content-Type": "application/json",

"Accept": "application/json"

}

);

}
Thanks in advance for your support.

I am SAP security consultant , now I want to learn BTP , how should I prepare ?

2026-04-11T03:10:31.824000+02:00

Hello all

I am SAP security consultant, I want to learn BTP, how should I start? Where will I get material and how should I prepare ?

Agentic AI in SAP Landscapes: The Next Identity & Authorization Risk Frontier

2026-04-20T13:22:51.261000+02:00

The adoption of agentic AI across SAP BTP, SAP AI services, and enterprise integrations is introducing a new class of identity risk—one that traditional SAP authorization models were never designed to handle.

At the center of this shift is Agent Identity & Credential Exposure, driven by the rapid expansion of Non-Human Identities (NHIs) across SAP and non-SAP orchestration layers.

The Architectural Mismatch in SAP Environments

Modern SAP AI-driven architectures (e.g., SAP AI Core, automation agents, integration flows) are generating a growing identity surface:

Technical users in SAP S/4HANA
Communication users in SAP BTP
OAuth clients and service keys
API tokens in SAP Integration Suite
Destination service credentials
RFC users and background jobs

These identities are often:

Long-lived
Over-provisioned
Poorly governed across lifecycle

Where the mismatch happens

SAP’s traditional authorization model is built around:

Human users (business roles via PFCG roles)
Static authorization objects
Clearly defined transactions and scopes

However, agentic AI introduces:

No human-triggered execution context
Dynamic, multi-step workflows across systems
Runtime decision-making and tool chaining

Resulting Gap

Agents frequently:

Inherit technical user credentials or OAuth tokens
Operate with broad composite roles
Execute across multiple SAP systems without re-authorization

These credentials are then:

Passed through integration flows
Used across APIs and destinations
Embedded into orchestration logic or memory layers

…without re-validation of authorization scope.

NHI Sprawl in SAP Landscapes

This leads to a new class of SAP-specific identity risk:

Explosion of technical users across S/4, BTP, and integrations
Service keys and OAuth clients without ownership
Credentials embedded in: iFlows (Integration Suite) Destinations CI/CD pipelines AI orchestration layers

Key Characteristics

Long-lived RFC and API users
Overloaded roles (SAP_ALL-like risk patterns)
Lack of traceability between agent → action → business context

Attacker Perspective: Exploiting SAP Identity Weakness

Attackers don’t need to compromise SAP core directly.

They target the weakest integration or agent boundary.

Entry Points

Compromised SAP Integration Suite iFlow
Misconfigured BTP destination
Exposed service key or OAuth client
Prompt injection via AI retrieval (documents, knowledge bases)

Once inside:

A single technical user may have: Cross-module access (FI, MM, HR) Read/write across business data
Shared credentials mask identity: All actions appear as one “technical user”

Advanced SAP-Specific Attack Paths

Extracting credentials from: Integration logs CPI traces Application logs in BTP
Leveraging over-authorized roles: Triggering unintended transactions (e.g., mass data extraction)
Moving laterally across: S/4HANA → BTP → external APIs

Illustrative SAP Scenario

An AI agent on SAP BTP is orchestrating a workflow:

Uses a destination to connect to S/4HANA
Authenticates via a technical communication user
That user has broad access via composite roles

A sub-agent:

Inherits the same credentials
Processes data retrieved from a document store

A prompt injection occurs via retrieved content.

Outcome

Agent executes unintended API calls
Extracts sensitive business data (e.g., financial records, vendor data)
Data is pulled from CDS views or APIs
Activity appears as legitimate system behavior

No clear trace to which agent or task triggered the action.

Impact in SAP Context

Exposure of sensitive ERP data (FI, HR, supply chain)
Violations of SoD (Segregation of Duties) principles
Compliance breaches (GDPR, SOX)
Audit gaps due to shared technical identities
Complex forensic investigations across SAP + BTP

Mitigation: Re-Architect Identity for SAP AI

1. Per-Agent Identity in SAP

Assign unique identities per agent: Separate OAuth clients in BTP Distinct communication users in S/4
Avoid shared technical users
Enable traceability: Agent → Action → System

2. Task-Scoped Authorization (Critical for SAP)

Replace static roles with: Task-based access (least privilege)
Avoid: SAP_ALL Broad composite roles

Instead:

Generate dynamic, minimal authorization scopes per API/task
Use short-lived tokens for each interaction

3. Modernize SAP Authentication Patterns

Move away from static credentials:

Use OAuth 2.0 Client Credentials with scoped access
Implement Workload Identity Federation (BTP)
Avoid storing credentials in: Destinations iFlows Code repositories

4. Govern Technical Users & NHIs

Maintain real-time inventory of: Technical users (SU01) OAuth clients Service keys
Enforce: Short-lived credentials Automated rotation Immediate revocation

5. Strengthen Secret Management

Use secure vaults (e.g., BTP credential store)
Prevent secrets from appearing in: Logs (SLG1, CPI logs) AI prompts or memory
Enforce strict rotation policies

6. Enforce Authorization Context in SAP

Map agent actions to: Business roles Authorization objects
Ensure: No execution without explicit context
Align with Zero Trust principles

7. Monitoring & Detection Across SAP + BTP

Enable: Audit logs (S/4, BTP) Integration monitoring
Detect anomalies: Unusual API volume Cross-module access patterns Unauthorized data extraction

SAP-Aligned Maturity Model

Tier 1 — Foundational

Clean up technical users
Remove SAP_ALL access
Enforce least privilege (PFCG roles)
Secure destinations and service keys

Tier 2 — Hardening

Task-scoped OAuth in BTP
Continuous discovery of technical identities
Monitoring across Integration Suite + S/4

Tier 3 — Advanced

Agent-specific identities with cryptographic trust
Full traceability across SAP landscape
Elimination of shared credentials
Dynamic authorization aligned to runtime context

Closing Perspective

SAP landscapes were not designed for autonomous agents operating across:

Systems
APIs
Business processes

Applying traditional SAP authorization models to agentic AI leads to:

Over-privileged technical users
Invisible identity propagation
Undetectable cross-system risks

The future of SAP security will depend on:

Containing NHI sprawl
Enforcing task-level authorization in SAP
Integrating identity across S/4, BTP, and AI layers

IAS App-to-App Navigation Failing: UI5 AppRouter → CAP Node.js via Destination

2026-04-22T13:48:38.036000+02:00

Hi experts,

I’m trying to implement SAP Cloud Identity Services (IAS / AMS) based authentication between two separately deployed BTP applications (MTAs), but the token exchange from UI5 AppRouter to CAP backend keeps failing.

I’d appreciate guidance on whether my architecture is valid, and what configuration I may have missed.

Landscape

Application A (Consumer)

UI5 frontend with standalone AppRouter

Deployed in BTP Cloud Foundry
Uses IAS login
Calls backend via Destination Service

Application B (Provider)

CAP Node.js service

Separate MTA
Protected by IAS / AMS
Has provided-apis configured

Expected Flow:

User
→ UI5 AppRouter
→ Destination (IASDependencyName)
→ AppRouter exchanges token
→ CAP backend receives exchanged token
→ CAP authorizes user

Current Destination Setup

Name: CAP_AMS_BACKEND
Type: HTTP
Authentication: NoAuthentication
URL: https://<cap-service-url>

Additional Properties:
HTML5.IASDependencyName = cap-ams //setup in IAS

I have also tried with destination type = oAuth2UserTokenExchange but got the same 401 error. Error screenshot below. Looks like the destination service client Id is the caller to IAS for token exchange but IAS is rejecting the audience.

UI5 App xs-app.json

{
  "welcomeFile": "/index.html",
  "authenticationMethod": "route",
  "routes": [
    {
      "source": "^/odata/(.*)$",
      "target": "/odata/$1",
      "destination": "CAP_AMS_BACKEND",
      "authenticationType": "ias"
    },
    {
      "source": "^(.*)$",
      "localDir": "resources",
      "authenticationType": "ias"
    }
  ]
}

CAP App ias instance

UI5 App ias instance

Dependency set on Consumer --> Provider App in IAS

All the grant types are selected in the provider and the consumer app for testing

What I Want to Confirm:

Is this architecture officially supported? Standalone UI5 AppRouter (MTA A) calling separate CAP Node.js app (MTA B) via destination using IAS App-to-App navigation?
Should this work using only:
Authentication = NoAuthentication / oAuth2UserTokenExchange
HTML5.IASDependencyName = <dependencyName>
Should both apps share the same IAS instance, or is separate IAS instance + dependency the correct model?
Has anyone implemented this successfully with CAP Node.js?

Thanks in advance,

Deepak

Unable to View Subaccount in BTP Cockpit After CIS Trust Setup (403 – Global Account Undefined)

2026-04-23T07:24:47.090000+02:00

Hi Experts,

I am facing an issue accessing a BTP subaccount when logging in via SAP Cloud Identity Services (CIS), even though trust and role assignments are in place.

Setup details:

Trust configured between CIS tenant and SAP BTP Global Account (for platform users)
Login performed using the BTP cockpit URL with https://amer.cockpit.btp.cloud.sap/cockpit/?idp=<CIAS_TENANT>
Platform user:
- Successfully authenticates via CIS
- Added to the target subaccount
- Assigned Subaccount Viewer role collection

Issue observed:

After login, the BTP cockpit shows:
- “Global Account: undefined – Account Explorer”
- 403 error: “Could not load global account”
No global account, directories, or subaccounts are visible

Based on the role assignment, at least read-only access to the subaccount was expected.

You can refer below image

Questions:

Are there any mandatory Global Account–level role collections (e.g. Global Account Viewer / Directory Viewer) required for CIS-authenticated platform users to see subaccounts?
Is there any additional setup or user assignment step required beyond:
- CIS trust configuration
- Subaccount role collection assignment?

Any guidance or pointers on missing prerequisites or common pitfalls for CIS + BTP cockpit access would be helpful.

Thanks in advance.

403 ForbiddenThe request has been blocked by UCON

2026-04-24T00:01:14.504000+02:00

Hi Team,

I am trying the RAP application in ABAP BTP cockpit and on clicking the Service URL I get to see " 403 Forbidde The request has been blocked by UCON." message on the screen.

And If I click on preview I see the screen but no fields appear on the FIORI app to select the fields.

I have Created a CDS View without UI annotations, and on top of that I have created a Service Definition and Service Binding on the same.

Any Idea, what needs to be done to get the metadata URL?
https://afb8637d-43ab-41e3-8743-e5ea9e7a5e6f.abap-web.us10.hana.ondemand.com/sap/opu/odata/sap/ZKSR_SB_CONNECTION/$metadata

Thanks!

S4 Post Upgrade - Profile Generator (SU25) Options

2026-05-01T20:57:51.868000+02:00

Hi All ,

While performing the security upgrade (SU25) as part of the S/4HANA system migration from S/4HANA 2022 SP03 to S/4HANA 2025 SP01, we observed that several new options were introduced in SU25. The impact of these changes is not clearly explained in the SAP documentation available to us. As a result, many of our roles are being affected—new authorization objects are being introduced, some existing ones are being removed automatically, and custom SU24 updates appear to be overwritten.

Before proceeding further, we would appreciate guidance on the impact of each selection under SU25 steps 2a, 2b, 2c, 2d, etc. If any detailed documentation or guidance is available, please share it.

As a precaution, we are also considering taking a User Master export post-upgrade, but before executing SU25, along with a backup of the SU24 customizing tables (USOBT_C and USOBX_C). We would like confirmation on whether these backups can be used to restore the system to its pre-SU25 state if required.

accessing SAP BTP Trial fail due to verifying phone number

2026-05-04T06:23:06.059000+02:00

hi Senior,

i am facing issue when accessing SAP BTP Trial get fail due to verifying phone number.

error message "We did not send you a code because you are not allowed to request phone calls. Please contact your system administrator."

anyone getting the same issue ?.

how to solve it ?

SAP BTP CF CAPI: replacement for password grant (OAuth 2.1 / RFC 9700)

2026-05-06T15:14:43.768000+02:00

I'm building an internal governance integration on SAP BTP (euXX) that **orchestrates org and space membership** in our Cloud Foundry subaccounts. The integration runs as SAP Cloud Integration (CPI) iFlows: incoming trigger from IAM, the iFlow validates and calls the Cloud Foundry v3 API to assign or revoke roles.

**Scope of this question**: only managing **organization and space members** — i.e. `POST /v3/roles`, `DELETE /v3/roles/{guid}`, and the related `GET /v3/roles`, `/v3/users`, `/v3/organizations`, `/v3/spaces` calls needed to resolve names to GUIDs.

Calling `/v3/*` requires a Bearer token issued by the **platform CF UAA** (`https://login.cf.eu10.hana.ondemand.com/oauth/token`), not by a tenant XSUAA — confirmed multiple times on this Community (e.g. https://community.sap.com/t5/technology-q-a/how-to-access-cloud-foundry-controller-api/qaq-p/12144361).

Constraints I have to live with:

`grant_type=password` (which I'm using now to connect to CF) is out (deprecated by OAuth 2.1 / RFC 9700)
It seems I don't have direct `uaac` admin access to the platform UAA https://docs.cloudfoundry.org/api/uaa/version/78.13.0/index.html , so I can't just `uaac client add my-cpi-client --scope cloud_controller.write`. The user I use has the global admin and orgManager of the subaccount.

Is there a way to give access to CF v3 APIs via client credent?

I also tried using the CF CLI this way on the XSUAA client, but it returns that my user is unauthorized.

cf8 set-org-role "clientID-XSUAA" ORGNAME "OrgManager" --client

References already consulted:

CF v3 API reference — https://v3-apidocs.cloudfoundry.org/
CF UAA API reference — https://docs.cloudfoundry.org/api/uaa/
BTP docs — *About Roles in the Cloud Foundry Environment*
RFC 9700 (OAuth 2.0 Security BCP) https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1
https://oauth.net/2/grant-types/password/#:~:text=The%20Password%20grant%20type%20is,be%20used%20at%20all%20anymore

Thank you in advance,

Giulio

Guidance Needed for SAP Learning Journey and SAP Security Career Path

2026-05-10T22:19:02.804000+02:00

Dear SAP Learning and Community Team,

I hope you are doing well.

I am currently studying for a Bachelor’s degree in Cybersecurity and IT at Rutgers University, and I recently received access to SAP Learning resources and certifications through my university opportunity.

I am very interested in becoming SAP certified and building a future career related to SAP, cybersecurity, enterprise systems, and emerging technologies. I am also actively learning and exploring AI, and I am very interested in understanding how AI, cybersecurity, and SAP technologies may connect in future enterprise environments.

However, I am currently a complete beginner in SAP and do not yet have prior knowledge of ERP systems, SAP modules, accounting concepts, FI/CO, MM, business processes, T-codes, or SAP terminology.

As I started exploring the SAP Learning portal, I found there are many learning journeys, modules, and specialization paths, which made it difficult for me to understand where I should begin and what sequence I should follow.

Since my academic background is in Cybersecurity and IT, I would sincerely appreciate guidance on the best SAP learning roadmap that aligns with my studies and long-term career goals. I would especially value recommendations related to SAP Security, GRC, governance, access management, enterprise security, AI-related SAP technologies, or other cybersecurity-relevant SAP areas.

I would be very grateful if your team could kindly guide me regarding:

1. Which beginner learning journeys I should start with from scratch
2. How I should learn ERP concepts, SAP basics, navigation, and business processes step by step
3. Whether I should first learn FI/CO, MM, T-codes, Internal Orders, Profit Centers, and SAP fundamentals before moving into SAP Security
4. The recommended sequence of courses and learning journeys for someone with a Cybersecurity and IT background
5. Which SAP certifications would be most relevant and valuable for my future career goals
6. Which learning journey could eventually lead me toward SAP Security or SAP GRC certification paths
7. Whether there are SAP learning paths that combine AI, enterprise systems, and cybersecurity concepts

My goal is to follow a proper structured roadmap instead of randomly selecting courses without understanding the correct direction.

I would sincerely appreciate your guidance and recommendations.

Thank you very much for your time and support.

Kind regards,
Inaya

How to find version of sap ETD( SAP enterprise threat detection) in sap netweaver 758 SP01

2026-06-08T19:09:22.343000+02:00

Hi All,

We are working on POC for SAP EDT cloud version with direct integration from SAP BTP to our RISE sap system. , While we try to configure SAP ETD in SAP system we are stuck when we sending data for our client (giving error CX_SETD_HTTP_403). I opened a ticket with SAP support but no luck till now.

I have few question to experts if anyone can help here.

1. How to find version of sap ETD( SAP enterprise threat detection) in sap NetWeaver 758 SP01 as it integrated with NW 758

2. On SAP system ETD launchpad is (version 0.3). Do we need to upgrade it on NetWeaver 758 SP01.

3. Any suggestion to resolve above error?

How to use APIs to retrieve BTP Audit Logs and Roles at Global Account level?

2026-06-17T23:52:39.035000+02:00

We are trying to access the audit logs and users and roles from Business hub APIs.

We need to get data for Global account as Audit log and also users, roles, and role collection data through API for a BTP Global account .

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

SAC and BTP subaccount Provisioning

2026-06-25T18:31:55.154000+02:00

Need clarity on below items

1. Can we provision to SAC and BTP subaccount directly via IPS without IAG
2. If yes , can we provision to SAC and BTP subaccount directly via IPS without IAG if request triggers via GRC

SAP IAS connection to SAP BTP via OIDC is not working

2026-07-06T13:16:37.358000+02:00

I have established the connectivity between IAS and BTP using OIDC via the "establish trust" button in trust configuration. All the necessary configuration is also done. ROle collection is also provided under trust configuration.

However, when I am assigning the user in IAS, it says missing authorization while logging to BTP.

It is not creating the use in the subaccount as well.

Any suggestions please?

I can go for SAML but Joule enablement needs only OIDC. Hence I am stuck.

Flexible WF: Deadline Notification - Email to Manager(s) of Approval Step Approvers in Service Entry

2026-07-20T15:41:45.607000+02:00

I have a requirement to send an escalation email to the manager of an approver if the work item has not been approved for the last 5 days. Can this be achieved using the "Manager of Last Approver" option available in Flexible Workflow?

However, I have a doubt. Since the approver has not approved the work item yet, how can the system consider them the "Last Approver"?

I am using workflow WS00800321, but I am not getting any value for LastApprover.

When I check the workflow container (AC_CONTAINER), it is empty, so lv_processor remains blank. As a result, I receive the error message: "No recipients found."

My understanding is that LastApprover is populated only after an approval action has been completed. In this case, since the approver has not yet approved the work item, no value is being returned for LastApprover. Is that correct?