| Status |
| |
| Owner | ||
| Stakeholders | ||
| LeanIX Link |
| Table of Contents | ||
|---|---|---|
|
The purpose of the document is to outline the application architecture of the SAP RISE environment in Europe, which is used to support all businesses not using the China instance or the CUI instance instance (see also KDD057). It will cover the following topics:
- Landscape overview
- Application and components
- Application security and access
- Operational architecture
Out of scope:
- Detailed architecture designs that are managed by SAP RISE.
- RISE operating model.
- Information related to product documentation and can be found online will not be documented here.
Key Decisions and Requirements
| Description | Rationale |
|---|---|
| SAP Private Cloud deployment model was selected for S/4HANA deployment | Please refer to KDD026 - SAP S/4HANA Deployment Model. |
| SAP GTS will be co-deployed with S/4HANA as a separate client. | Please refer to KDD074 - Architecture of SAP GTS |
| Embedded Fiori deployment model - SAP Fiori front-end server is deployed on S/4HANA | S/4HANA will be the only backend system for Fiori and there is a strict dependency between Fiori and S/4HANA version. Hence an embedded deployment will be preferred and it also optimizes hosting and maintenance costs. Embedded deployment option is also recommended for S/4HANA by SAP. |
| SSL and SNC will be configured for S/4HANA to encrypt web and RFC traffic | Based on SyWay implementation approach, all data in transit must be encrypted. |
| Configure SSO for S/4HANA | As part of SyWay project, a common authentication mechanism (e.g., SAML) will be adopted for ease of access and unified user experience. |
| 99.9% SLA and SAP RISE short distance disaster recovery for production systems. | Based on Syensqo existing non-functional requirements. |
| Setup Best Practices client using alternative 1 method: Best Practices client . | As discussed in KDD071 - Development System Approach, alternative 1 is selected and client 050 will be created and configured as Best Practice client. |
| Enhanced Operations Service add-on services is included in SAP RISE for Syensqo. | Enhanced Operations Service was purchased for the following reasons:
|
| EU Access services is included in SAP RISE for Syensqo. | To ensure only SAP RISE support team located in Europe has accesses and maintains Syensqo SAP RISE systems. |
| Common Development Landscape | A common development landscape used to ensure process harmonization across the systems deployed in 3 EU and China regions. |
Terminology
| draw.io Diagram | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
- Client: A self-contained, logically-separated unit in an SAP system (technical instance based on ABAP Application Server) with separate master data, transactional data and configurations that are client specific. E.g., Client 100.
- Component: Software modules or add-on that are installed in the instance and enables a specific function. E.g., Fiori, GTS.
- Instance: An entity refers to the entire system including the software and all technical components (DB, application server etc.). E.g., S/4HANA Production.
- SID: Unique identifier for an SAP instance that consists of three characters.
- Environment/Tier: Refers to systems that are used for the different stages of the project lifecycle. Each environment serves a distinct purpose and has a dedicated instance to ensure stability and integrity. E.g., Development, QAS.
- Landscape: Refers to all the environment for an application or entire project. E.g., S/4HANA landscape, SyWay landscape.
Application Architecture
Overview
SAP RISE application architecture is represented in the diagram below. It will be hosted in Azure and the cloud infrastructure will be managed by SAP.
draw.io Diagram border true diagramName SAP Rise landscape simpleViewer false width 600 links auto tbstyle top lbox true diagramWidth 470 height 324 revision 3
SAP RISE Details
The table below summaries SAP RISE details.
Customer ID | YSQ |
|---|---|
Customer Number | 3008440 |
Installation Number | 21360356 |
S-User for PCE | S0026961840 |
Cloud Provider | Azure |
Cloud Region | North Europe (Ireland - Dublin) |
RISE Add-ons |
|
Application Components
S/4HANA
S/4HANA is an Enterprise Resource Planning solution based on SAP HANA database and SAP ABAP platform. It is a core component in SyWay landscape. SAP Fiori and GTS components will be co-deployed with S/4HANA. A two tier deployment approach will be adopted for S/4HANA systems: Application and DB.
For Sandbox, Development, Integration testing and Training S/4HANA systems, 1 application and 1 DB server will be deployed.
For QAS and Parallel Testing S/4HANA systems, multiple application servers will be deployed with 1 DB server.
For Production, high availability is in scope and S/4HANA components (like message server, app and DB) are deployed across 2 availability zones with pacemaker clusters to ensure no single point of failure.
draw.io Diagram border true diagramName Untitled Diagram-1749458382450 simpleViewer false width links auto tbstyle top lbox true diagramWidth 918 height 309 revision 3
CI: Central Instance, SCS: SAP Central Services, PAS: Primary Application Server, AAS: Additional Application Server
Add-ons
The following SAP add-ons are installed in S/4HANA.
| Add-On | Purpose |
|---|---|
| SUCCESSFACTORS_HCM_INTEGR | Integration with SuccessFactors |
| ARIBA CLOUD INT S/4 HANA | Integration with Ariba |
SAP GTS ED FOR SAP HANA | Co-Deploy GTS with S/4HANA |
SAP FIORI FOR SAP GTS | Fiori Apps for GTS |
S/4HANA ADA BY OT | OpenText integration for Archiving and Document Access |
S/4 INVOICE MGMT BY OT (FND & INV) | OpenText Vendor Invoice Management (VIM) |
SAP MRS FOR S4HANA | SAP Multiresource Scheduling |
Blackline Core & Connector | Integration with Blackline |
SAP Web Dispatcher
SAP Web dispatcher acts as a reverse web proxy for S/4HANA systems. It facilitates and load balances incoming HTTP traffic.
- For all non-PRD environment, one web dispatcher for each tier will be deployed
- For PRD, two Web Dispatchers will be deployed for HA purposes and Azure load balancer will used to load balance HTTP traffic to the 2 PRD Web Dispatchers.
| draw.io Diagram | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
SAP Cloud Connector
The SAP Cloud connector acts as a reverse invocation proxy to establish network connection between SAP RISE systems and SAP BTP services (Integration suite, API management, SAP Analytics Cloud etc.) and Ariba Cloud Integration Gateway (CIG). Due to its reverse invoke capabilities, the network traffic originates from SAP Cloud connector to SAP BTP and once the link as been established, data can be exchanged between SAP RISE systems and BTP. HTTPS or RFC protocols are used between SAP Cloud Connector and S/4HANA, and HTTPS protocol is used between Cloud Connector and SAP BTP.
To enable outbound internet traffic from SAP RISE, SAP has provisioned a customer gateway server (CGS) with a forward internet proxy installed on it. CGS will be configured with a public IP which will be used for SAP Cloud Connector connection to SAP BTP and this public IP will be whitelisted in SAP BTP.
A 2 tier landscape will be adopted for SAP cloud connector: non-PRD and PRD. The non-PRD cloud connector will be shared across all non-PRD landscape.
| Embed draw.io Diagram | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
Data Provisioning Agent
Data Provisioning Agent (DPA) is used for real-time and batch data replication from S/4HANA to SAP Datasphere. The network connection to SAP Datasphere is initiated by DPA and CGS is used to facilitate the internet connection to SAP Datasphere.
DPA uses the HTTPS or RFC protocols to communicate with S/4HANA and uses the HTTPS protocol to communicate with SAP Datasphere.
A 2 tier landscape will be adopted for DPA: non-PRD and PRD. The non-PRD instance will be shared across all non-PRD landscape.
| Embed draw.io Diagram | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
SAP Analytics Cloud (SAC) Agent
SAC Agent facilitates fa cilitates secure data connectivity and data transfer from S/4HANA to the SAP Analytics Cloud. It leverages SAP Cloud connector connection to BTP to transmit data from S/4HANA to SAC. The HTTPS protocol is used for communication S/4HANA, SAC agent and SAC.
A 2-tier landscape will be adopted for SAC agent: non-PRD and PRD. The non-PRD SAC agent will be shared across all non-PRD landscape.
| draw.io Diagram | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
OpenText Connector
OpenText connector facilitates the connection between S/4HANA and the OpenText cloud. The connection is initiated from S/4HANA to the OpenText connector and to OpenText cloud via CGS. The HTTPS protocol is used for communication between all components.
A 2 tier landscape will be adopted for OpenText Connector: non-PRD and PRD. The non-PRD instance will be shared across all non-PRD landscape.
| Embed draw.io Diagram | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
Supporting Components (SAP Router and DNS)
These are components deployed to SAP RISE landscape and are managed by SAP. Syensqo users will not have access to these applications and can raise requests to SAP to manage any changes.
- SAP Router: Single instance deployed in SAP RISE to manage SAP support's connection to Syensqo RISE systems.
- DNS: Three instances deployed in SAP RISE to manage SAP RISE domain and will be integrated with Syensqo DNS using Conditional DNS Forwarding.
DNS–CSN-A-HA IP - 172.16.32.14 (vhysqirlcsna-ha.irl.sap.eu.cloud.syensqo.com)
DNS–CSN-B-HA IP - 172.16.32.30 ( vhysqirlcsnb-ha.irl.sap.eu.cloud.syensqo.com )
DNS–CSN-C-HA IP - 172.16.32.46 ( vhysqirlcsnc-ha.irl.sap.eu.cloud.syensqo.com )
- Customer Gateway Server: Proxy for outbound internet connections and based on Squid Proxy application.
- Connection Details:
Hostname Port proxy 3128
- Connection Details:
Network Architecture
SAP RISE will be connected to Syensqo network via Azure ExpressRoute and DNS Delegation will be configured between Syensqo and SAP RISE DNS.
For more details on the network architecture and the following items, please refer to Network and Infrastructure Architecture DD-TEC-070.
- ExpressRoute design.
- DNS Integration details.
- Inbound & Outbound Internet access
- Network connectivity for S/4HANA integration
- User access from internet using Zscaler
System Landscape
The table below describes the environment and the corresponding application & SID deployed.
Region | Environment | Systems | |||||
S/4HANA (HANA DB) | Web Dispatcher | SAP Cloud connector | SAP Data Provisioning Agent | SAC Agent | OpenText Connector | ||
Europe | Sandbox | ERS (HRS) | WRS | N/A | N/A | N/A | N/A |
Development | ERD (HRD) | WRD | CRD | DRD | SRD | ORD | |
Integration Testing | ERT (HRT) | WRT | N/A | N/A | N/A | N/A | |
Training | ER2 (HR2) | N/A | N/A | N/A | N/A | N/A | |
QAS | ERQ (HRQ) | WRQ | N/A | N/A | N/A | N/A | |
Parallel Testing | ER1 (HR1) | WR1 | N/A | N/A | N/A | N/A | |
Production | ERP (HRP) | WRP & WRH | CRP | DRP | SRP | ORP | |
The following sections describes the system details for each tier. Please note the following:
- Each VM as a physical hostname (starting with hec*) and 1 or more virtual hostname (starting with vhysq*).
- The main hostname should be used to connect to the respective systems.
Sandbox
| Application | Primary Role | SID | Instance | Hostname | Ports | ||
|---|---|---|---|---|---|---|---|
| S/4HANA | Central Instance | ERS | ASCS01 D00 | vhysqersci.sap.eu.cloud.syensqo.com ( 172.16.33.12)
| HTTP - 8000 | ||
| HANA DB | HRS | ERS (tenant DB) HRS (system DB) | vhysqersdb.sap.eu.cloud.syensqo.com ( 172.16.33.13)
| System DB - 30615 Tenant DB- 30641 | |||
| Web Dispatcher | Web Dispatcher | WRS | 00 | vhysqwrswd01.sap.eu.cloud.syensqo.com (172.16.33.9)
| HTTP - 8080 HTTPS - 44380 |
Development
| Application | Primary Role | SID | Instance | Hostname | Ports | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| S/4HANA | Central Instance | ERD | ASCS01 D00 | vhysqerdci.sap.eu.cloud.syensqo.com (172.16.33.49)
| HTTP - 8000 | |||||
| HANA DB | HRD (system DB) ERD (tenant DB) | 06 | vhysqerddb.sap.eu.cloud.syensqo.com ( 172.16.33.51)
| System DB - 30615 Tenant DB- 30641 | ||||||
| Web Dispatcher | Web Dispatcher | WRD | W80 | vhysqwrdwd01.sap.eu.cloud.syensqo.com (172.16.33.44)
| HTTP - 8080 HTTPS - 44380 | |||||
| SAP Cloud connector | SAP Cloud connector | CRD | - | vhysqcrdcc01.sap.eu.cloud.syensqo.com (172.16.33.46)
| HTTPS - 8443 | |||||
| Data Provisioning Agent | Data Provisioning Agent | DRD | - | vhysqdrddpa01.sap.eu.cloud.syensqo.com (172.16.33.47)
| Agent listener port - TBC Agent admin port - TBC | |||||
| SAC Agent | SAC Agent | SRD | - | vhysqsrdweb01.sap.eu.cloud.syensqo.com (172.16.33.38)
| HTTP - 8080 HTTPS - TBC | |||||
| OpenText Connector | OpenText Connector | ORD | - | vhysqordotc01.sap.eu.cloud.syensqo.com ( 172.16.33.55)
| HTTP - 8080 |
Integration Testing
The environment is planned to be provisioned by SAP on 1 December 2025. This document will be updated after this date.
QAS
HTTPS - 8443 | |||||||
| TM Optimizer | TM Optimizer | TRD | - | vhysqtrdgtw01.sap.eu.cloud.syensqo.com (172.16.33.53)
| N/A |
Integration Testing
| Application | Primary Role | SID | Instance | Hostname | Ports | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| S/4HANA | Central Instance | ERT | ASCS01 D00 | vhysqertci.sap.eu.cloud.syensqo.com (172.16.33.76)
| HTTP - 8000 | |||||
| HANA DB | HRT (system DB) ERT (tenant DB) | 06 | vhysqertdb.sap.eu.cloud.syensqo.com (172.16.33.77)
| System DB - 30615 Tenant DB- 30641 | ||||||
| Web Dispatcher | Web Dispatcher | WRT | W80 | vhysqwrtwd01.sap.eu.cloud.syensqo.com (172.16.33.70)
| HTTP - 8080 HTTPS - 44380 |
QAS
The environment is planned to be The environment is planned to be provisioned by SAP on 1 August 2026. This document will be updated after this date.
Training
The environment is planned to be provisioned by SAP on 1 June 2027. This document will be updated after this date.
Parallel Run
The environment is planned to be provisioned by SAP on 1 June 2027. This document will be updated after this date.
Production
The environment is planned to be provisioned by SAP on 1 January 2028. This document will be updated after this date.
S/4HANA Client and Transport Strategy
Please see DD-TEC-170 Transport Management for Release 4 for client details in S/4HANA.
SAP Best Practices
As discussed in KDD071 - Development System Approach, Best Practices client will be setup using alternative 1 method.
Below are the high level steps on how to setup client 050 and 100 in Sandbox and Development S/4HANA.
- Configure /FTI/T_NOCLN000 with client 050.
- Copy client 000 to 050 using copy profile SAP_U000.
- Copy client 050 to 100 using copy profile SAP_ALL.
For more details, please refer to SAP help documentation and BP Activation Questionnaire for the list of business function and BP objects that will be activated.
Post Go-Live Landscape
Post release 4 Group 2 go-live a 4-tier landscape (DEV, QAS, PAR and PRD) will be maintained. SBX, INT and TRG landscapes will be decommissioned.
Region | Environment | Systems | |||||
S/4HANA (HANA DB) | Web Dispatcher | SAP Cloud connector | SAP Data Provisioning Agent | SAC Agent | OpenText Connector | ||
Europe | Development | ERD (HRD) | WRD | CRD | DRD | SRD | ORD |
QAS | ERQ (HRQ) | WRQ | N/A | N/A | N/A | N/A | |
Parallel Testing | ER1 (HR1) | WR1 | N/A | N/A | N/A | N/A | |
Production | ERP (HRP) | WRP & WRH | CRP | DRP | SRP | ORP | |
User Access
The following table summaries how the different systems in SAP RISE will be accessed.
System | Users | Access Method |
|---|---|---|
S/4HANA | Business users | Web |
Support users | Web and SAPGUI | |
HANA DB | N/A | Can be requested from SAP if required. |
Web dispatcher | Admin | Web |
SAP Cloud connector | Admin | Web |
Data Provisioning Agent | N/A | Raise request to SAP to perform changes as access is via OS command line |
SAC Agent | Admin | Web |
OpenText Connector | Admin | Web |
Load Balancer Configuration
Azure load balance will be used to allow users to access S/4HANA webpages using a user friendly URL and over standard HTTP port. The following diagram describes how load balances will be deployed.
All load balancer will be configured to listen on port 80 (HTTP) and 443 (HTTPS).
| draw.io Diagram | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
URL Naming Convention
User friendly URLs will be create for S/4HANA web and SAPGUI access. For SyWay the following naming convention will be adopted:
- Web URL - <App>-<ENV>.<Region>.syensqo.com
- SAPGUI Hostname - <SID>.syensqo.com
Based on the above naming convention, the following URLs will be adopted for the respective S/4HANA instances. CNAMEs will be created in Syensqo DNS to map the following
- Web URL → SAP RISE load balancer hostname
- SAPGUI hostname → S/4HANA message server hostnames
| S/4HANA SID | Web URL CNAME | Load Balancer Hostname | SAPGUI Hostname CNAME | S/4HANA message server hostnames |
|---|---|---|---|---|
| ERS | s4-sbx.syensqo.com | vhysqwrslb.irl. sap.eu.cloud.syensqo.com | ers.syensqo.com | vhysqerscs.sap.eu.cloud.syensqo.com |
| ERD | s4-dev.syensqo.com | vhysqwrdlb.irl.sap.eu.cloud.syensqo.com | erd.syensqo.com | vhysqerdcs.sap.eu.cloud.syensqo.com |
| ERT | s4-int.syensqo.com | ert.syensqo.com | ||
| ERQ | s4-qas.syensqo.com | erq.syensqo.com | ||
| ER2 | s4-trg.syensqo.com | er2.syensqo.com | ||
| ER1 | s4-par.syensqo.com | er1.syensqo.com | ||
| ERP | s4.syensqo.com | erp.syensqo.com |
Application Security
Authentication
Single Sign-on (SSO) will be enabled for S/4HANA system. Since other systems in SAP RISE landscape are supporting systems that will not be accessed directly by business users, authentication will be based on user ID and password.
SAML SSO - Fiori
SAML SSO will be configured between Entra ID and S/4HANA.
SAPGUI SSO
Single sign-on based on X.509 certificates SSO method will be leveraged for SAPGUI SSO.
Following describes the authentication flow.
- User opens an SAP GUI connection.
- Secure Login Client (SLC) redirects user to the identity provider logon page.
- Identity Authentication Service delegates authentication to Microsoft Entra ID.
- Users authenticates to Microsoft Entra ID.
- After successful authentication, SAP Cloud Certificate Authority issues an X.509 certificate
- SAP Secure Login Service returns the X.509 certificate, valid for one day, to SLC
- X.509 certificate token is used for authenticating the SAP GUI user to the ABAP system
Communication Security
All data in transit will be encrypted.
- SSL is used for all web traffic (Systems are configured to reject HTTP access or redirect to HTTPS).
- SNC is used for all RFC and SAPGUI communications.
See Network and Infrastructure Architecture DD-TEC-070 for details on network security and internet connectivity.
Data Security
Data encryption is enable for SAP HANA DB as part of the system provisioning.
NextLabs Data Access Enforcer (DAE) is used to enable field level encryption in S/4HANA. This will encrypt export control relevant data elements and the encrypted values will be stored in HANA DB. Data will be unencrypted on the fly when it is access by an authorized user. For more details please refer to DD-SOL-090 to Application Architecture NextLabs.
Other Controls
SAP provides infrastructure and server logs via its "LOGSERV" service, which can be integrated into Syensqo's SIEM. This is under discussion with Syensqo IT as of July 2025, and the agreed design will be documented in a future revision of this document.
Operation Architecture
Under the shared responsibility model, SAP is responsible for the infrastructure layer to the technical basis layer as shown below. The following section will cover the operational architecture that falls under customer's responsibility.
For the breakdown of detailed tasks and the respective roles and responsibilities, see SAP S/4HANA Cloud, extended edition Roles and Responsibilities for Production.
Change and Configuration Management
Change and configuration management in S/4HANA will be managed through SAP transports. See DD-TEC-170 Transport Management for Release 4.
For non-S/4HANA systems, there will be no transport mechanism and changes will be managed manually.
Monitoring
The following can be obtained from SAP for me portal .
- SAP RISE system availability (https://me.sap.com/systemsprovisioning/availability)
- Early watch reports (https://me.sap.com/ewa/workspace)
SAP will be monitoring from the infrastructure layer to the technical basis layer. In the event of an issue, users under Private Cloud Contacts will be notified.
Sizing
S/4HANA sizing is based on FUE licenses as shown below. For more details, please refer to RISE with SAP S/4HANA Cloud, private edition Service Description Guide in SAP Agreements.
During the course of SyWay project, FUE license will be ramped up from 60 to 1,001 and 4,001 when the project goes lives. Additional infrastructure upgrades are provisioned in the BOM to ensure the following sizing and landscape is maintained at Go-Live.
For more details on infrastructure, please refer to Network and Infrastructure Architecture DD-TEC-070.
High Availability & Disaster Recovery
See DD-TEC-140 HA/DR Architecture Design for more details.
Backup/Restore
See DD-TEC-160 Back up and Restore Design for more details.
Maintenance Plan
The following downtime window is planned for SAP to perform maintenance work that require system downtime.
| Environment | Planned Downtime Window |
|---|---|
| Sandbox, Development, Integration Test | First Tuesday each month, 15:00 - 19:00 UTC |
| QAS, Training, Parallel Run | Second Thursday each month, 15:00 - 19:00 UTC |
| Production | Third Sunday each month, 03:00 - 07:00 UTC |
Exceptions
N/AAppendix
Customer Gateway Server
Following hostnames have been configured to allow outbound internet connections.
- .python.org
- .ondemand.com
- .cloud.sap
- .alm.cloud.sap
- .applicationstudio.cloud.sap
- .hana.ondemand.com
- .hanatrail.ondemand.com
- .crm.ondemand.com
- .successfactors.com
- .successfactors.eu
- .concur.com.au
- .ariba.com
- .fieldglass.com
- .sap.com
- .sapbusinessobjects.cloud
- .hybris.com
- .abakus.me
- .s4hana.ondemand.com
- .sap-ag.de
- .support.sap.com
- .rapid.sap.com
- .apps.support.sap.com
- .servicepoint.sap.com
- .smpdl.sap-ag.de
- .deploy.static.akamaitechnologies.com
- .sapbydesign.com
- .windows.net
- .microsoft.com
- dc.services.visualstudio.com
- management.azure.com
- .sapanalytics.cloud
- .trendmicro.com
- .opentext.com
- .opentext.eu
- .opentext.cloud
- .mysap.com
- .slanalytics.net.sap
- .sapsf.eu
- .microsoftonline.com
- .amazonaws.com
- licensing.neptune-software.com
See also
- The Lean IX factsheet for SAP S/4HANA - [ERP] (Rest of World instance)
- KDD057 - Business System Location
Change log
| Change History | ||
|---|---|---|
|