Learning the Fundamentals

The Cloud Console serves as the central administrative management interface for SAP Integration Suite, advanced event mesh. Instead of requiring direct interaction with underlying cloud hyperscaler consoles, the Cloud Console abstracts complex cloud infrastructure operations into a unified graphical interface. Platform engineers, system administrators, and integration architects use this portal to provision messaging capacity, manage access rights, and monitor platform resources.

To enforce structured enterprise governance and multi-tenant isolation, platform resources are structured hierarchically:

Organization

Represents the top-level tenant container corresponding to a company or business unit.

Environments:

Located within an Organization, environments segregate messaging infrastructure according to operational boundaries and lifecycle stages. Typical environment topologies include separate setups for Development, Testing (Staging), and Production. Each Environment acts as an isolated container with its own dedicated Event Broker Services, network policies, and user permissions. This isolation ensures that high-load testing or experimental setups in a development environment cannot impact the stability or throughput of production messaging services. Resource parameters such as client connections and message spool size are defined at the individual Event Broker Service level.

Initial access to the Cloud Console is secured through SAP Identity Authentication Service (IAS), configured with OpenID Connect (OIDC). Corporate identity providers can be connected via IAS to enable single sign-on (SSO) using corporate credentials.

The Cloud Console interface is structured around three main workspaces, Event Portal, Mission Control, and Insights.

Event Portal directs users to the design-time workspace where event-driven architectures are modeled and governed. It includes:

• Designer - For creating and managing event domains, schemas, and application topologies.
• Catalog - For discovering and sharing events and AsyncAPI specifications across teams.
• Runtime Event Manager - For monitoring live event flows and runtime behavior.

Mission Control acts as central workspace for event streaming operations. It contains two sub-areas:

• Cluster Manager - Provides controls for provisioning, configuring, scaling, and monitoring Event Broker Services across supported cloud regions.
• Mesh Manager - Allows you to create and manage Event Meshes that connect multiple Event Broker Services into a unified messaging fabric.

Insights provides monitoring dashboards, visualizations, and alerts for observing the health and performance of Event Broker Services.

At the bottom of the navigation bar are actions that are always available, regardless of the active workspace:

User & Account

Management of personal account preferences and authentication credentials.

Notifications

Access to system notifications and subscription settings.

Learn & Help

Links to documentation, tutorials, and support resources.

The Role-Based Access Control framework in the Cloud Console is built on three core concepts that govern administrative and operational boundaries.

Permissions

Discrete capabilities within the platform, such as creating Event Broker Services, viewing queue metrics, configuring mesh links, or modifying Event Portal schemas.

Roles

Groupings of permissions that represent common job functions within an organization. Advanced event mesh provides a set of predefined roles: Administrator, Mission Control Manager, Mission Control Viewer, Event Portal Manager, Event Portal User, Insights Advanced Editor, and Insights Advanced Viewer.

Accounts and Environments define the structural boundaries within which assigned roles apply. A user can hold different roles in separate accounts, and environment-level access can be further restricted per role.

The platform provides predefined roles tailored to standard operational duties. The Administrator role grants full authority to manage users, roles, environments, and account settings across the platform. Mission Control Manager allows creation, modification, and deletion of Event Broker Services and Event Meshes, while Mission Control Viewerprovides read-only access to service details and health checks. Event Portal Manager enables governance of application domains and modeled event meshes, while Event Portal User provides scoped access that can be expanded for specific domains or environments. The Insights Advanced Editor and Insights Advanced Viewer roles govern access to monitoring dashboards and alerting configurations.

Through identity federation with external identity providers such as SAP Identity Authentication Service (IAS), users log into the platform using their corporate credentials. Administrators use the Group Management feature in the Cloud Console to map external identity provider groups directly to roles within SAP Integration Suite, advanced event mesh. When an employee joins, changes roles, or leaves the organization, updates made in the corporate identity system automatically reflect in their platform access rights.

Administrators create environments through the Cloud Console under their organization tenant. During the creation process, key operational parameters are defined to establish the scope and rules of the environment.

Properties

Administrators assign a meaningful name, description, and operational tier, such as development, testing, staging, or production.

Resource Limits and Quotas

Service limits govern how many Event Broker Services can be provisioned within the environment. Detailed resource parameters such as client connections, message spool size, and queue capacity are defined at the individual Event Broker Service level during provisioning in Cluster Manager.

Access Control Policies

Role-Based Access Control settings are bound to the environment, determining which user groups have permission to deploy, configure, or monitor services in that space.

The platform supports multi-cloud deployment models across public cloud hyperscalers (AWS, Microsoft Azure, Google Cloud Platform) as well as dedicated enterprise environments. For specialized regulatory, security, or compliance needs, administrators can activate Dedicated Regions. They extend the management capability of the Cloud Console into private cloud accounts or on-premises data centers.

Administrators establish secure perimeters by configuring private network connectivity options, such as SAP Private Link Service, VPC/Net-peering, or managed hub-and-spoke networking for Dedicated Region deployments, ensuring that Event Broker Services are not exposed over the public internet. Setting up these infrastructure boundaries beforehand ensures that any Event Broker Service created in the environment is automatically secured.

To understand why organizations construct structured environment topologies, consider a global retail enterprise deploying SAP Integration Suite, advanced event mesh to handle real-time inventory and order processing.

The enterprise configures three isolated environments within its Organization tenant:

• Development Environment: Used by integration developers to test new event producers, experiment with queue settings, and validate AsyncAPI definitions. This environment uses lower Service Classes in a public cloud region to keep operational costs low without risking core systems.

• Staging Environment: Serves as a pre-production validation zone where performance and load tests are executed. Here, Private Regions are activated to mirror the exact network security, IP whitelisting, and hybrid connectivity settings of the data center before going live.

• Production Environment: Hosts mission-critical Event Broker Services running high-availability clusters across multiple cloud availability zones. Strict Role-Based Access Control ensures that developers have read-only visibility for monitoring, while only designated platform operations teams possess rights to modify broker configurations or mesh links.

By isolating these tiers into distinct environments, the enterprise guarantees that high-volume load testing in the staging zone never interferes with live order processing in production, while maintaining consistent governance across all stages.