Overview of Access and Interaction Model

SyWay applies a unified access model that ensures users interact with S/4HANA, SaaS, and related enterprise solutions in a consistent and secure way, regardless of device type or location. We define access according to the device being used, the classification of the data being handled, and the role of the user. All corporate devices are managed through Intune. This ensures that laptops, PCs, and mobile devices remain compliant and secure before connecting to company systems.

This document describes access in terms of two concepts: Access Channels and Digital Touchpoints.

Access Channels

These are the devices and entry points that people use to reach our systems, for example a corporate laptop, a managed mobile device, or controlled third-party access.

Digital Touchpoints

These are the applications and platforms where users perform their work, for example Work Zone Standard, S/4HANA Fiori, Salesforce, SuccessFactors, Ariba, or SAP Analytics Cloud (SAC).

Matrix: Digital Touchpoints vs Access Channels

Business-Facing Touchpoints

IT-Facing Touchpoints

Footnotes

1* Desktop access is provided for configuration, testing, troubleshooting, and supervisory purposes, even though these applications are primarily designed for mobile or industrial devices.
2* Work Zone Standard on mobile is accessed using SAP Mobile Start. Users can still open Work Zone in a mobile browser, but the experience is less optimised. We will not block this, although our recommendation and supported option is SAP Mobile Start.
3* External portals on managed mobile devices follow Intune browser rules.
4* Access on personal devices depends on data classification and business approval.
5* TPA provides a controlled virtual desktop where only approved applications are deployed and accessed.

The following sections describe each Access Channel in more detail.

Access Channels

Access channels represent the devices and entry points through which users reach SAP and other enterprise systems. Each channel is defined by its level of control, security, and the type of data it can access. Together they ensure that every user, regardless of role or location, connects through a secure and consistent path that matches their work environment.

Syensqo Corporate Laptops

Corporate laptops are the standard way most employees access SAP systems. All corporate PCs and laptops are managed through Intune, Syensqo’s device management platform. This ensures that devices remain compliant and secure before connecting to company systems. The design principle is browser first, so business applications are accessed through a web browser rather than installed locally.

Managed Mobile Devices (Personal, Corporate)

Corporate mobile phones, and personal mobile devices that employees enrol in Intune are managed centrally through Syensqo’s device management platform. This allows secure configuration, app deployment, and compliance enforcement before the device connects to company systems. Applications are either pre-installed or made available through the company app catalogue. If more than half of a target population needs a specific app, such as SAP Mobile Start or SuccessFactors, the app is pushed automatically. Apps used by smaller groups, such as Concur, are available on demand. All managed mobile devices support single sign on so users can move between approved apps without repeated logins.

Industrial Mobile Devices

Industrial mobile devices, such as rugged tablets or handheld scanners, are pre-configured for operational use, and only approved business applications are deployed on these devices. User authentication must stay simple and secure. SyWay will collaborate with the preferred mobile device vendor to evaluate potentially proprietary options such as RFID badge-based login or shared-device patterns, with the goal of keeping user effort low while still enforcing access control.

As of November 2025, Syensqo uses more than sixty different industrial device models across plants and warehouses. This creates significant complexity for application design, testing, support, and long-term maintenance because every solution must be validated across many hardware types and operating conditions. SyWay intends to standardise the fleet to a small set of supported devices, ideally no more than three devices:

1. A device which is Intrinsically-safe, with suitable ATEX / IECEx certifications, for use in potentially-explosive atmospheres. It is known that some areas in Syensqo facilities require the use of such devices. This certification, and the necessary hardware modifications, add a significant amount of cost to the hardware - often 100% more than the base device cost. As a result, manufacturers typically only undergo the certification process for their flagship devices. An illustrative example is the Bartec TC78ex-NI which is based on the Zebra TC78 device. 
2. A version of the intrinsically-safe (IS) device without the certifications, for use in other areas of the plant that see intensive use of the device and thus warrant the use of a high-performance flagship device. This would be regarded as the standard model deployed unless IS certification is needed. An illustrative example might be the Zebra TC78.
3. For selected low-use areas, such as plants with only a small warehouse storage area using only SAP Inventory Management (and not SAP Extended Warehouse Management and its more complex processes), a simpler, lower-spec and lower-cost device might be sufficient. This should still be a ruggedised device for business continuity purposes, but lighter and less-frequent use could allow Syensqo to save costs by deploying a lower-tier device from Zebra such as the TC58e.

Zebra devices are the leading candidates due to their strong industry adoption and the availability of both intrinsically safe and non-intrinsically safe models for different site environments.

The third option in the supported device set will focus on smaller warehouses or light industrial operations where a cost-effective alternative is required. This option will provide a more affordable device model that meets operational needs without the higher cost associated with ruggedised Zebra hardware.

Kiosks

Kiosks in Syensqo are fixed, shared terminals used across production, maintenance, laboratory, and operational areas. They are not personal computing devices and do not follow standard end-user sign-in patterns. Each kiosk type supports a specific operational purpose, ranging from displaying production indicators to enabling maintenance scheduling or supporting local shop-floor workflows.

Only a small subset of kiosks interacts with SAP, specifically the GWOS kiosks (see table below). These kiosks currently run the custom transaction ZWPM09A using technical service accounts mapped to the kiosk’s Windows login. As part of SyWay, we will review ZWPM09A together with the A2D team to determine whether this process continues in the new system. We will also assess whether the current generic-account approach should be replaced with user-based access or an alternative pattern that aligns with the S/4HANA security model.

All other kiosk types will be treated as operational equipment managed by the local IT teams rather than within the scope of SAP UX.*

Footnote

* Kiosk inventory information is still being consolidated. Current data from IT is fragmented across different teams and systems, and not maintained in a central repository. As of November 2025, the SyWay program is working with IT to confirm which kiosks exist, how they are used, and which ones have SAP access.

Unmanaged Mobile Devices

Personal mobile devices can be used for selected cloud applications, for example SuccessFactors or Concur, where this is allowed by security policy. Access to core S/4HANA systems and other higher-risk applications continues to require a corporate device.

Third-Party Access (TPA)

Third-party personnel, such as contractors or consultants, will access restricted Syensqo applications through the Syensqo Third-Party Access (TPA) workspace. TPA is a secure virtual desktop environment that runs in the browser and provides only the applications that external users need for their work. It keeps all activity isolated from the Syensqo corporate network while still giving a simple and familiar experience.

Access through TPA focuses on what is required for the person’s role. Only the approved Syensqo applications and business tools are available, and no wider access to the Syensqo network is exposed. This allows external users to perform their tasks safely without compromising internal systems.

The following sections describe each Digital Touchpoint in more detail.

Digital Touchpoints

Digital touchpoints represent the applications and platforms where users actually perform their work once they have accessed the environment through an approved Access Channel. The objective is to provide a consistent experience across SAP and related enterprise solutions, regardless of device or entry point.

Work Zone Standard

SAP Build Work Zone Standard is the central entry point for all user access. It connects directly to our S/4HANA systems to expose the role-based Fiori apps assigned to each user, and it also links to other enterprise and SaaS solutions such as SuccessFactors, Ariba, and Concur where the role requires them. This gives users one consistent environment to access everything they need for their work without having to remember system names or maintain separate logins.

Work Zone combines content from multiple systems into a single, role-based experience. For example, a procurement specialist can see both S/4HANA Fiori apps and supplier links, while an HR user can access Fiori workflows together with SuccessFactors content. This unified model is one of the core design decisions by SyWay, providing a consistent user experience and reducing fragmentation while keeping access governed.

How users access apps and tools in Work Zone

In Work Zone, users access applications and content through tiles or links. Tiles represent apps or actions and launch the underlying Fiori app, classic UI, or SaaS system. Each tile displays the app name, icon, and, where relevant, live data or status indicators.

SyWay will use Insight Tiles (KPI, Chart, Trend, and Comparison) where it makes sense to show key figures or status information directly on the tile. This gives users quick visibility of important metrics before opening the app.

Links are used where a full tile is not needed. They save space and are ideal for opening SaaS homepages, reports, or documentation that support the user’s role. This keeps pages clean and focused.

To maintain clarity as the number of tiles grows, the SyWay design follows the new Work Zone layout based on Spaces, Pages, and Sections. This structure keeps navigation consistent and reduces clutter:

• Spaces group work by function or Line of Business, such as Finance, Procurement, or HR (maps to Signavio L3 - Process Group / End-to-End Process).

• Pages organise tiles by activity or task type, such as Operational tasks or Analytics (maps to Signavio L4 - Process / Activity).

• Sections further group tiles to make large collections more manageable and reduce visual clutter.

• Tiles are the smallest display element (map to Signavio L5 - Executables / Tasks).

See images below for examples of the structure and tile types used in Work Zone.

Spaces, Pages and Sections schematic

A schematic display of how Spaces, Pages, and Sections are structured in Work Zone.

Tile Examples image

Examples of different tile types including KPI, Comparison, Monitoring, and Link tiles.

How users access systems across multiple backends

The SyWay landscape includes two SAP Build Work Zone Standard tenants that are each aligned to one S/4HANA system. This design gives each region its own Work Zone entry point and ensures that access, data, and performance remain local to the region. Users sign in once to their regional Work Zone and can reach all backend systems that belong to that region without managing multiple logins or credentials.

Some roles require access to applications in more than one regional instance, such as ROW and China. From a user perspective, access across these regions is seamless. Users sign in once and can reach the Work Zone for their region without needing to manage multiple logins or credentials. Aside from the URL, there is no disruption to how users access or work with their applications.

Each Work Zone follows the same structural design so that navigation, pages, and tiles behave consistently across regions. The use of regional theming to help visually distinguish each tenant is still under review together with SAP to ensure this does not deviate from a future-proof design.

Within Work Zone, each tile indicates which backend it connects to, allowing users to identify the system before launching the app. This provides one unified entry point while keeping each region’s data and connectivity governed independently.

See KDD036 - User Access to Enterprise Systems for the technical rationale behind the multi-tenant design.

See images below for examples of how roles access multiple S/4HANA systems through Work Zone.

• Individual tiles  – used where users need to open separate apps per backend without displaying data. Each tile represents one system and is clearly labelled (for example,  Manage Purchase Orders – ROW,  China).

• UI cards  – used where data or status values are meaningful at a glance, such as monitoring purchase orders or supplier confirmations across multiple systems. Cards summarise key values in one component, allowing quick comparison without opening separate apps.  (Example: “Open PO counts by backend”)

Where you see approvals (Task Centre)

Workflow approvals and tasks are accessed through the Task Centre, which is embedded directly in SAP Build Work Zone Standard. This gives users a single consolidated view of approvals from S/4HANA, SuccessFactors, Ariba, Concur, and any other connected systems. Users can review, approve, or forward tasks without leaving Work Zone, creating a consistent and efficient experience.

The technology team will assess each SAP and non-SAP system to determine whether Task Centre integration is feasible. The SaaS Applications table (See Below) reflects this assessment with three outcomes: 

• Yes where integration is supported
• No where it is not
• Conditional where further investigation is required. Conditional cases depend on the system APIs and whether the required task data can be exposed through a Task Provider.

Where you see alerts (Notifications)

Notifications can be surfaced in SAP Build Work Zone Standard to give users a single place to view important updates from S/4HANA and other connected systems. This includes alerts, status changes, reminders, and Task Centre items, since workflow tasks can also generate notifications. Users can open the related application or record directly from Work Zone, helping them stay informed without switching between systems.

The technology team will assess each SAP and non-SAP system to confirm whether notification integration is possible. The SaaS Applications table (See Below) reflects this with three outcomes:

• Yes where the system can publish notifications to Work Zone
• No where this is not supported
• Conditional where further analysis is required. Conditional cases depend on the system’s ability to expose event or notification APIs that Work Zone can consume.

Figure: Example of notifications displayed in SAP Build Work Zone Standard

Deep Linking

Deep linking allows users to open an application or a specific record through a direct URL. Inside S/4HANA and the Fiori ecosystem this works consistently because Fiori supports true deep links and Work Zone acts as the central entry point for navigation.

Outside S/4HANA the experience varies. Each SAP SaaS and non-SAP SaaS product uses its own navigation model, so record-level deep linking is not always available. Some systems support it, others offer only app-level links, and some do not support deep linking at all.

When the business requests a deep link to an external system, the technology team will review the requirement. If the request is valid and within scope, we will assess the capabilities of the target system and confirm what is technically possible. These situations are marked as “Conditional” in the SaaS Applications table below.

SaaS Applications

Joule and AI Assistance

Joule is SAP’s built-in generative AI assistant that helps users work faster and with fewer manual steps. It can answer questions, summarise information, create insights, and guide users through processes using natural language. In the SyWay S/4HANA landscape, Joule will support everyday business activities such as reviewing transactions, analysing documents, identifying issues, and recommending actions based on the data in the system.

For business users the main benefit is simplicity. Instead of navigating multiple screens or searching for the right application, users can ask Joule a question or describe what they want to do. Joule can open the correct app, retrieve relevant information, or complete routine tasks on the user’s behalf. This creates a more intuitive and productive experience, especially for infrequent users or users who work across multiple systems.

SyWay will make Joule available through SAP Build Work Zone Standard as one of the core access points for AI support. Users will be able to launch Joule directly from Work Zone to ask questions, request guidance, or trigger actions in S/4HANA and connected systems. As SAP expands Joule’s capabilities, the assistant will become a central touchpoint for insights, help, troubleshooting, and process support.

The SyWay program uses a structured approach to assess and test the value of Joule use cases in realistic business scenarios. This includes validating how well Joule understands processes, the accuracy of its responses, and how it can speed up tasks for each Line of Business. The objective is to identify high-value use cases and provide guidance to users so the organisation gets the most benefit from the AI capabilities SAP delivers, and to balance these against both licensing costs and compliance risks (e.g. in light of the EU AI Act). 

Supported Browsers

SAP Build Work Zone Standard and the related SAP Fiori applications require a modern, fully supported web browser. Using the latest version ensures the best performance, security, and user experience. Older or unsupported browsers can cause missing features, display issues, or login problems.

See SAP documentation: Browser and Platform Support

Figure: Supported browsers for accessing SAP Build Work Zone and Fiori apps

Usage Classification

Understanding how different users interact with SAP systems helps define which access channel is most suitable for their role. These categories guide which front-end technology is recommended, including SAP Fiori, SAP Build Work Zone Standard, SAP Mobile Start, desktop browsers, or occasional use of SAP GUI for IT specialist functions.

This classification supports the UX design by aligning each user type with the most appropriate experience.

Industrial Applications

Industrial applications are deployed on rugged or shared devices such as Zebra scanners to support plant, maintenance, and logistics operations. These solutions provide task-focused mobile workflows, scanning capabilities, offline support where needed, and seamless integration with S/4HANA. Below is the initial list of confirmed industrial applications for Syensqo:

Mobile Solutions and Apps

Mobile access supports users who need quick, on-the-go entry to tasks, approvals, and business information. SAP Mobile Start provides the primary entry point to S/4HANA and Work Zone content, while additional mobile applications from solutions such as Concur, SuccessFactors, Salesforce, and other SaaS products are made available through the company app catalogue delivered via Microsoft Intune. The intent is to provide secure, role-based access on mobile devices and maintain a consistent experience across desktop, tablet, and phone.

Alert Notifications (Email and SMS)

Email and SMS alerts are not recommended as primary communication channels for SyWay. With SAP Build Work Zone Standard providing Task Centre and in-platform notifications, we already have a consistent and centralised way to reach users for tasks, approvals, and system updates. Relying on external email or SMS channels increases noise, creates duplicated messages, and reduces the overall user experience.

There will be valid exceptions. Certain external processes, such as DocuSign, depend on email-based notifications as part of their standard workflow. Forcing these into notifications in Work Zone may not be possible or require extensive customisations, and thus violate the Standardisation principle of SyWay. There may also be cases where messages must be sent to users outside the organisation. These situations will be reviewed on a case-by-case basis to confirm the business need and determine the correct approach.

The objective is to minimise unnecessary email and SMS alerts and encourage the use of consolidated, in-platform notifications through Work Zone Standard for all internal users.

Microsoft Teams Integration

The separate LEAP program is running during 2026 to move the organisation to the Microsoft365 stack of productivity applications. Once Microsoft Teams is deployed to the organisation (estimated Q3 2026), the SyWay program will assess the integration options for SAP Work Zone, Task Center, and other touch points. Both SAP Work Zone and its integration to Teams is still evolving as of 2025, and any integration approach must be tested to confirm the value for business users and ensure it aligns with SyWay's security, access, and data governance model.

Below is an overview of how Microsoft Teams can potentially integrate with SAP systems and what may be considered once the LEAP program has executed the transition.

External Portals

External portals support interactions with customers, suppliers and other business partners. Examples include supplier portals, B2B portals, and customer access to Safety Data Sheets. These portals are separate from internal systems but follow similar principles for branding and ease of use. The SyWay program will apply the same principles of standardising and simplifying global processes to these external channels. SyWay will largely replace existing portals to ensure consistent user journeys, clearer navigation, harmonised visual design and a more integrated experience with Salesforce, S/4HANA, and related applications. The objective is to reduce fragmentation, eliminate custom variations where possible and provide partners and customers with a modern, predictable and easy-to-use interface that aligns with our upgraded digital landscape. 

Separate documents will define in greater detail the individual designs of the Supplier Portal, SDS portal, and any other B2B portals in scope of SyWay. 

WalkMe

WalkMe is a digital adoption platform that guides users through complex applications by providing on-screen, step-by-step assistance. It helps users complete tasks correctly by overlaying prompts, walkthroughs, and guidance directly on top of the system they are using, without modifying the underlying application. The SyWay program supports WalkMe for S/4HANA-based applications and selected user populations only, and will utilise it as part of the overall user enablement approach for these. Due to the high cost of WalkMe and a licensing model that charges Syensqo on a per-application and per-user basis, WalkMe will only be deployed for scenarios where the vendor-provided UI is not overly user-friendly and end users would thus benefit the most from the assistance provided by WalkMe. S/4HANA, with its strong reliance on old-fashioned SAP GUI transactions delivered through Web GUI, is thus a good candidate for this. 

Some applications, especially industrial mobile solutions such as Blueworx or the custom Logistics Mobility Solution, can be sensitive to performance overhead. In these cases WalkMe may introduce latency or slow down the user interface. Where this occurs, SyWay will provide two versions of the application which can be installed concurrently on the same device:

1. one version with WalkMe enabled
2. one version with WalkMe removed, but otherwise completely identical in functionality.

This approach ensures that operational processes remain fast and practical while still offering guided support where appropriate. Crucially the user will be able to choose whether or not to launch the app with or without WalkMe assistance and thus allow users to self-select when to "remove the training wheels". 

The automated build pipeline for the creation of deployable mobile apps will ensure that, save the WalkMe functionality, the application code is identical between both versions of the app, and thus prevent differences in functionality between these two versions. 

SAP Screen Personas

SAP Screen Personas can help simplify specific SAP GUI transactions, but it is not a strategic UX technology for S/4HANA. SyWay will use Personas only for simple adjustments such as hiding unused fields, setting default values or reducing screen clutter. Personas will not be used to redesign screens, change layouts or create new views. The technology becomes less relevant as SAP continues to replace older SAP GUI screens with modern Fiori applications, and any use of Personas creates a customization that moves the system away from standard. This is not aligned with the SyWay principles of maintaining a clean core. Heavy use of Personas also introduces additional maintenance effort and upgrade risk without delivering the full benefits of a modern Fiori experience. For these reasons, Personas is treated as a tactical tool to reduce pain in a small number of transactions rather than a platform for broader UX redesign.

Personas will only be used for minor simplifications such as:

• Hiding fields that are not used

• Pre-filling default values

• Creating a cleaner or shorter entry screen

• Removing noise from standard transactions

Accessibility and Inclusive Design

SyWay solutions leverage standard SAP user interface technologies. SAP Fiori and SAP UI5 are designed in alignment with the Web Content Accessibility Guidelines (WCAG) 2.2, the current internationally recognised standard for digital accessibility. This includes support for screen readers, keyboard navigation, appropriate contrast, scalable text, and consistent interaction patterns.

Where standard SAP applications are used, accessibility support is provided out of the box. Where custom applications or extensions are required, the project will use standard SAP UI5 libraries and controls so that accessibility capabilities are inherited by design. No separate accessibility framework is introduced as part of the UX approach. Accessibility is addressed through the consistent use of SAP-standard technologies and SAP’s product compliance guidelines.

Further reference:

• SAP UI5 accessibility and WCAG 2.2 alignment

• SAP UX design and product compliance standards