##  Implementation Details
The integration uses servicePrincipals instead of the application endpoint, allowing us to discover applications across different tenants rather than being limited to those within the current tenant. For a detailed guide on discovering and managing service principals and applications, see Microsoft's documentation [Application and Service Principal Objects![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity-platform%2Fapp-objects-and-service-principals%3Ftabs%3Dbrowser%23example "https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser#example").
SAP LeanIX integration supports two regions - Global and China, with API calls directed to different URLs depending on the region. For details on handling national cloud deployments, including URIs specific to national clouds, see [Authentication for National Clouds![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity-platform%2Fauthentication-national-cloud "https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud").
Authorization and permissions are managed using OAuth 2.0 client credentials grant flow, as outlined in [OAuth 2.0 Client Credentials Grant Flow![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity-platform%2Fv2-oauth2-client-creds-grant-flow%23first-case-access-token-request-with-a-shared-secret "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow#first-case-access-token-request-with-a-shared-secret"). The required scope for API access is specified by .default within the https://graph.microsoft.com/resource. For information on managing permissions and consent for the applications, see [Permissions and Consent Overview![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity-platform%2Fpermissions-consent-overview%23the-default-scope "https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#the-default-scope").
If you want to cross-check the discovered services, you can do so by navigating to Enterprise applications | All applications > All applications. Ensure you do not apply any filters.
![Cross-checking the Pulled Services](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/loio274e5a967a441014b33ab7a7adb079da_LowRes.png)
Cross-Checking the Discovered Services
Integration Categories | Authentication Mechanism | Supported Regions | API Endpoints Used
---|---|---|---
Single Sign-On Systems (SSO) | REST API - [OAuth![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity-platform%2Fv2-oauth2-client-creds-grant-flow "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow") | Global China |  For API authentication: /<tenantID>/oauth2/v2.0/token For SaaS discovery: /servicePrincipals


