Introduction

This section provides the background, scope, and key requirements for SyWay’s adoption of SAP Business Technology Platform (BTP) as the cornerstone of its global SAP landscape.

Purpose

The purpose of this Application Architecture document is to define a single, authoritative blueprint for how SAP BTP services will be organized, secured, integrated, and managed across all programme phases and regions. It serves as the reference for solution architects, development teams, operations, and audit stakeholders when designing or reviewing any BTP‑based workload

Scope & Objectives

This document describes the high-level architecture for the following SAP Business Technology Platform (BTP) services. It defines the target state and guiding standards, including identity and connectivity patterns, regional/environment alignment, and guardrails for change management, monitoring, and operations.

• SAP Integration Suite (including API Management), Forms Service by Adobe

• SAP Build Work Zone, SAP Task Center

• SAP Build Code, SAP Business Application Studio (BAS)

• SAP Cloud Transport Management,  ActiveControl – UI

• SAP Cloud Identity Services: Identity Authentication (IAS) and Identity Provisioning (IPS)

• SAP Secure Login Service for SAP GUI

• SAP Identity Access Governance (IAG)

• SAP Datasphere

• SAP Profitability and Performance Management Cloud (PaPM Cloud)

• Sustainability Footprint Management (SFM)

• Sustainability Control Tower

• Green Ledger

• Asset Performance Management

• Group Reporting Data Collection

• Advanced Financial Closing

• SAP Risk and Assurance Management

• SAP Business Network Global Track and Trace (GTT)

• Document Reporting Compliance

Key Decisions and Requirements

Application Architecture

Overview

The SyWay SAP BTP landscape is organized into three global accounts (Europe, China, US Sovereign) with shared SBX/DEV in EU20 and region-specific INT/TRN/UAT/PAR/PRD, implemented as segregated subaccounts per domain (e.g., itg, ui, dep, sec, iag, ana, sus, apm, fin, gtt, drc). Identity is federated via region-specific SAP IAS tenants proxied to Microsoft Entra ID, and connectivity to S/4HANA RISE/on-premise endpoints is mediated by SAP Cloud Connector using approved Destinations and principal propagation. Integration and API exposure are delivered through Integration Suite (including API Management), user-facing capabilities through Work Zone/Task Center/BPA/Build Code/BAS, and data/finance/sustainability workloads through Datasphere, PaPM Cloud, GRDC/AFC/DRC, GTT, and related services; change promotion is governed by Cloud Transport Management. Operations and observability rely on SAP Cloud ALM and service-native consoles, ensuring consistent security, transport control, and run-state oversight across regions and environments.

BTP Global Account & Subaccount Model

Global Account: Syensqo Main. 
Account ID: 59549222-81b5-4701-afde-9a23643d0b00

Global Account: [TBC Syensqo China] 
Account ID: TBC

Global Account: [TBC Syensqo USA] 
Account ID: TBC

Application Architecture Design

Application Architecture Components

SAP Cloud Identity Service and SAP Secure Login Service for SAP GUI

SAP Build Work Zone, SAP Task Center 

SAP Cloud Transport Management and ActiveControl -UI

Identity Access Governance (IAG)

SAP Datasphere, PaPM Cloud 

SAP Asset Performance Management 

SAP Group Reporting Data Collection, Advanced Financial Closing, SAP Risk and Assurance Management

SAP Business Network Global Track and Trace(GTT)

SAP Document Reporting Compliance 

SAP Sustainability Footprint Management(SFM), Sustainability Control Tower, Green Ledger

Application Security

Classification

Authentication

Authentication is implemented via Single Sign-On using SAP Identity Authentication Service (IAS) federated to Microsoft Entra ID, with separate IAS tenants per region (Europe, China, US Sovereign) and trust configured at the subaccount level. Authorisation bindings use Entra groups mapped to IAS groups and BTP role collections, with a small, named platform-administrator set operating under least-privilege and controlled break-glass procedures. All web access is enforced over HTTPS/TLS, while SAP GUI/RFC channels use SNC with client certificates via SAP Secure Login Service; application calls to backend systems employ principal propagation through Cloud Connector and approved Destinations. Identity Provisioning Service (IPS), using the connectivity plan and co-hosted with the IAG subaccount, supports S/4HANA user provisioning in line with plan limits. Authentication for systems outside SAP BTP is out of scope.

Authorisation

Authorization on SAP BTP follows role-based access control (RBAC) with Microsoft Entra groups mapped via IAS groups to BTP role collections; direct user assignments are not permitted. Role collections are scoped by subaccount, environment, and region to enforce least privilege and clear separation of duties across platform administration, transport governance (cTMS), integration development/operations, UI/Work Zone content administration, analytics (Datasphere/PaPM), sustainability/finance services, and read-only audit. Production privileges are minimised and time-bound; emergency access (“break-glass”) is granted via pre-approved, MFA-protected role collections with full logging. Service-specific authorizations (e.g., Integration Suite/API Management, Work Zone/Task Center, BPA/BAS, Datasphere/PaPM, DRC, GTT) are granted only through mapped collections, and Destinations/principal propagation are allowed solely when required scopes are present. All grants are change-controlled, auditable, and subject to periodic recertification.

Communication Security

• Encrypt-in-transit by default. All BTP web endpoints (applications, services, app routers) enforce HTTPS with TLS 1.2+ (TLS 1.3 preferred).

• Secure SAP GUI/RFC channels. SAP GUI and RFC communications use SNC with client X.509 certificates via SAP Secure Login Service, ensuring mutual authentication and integrity for administrative and operational access.

• Controlled back-end connectivity via Cloud Connector. Connectivity to SAP S/4HANA Rise hosted is established through SAP Cloud Connector with TLS, Location IDs per connector, and minimal resource mappings. One connector serves all non-production, and two connectors in HA serve production. Virtual hostnames used in Destinations are not externally resolvable.

• Hardened Destinations and principal propagation. BTP Destinations use OAuth2 SAML Bearer Assertion or mutual TLS; basic credentials are avoided. User identity is propagated end-to-end where required, and scopes/authorities are limited to least privilege.

• Certificate and key management. Certificates (server and client) are lifecycle-managed with defined owners, rotation schedules, and audit trails; trust stores are curated per subaccount to avoid over-broad trust.

• Egress and inbound controls. Outbound traffic from BTP is restricted to approved Destinations; inbound exposure is limited to necessary public entry points. IP allow-listing and service-level throttling are applied where available (e.g., API Management policies).

• Monitoring and auditability. Transport security events (connector state, certificate expiry, failed auth, TLS errors) are monitored, alerted, and logged to the central observability stack for investigation and compliance.

Data Security

Other Controls

System Landscape

Development Environment

Project Test Environment

Quality Environment

Production Environment

Operation Architecture

Change and Configuration Management

Transport Management

Release Management

Monitoring

Application Monitoring

System Monitoring

Sizing

High Availability

Disaster Recovery

Backup/Restore

Maintenance Plan

SAP BTP follows continuous production releases. Teams should subscribe to What’s New for SAP Business Technology Platform to receive feature and fix updates. Regions are updated on a biweekly cadence (standard) with zero-downtime maintenance for most services. For more information about the biweekly updates, see Consolidated Release Schedules for SAP BTP, Intelligent Enterprise Suite: Harmonized release calendar for SAP Cloud products. Immediate updates may occur for critical defects or security fixes and can require application restarts or brief downtime with prior notification; major upgrades are rare (up to four per year) and are announced four weeks in advance in line with the Service Level Agreement and harmonized release calendars. For the China (Shanghai) region, availability and planned maintenance are communicated via the regional status page, where subscription is available. For the US Government region, planned downtimes and outage notices are sent by e-mail to the initial administrator of the global account.

Service Introduction

Application Category

Support Team

Skill required

Checklist

Exceptions

See also

Change log

Workflow history