Introduction

This section provides the background, scope, and key requirements for SyWay’s adoption of SAP Business Technology Platform (BTP) as the cornerstone of its global SAP landscape.

Purpose

The purpose of this Application Architecture document is to define a single, authoritative blueprint for how SAP BTP services will be organized, secured, integrated, and managed across all programme phases and regions. It serves as the reference for solution architects, development teams, operations, and audit stakeholders when designing or reviewing any BTP‑based workload

Scope & Objectives

The architecture covers the full BTP footprint required for the SyWay programme, including— but not limited to—Integration Suite, Build Work Zone, Datasphere, PaPM Cloud, Sustainability solutions, Asset Performance Management, Advanced Financial Closing, Global Track & Trace, Document Reporting Compliance, Cloud Identity services and SAP Cloud Transport Management.
Primary objectives are to:

1. Provide scalable and resilient platform services that meet a 99.9 % SLA for production.

2. Ensure end‑to‑end security and compliance with EU GDPR, US SOX, and China cybersecurity regulations.

3. Enable efficient DevSecOps with automated transport, continuous integration, and central logging.

4. Minimise total cost of ownership through sub‑account consolidation and quota pooling.

5. Deliver a governed naming and role model that supports audit‑ready change control and segregation of duties.

Key Decisions and Requirements

Application Architecture

Architectural Decisions

Below Table provides the details of the architectural decisions made based on the rationale.

Application Architecture Design

Application Architecture Components

Web Dispatcher

Gateway Server

S/4HANA

ADFS

Application Security

Classification

Authentication

Authentication is implemented via Single Sign-On using SAP Identity Authentication Service (IAS) federated to Microsoft Entra ID, with separate IAS tenants per region (Europe, China, US Sovereign) and trust configured at the subaccount level. Authorisation bindings use Entra groups mapped to IAS groups and BTP role collections, with a small, named platform-administrator set operating under least-privilege and controlled break-glass procedures. All web access is enforced over HTTPS/TLS, while SAP GUI/RFC channels use SNC with client certificates via SAP Secure Login Service; application calls to backend systems employ principal propagation through Cloud Connector and approved Destinations. Identity Provisioning Service (IPS), using the connectivity plan and co-hosted with the IAG subaccount, supports S/4HANA user provisioning in line with plan limits. Authentication for systems outside SAP BTP is out of scope.

Authorisation

Authorization on SAP BTP follows role-based access control (RBAC) with Microsoft Entra groups mapped via IAS groups to BTP role collections; direct user assignments are not permitted. Role collections are scoped by subaccount, environment, and region to enforce least privilege and clear separation of duties across platform administration, transport governance (cTMS), integration development/operations, UI/Work Zone content administration, analytics (Datasphere/PaPM), sustainability/finance services, and read-only audit. Production privileges are minimised and time-bound; emergency access (“break-glass”) is granted via pre-approved, MFA-protected role collections with full logging. Service-specific authorizations (e.g., Integration Suite/API Management, Work Zone/Task Center, BPA/BAS, Datasphere/PaPM, DRC, GTT) are granted only through mapped collections, and Destinations/principal propagation are allowed solely when required scopes are present. All grants are change-controlled, auditable, and subject to periodic recertification.

Communication Security

• Encrypt-in-transit by default. All BTP web endpoints (applications, services, app routers) enforce HTTPS with TLS 1.2+ (TLS 1.3 preferred).

• Secure SAP GUI/RFC channels. SAP GUI and RFC communications use SNC with client X.509 certificates via SAP Secure Login Service, ensuring mutual authentication and integrity for administrative and operational access.

• Controlled back-end connectivity via Cloud Connector. Connectivity to SAP S/4HANA Rise hosted is established through SAP Cloud Connector with TLS, Location IDs per connector, and minimal resource mappings. One connector serves all non-production, and two connectors in HA serve production. Virtual hostnames used in Destinations are not externally resolvable.

• Hardened Destinations and principal propagation. BTP Destinations use OAuth2 SAML Bearer Assertion or mutual TLS; basic credentials are avoided. User identity is propagated end-to-end where required, and scopes/authorities are limited to least privilege.

• Certificate and key management. Certificates (server and client) are lifecycle-managed with defined owners, rotation schedules, and audit trails; trust stores are curated per subaccount to avoid over-broad trust.

• Egress and inbound controls. Outbound traffic from BTP is restricted to approved Destinations; inbound exposure is limited to necessary public entry points. IP allow-listing and service-level throttling are applied where available (e.g., API Management policies).

• Monitoring and auditability. Transport security events (connector state, certificate expiry, failed auth, TLS errors) are monitored, alerted, and logged to the central observability stack for investigation and compliance.

Data Security

Other Controls

System Landscape

Account Model - Global Account: Syensqo Main.
Account ID: 59549222-81b5-4701-afde-9a23643d0b00

Development Environment

Project Test Environment

Quality Environment

Production Environment

Operation Architecture

Change and Configuration Management

Transport Management

Release Management

Monitoring

Application Monitoring

System Monitoring

Sizing

High Availability

Disaster Recovery

Backup/Restore

Maintenance Plan

Service Introduction

Application Category

Support Team

Skill required

Checklist

Exceptions

See also

Change log

Workflow history