Introduction

Purpose

Scope & Objectives

This document will describe the high-level architecture of the SAP Cloud Integration Suite.

Out of Scope:

• Since SAP Cloud Integration Suite is a group of SaaS applications accessed over the internet, network and infrastructure architecture will not be covered here.
• Product documentation and information that can be found online will not be replicated here, but referenced using hyperlinks. 
• Implementation details such as Integration Design or API Management Design may have different architectures. 

Application Architecture

Overview

Application Architecture Components

Application Security

User Access

User Access to all of the components in Integration Suite is via a web browser, and is limited to technical users (developers, system administrators, support teams, etc). 

Authentication

• User authentication to Cloud Integration is via SAML Single Sign-on (SSO) using Syensqo Entra ID. Username and Password logon are not permitted.
• Authentication options for non-human system user accounts include:
  • OAuth 2.0 - access tokens issued via XSUAA
  • Basic Authentication
• Cloud Connector - for traffic from Cloud Integration to systems hosted inside a Syensqo network or in RISE. This provides a TLS-encrypted tunnel connection and authenticates via Principal Propagation.

Authentication Flow

1. User accesses Cloud Integration tenant URL

2. The request gets redirected to SAP IdP configured in SAP BTP subaccount for Cloud Integration

3. User is re-directed to Corporate Identity Provider (IdP) logon page (i.e. Entra ID)

4. User authenticates to Microsoft using Entra ID, if not already authenticated. 

5. IdP validates and issues SAML 2.0 assertion back to BTP

6. SAP BTP maps the Role Collections assigned to the User

7. User accesses Cloud Integration

Authorisation

Standard Roles and Role Collections are assigned for User Access to Cloud Integration Components. Roles are assigned via SAP BTP Cockpit

Communication Security

For System-to-system communication, all data transfers are encrypted via a suitable mechanism - for example:

• HTTP Adapter which uses TLS 1.2 as the standard (HTTPS)
• IDoc Adapter, which also uses TLS 1.2 as the standard (HTTPS)
• RFC Adapter, using SAP SNC (Secure Network Communications)
• SFTP Adapter which uses SSH 2

Data Security

Other Controls

SAP Integration Suite on SAP BTP offers a system availability service level of up to 99.95%. This reliability commitment is supported by the official SAP Integration Suite product page, under the section “The capabilities you need, all in one place,” which highlights enterprise-grade features such as multizone availability, failover prevention, and elastic scaling for high performance and throughput. Further details on uptime guarantees, entitlements, and usage metrics by license type are provided in the SAP Business Technology Platform Service Description Guide.

System Landscape

In line with Syensqo's overall preference for the Microsoft technology stack, Azure is generally the preferred infrastructure provider. In Europe, this means the EU20 region is hosted by Azure in the Netherlands. The EU10 region is used to provide regional and provider diversity and to implement a simple and cost-effective Disaster Recovery strategy (see relevant section for more details). A separate pair of instances is provisioned in US21 region in the US to handle interfaces processing export-controlled data that must remain in the US, and a third pair is provisioned in China for resiliency and local integration requirements. 

Operation Architecture

Transport Management

Managed through Figaf Tooling see Figaf transport management

Transport landscape see DD-TEC-170 Transport Management for Release 4

Release Management

Provides information on patch releases for hotfixes, bugfixes, and code enhancements. Patches for SAP Cloud Integration and Integration Advisor . Patch Release information covers the most recent changes made to the latest version of the software.

Monitoring

Monitoring in SAP Integration Suite provides end-to-end visibility into integration processes, APIs, and event-driven messaging across hybrid and cloud landscapes. It helps administrators, developers, and business stakeholders ensure that integrations run reliably, securely, and in compliance with business SLAs.

Monitoring in SAP Cloud Integration (CI)

1. Message Monitoring - This core feature of SAP Cloud Platform Integration (SCPI), used to track, analyse, and troubleshoot the flow of integration messages between systems. It provides visibility into message processing, status, and potential errors, ensuring smooth operation of integration scenarios. Note - payloads are not captured by default, these may only be captured through explicit tracing with sufficient privilege in the system.
2. Integration Content - Deployed object status with associated error on failure.
3. Security Content - List displays of existing credentials (obscured passwords), certificates with expiry and custom user roles. Additional tooling is available for connectivity testing etc.
4. Datastore Monitoring - List display of local storage (global variables) for use by integration developers (correlations/aggregators).

Monitoring in API Management

Monitoring in SAP API Management provides transparency into how APIs are being consumed, their performance, and any potential errors. It allows administrators, developers, and business users to analyse API traffic, detect issues, and ensure APIs are meeting business and technical expectations.

1. API Analytics and Monitoring
   • Provides real-time and historical insights into API traffic
   • Tracks metrics such as request counts, response times, error rates, latency, and throughput.
   • Allows filtering by API proxies, applications, developers, or time ranges
   • Helps identify usage trends including unusual traffic patterns for capacity planning and fraud detection.
2. Trace and Debug
   • Captures inbound and outbound request/response details
   • Shows traffic distribution across APIs and consumers

Sizing

SAP monitors system load and utilization, and scales up hardware resources either proactively in response to increased load being detected, or in response to a ticket raised by Syensqo. Additionally a review with SAP can be scheduled when extensive changes when increases in load are expected to modify configuration, this requires simulated loads for monitoring in a non-productive stance to "tune" the system.

Extensions of the log storage area and retention periods can be requested at additional cost.

Cloud Integration tenant characteristics

Disaster Recovery

SAP provides a Disaster Recovery service as an additional service which must be purchased on an order form. This is implemented by completely replicating the infrastructure in a secondary region, which roughly doubles the cost of the Integration Suite. 

In order to provide a more cost-effective solution, the SyWay design will instead provision the Test environments in a separate region from the Production environment. In case of a significant Disaster-level failure event affecting an entire region of BTP, the integration flows which are already deployed in the Test environment can be reconfigured to connect to the production environments of S/4HANA and other integrated systems. The use of Figaf's DevOps tooling will assist in this. Although this involves some significant manual effort and does not provide for automatic fail-over, it represents a much more cost-effective strategy for achieving both regional and provider diversity. 

As Cloud Integration does not persist business data, RPO (Recovery Point Objective) is not an important attribute of a Disaster Recovery solution. 

The Recovery Time Objective (RTO) achievable via this solution can only be estimated after full implementation of the Figaf DevOps suite and a practice execution. It is however expected that a 24-hour RTO is achievable. 

Backup/Restore

All the data that’s being backed up is safeguarded by following set of qualities that guarantee a secure backup and facilitate data restoration with minimal loss:

• Full backup: All necessary data is backed up daily.

• Incremental backup: All delta updates within a day are backed up every 15 mins.

• Data Storage: Each set of backup data is stored in secondary storage for up to 14 days.

• Data Security: Every backup data stored is encrypted by default with the standard encryption mechanism.

• Recovery Options: Point in time recovery is supported.

Maintenance Plan

SAP Integration Suite follows a comprehensive maintenance approach with zero downtime updates for Cloud Integration, though dependent BTP services may still cause potential issues.

Zero Downtime Software Updates

• SAP performs automatic software updates for Cloud Integration.
• Updates are applied using a zero-downtime process, requiring no customer action.
• Productive integration scenarios continue running without interruption during updates.

Update Schedule and Process

• Follows a monthly update cadence (every 4 weeks).
• Updates usually occur on weekends, outside business hours.
• Rollout is random across tenants; specific timing per tenant is not provided and cannot be controlled by a customer.

Maintenance Windows and Exceptions

Most updates are seamless, but some require downtime, such as:

• Major upgrades
• Database updates
• Network or infrastructure changes

SAP reserves a weekly maintenance window for urgent patches or tenant/database operations.

Notification and Monitoring

• Customers can subscribe to receive advance email notifications for expected disruptions.
• Subscriptions can be done in Cloud Service Availability Notifications application in SAP for Me
  • Link in SAP for Me: https://me.sap.com/systemsprovisioning/getNotified
  • More details in this community blog.
• System status and maintenance updates are also available in SAP for Me.

See also

Change log