Defining Technology Architecture

Objectives

After completing this lesson, you will be able to:
  • Grasp the fundamental concepts of technology architecture
  • Use environments and location diagrams to show geographical representation of solution building blocks

SAP Enterprise Architecture Methodology

SAP Enterprise Architecture Methodology

The SAP Enterprise Architecture Methodology – a methodology aligned with the TOGAF standard and tailored to the SAP Reference Architecture

Image that shows the various aspects of requirements management and details for the architecture vision, business architecture, application and data architecture as well as technology architecture.

The SAP Enterprise Architecture Methodology has evolved from the formerly known Industry Reference Architecture (IndRA) framework, an SAP internal project.

It provides a comprehensive approach used by SAP and customers to systematically map IT Solutions to business needs. Internally SAP uses the framework to build enterprise architecture content. Customers apply the framework to define their desired future business scope and desired target architecture.

The recommendation for our customers is to follow a phased approach. It can be used by any enterprise to find the IT Solutions that meet their business need. Same holds true also for SAP's own IT.

This approach is in line with the TOGAF® standard from The Open Group, a proven EA methodology used by the world’s leading organizations to improve their business efficiency.

The TOGAF Architecture Development Method (ADM) cycle is the result of continuous contributions from a large number of architecture practitioners. It describes a method for developing and managing the lifecycle of an Enterprise Architecture.

The ADM is highly iterative: Within phases, between phase, between cycles, stakeholder reviews after the phases.

Metro Map

The SAP Enterprise Architecture Methodology - Metro Map outlines the following:

  • The full set of architecture artifacts (recommended and optional)
  • Input from the SAP Reference Architecture to define the target architecture both in terms of business and IT domains
  • References to existing architecture work products such as principles, standards and guidelines as well as existing baseline business and solution architectures
This figure shows an SAP Enterprise Architecture Methodology - Metro Map

The selection of artifacts again very much depends on the nature of the architecture project and the stakeholders involved. These should be selected for the sake of the stakeholders (not for the sake of architecture).

Note

There will be iterations within and across the individual phases (the intention of the visualization is not to give the impression of a waterfall-based approach).

Technology Architecture

This figure describes the purpose and artifacts of the Target Technology Architecture

The evolution of new technologies is a major driver for change in enterprises looking for new innovative ways of operating and improving their business. The Technology Architecture needs to capture the transformation opportunities available to the enterprise through the adoption of new technology.

While the Enterprise Architecture is led by business concerns, drivers for change are often found within evolving technology capabilities. As more digital innovations reach the market, stakeholders need to both anticipate and be open to technology-driven change. Part of Digital Transformation has arisen due to the convergence of telecommunications and computer capabilities which have opened up new ways of implementing infrastructures.

Solution development methods are also evolving to challenge traditional development methods and are putting pressure on the shared services and common use benefits of the traditional Enterprise Architecture approach. Without a strong Enterprise Architecture approach, the rapid adoption of changing technologies will cause discontinuities across the enterprise.

The flexibility of the TOGAF ADM enables technology change to become a driver and strategic resource rather than a recipient of Change Requests. As a result, the Technology Architecture may both drive business capabilities and respond to information system requirements at the same time.

Specifically, the Technology Architecture describes the technology stack, physical computing environment and required network connectivity that enable the Application and Data Architecture Solution Building Blocks. Examples are the dedicated selection of virtual computing environments (for example, container-based), the availability in selected data center locations and the connectivity from office locations to the data centers where the Solution Application Components are operated.

Technology Architecture - Steps

The objectives of this phase are as follows:

  • Develop the Target Technology Architecture that enables the Architecture Vision, target business, data, and application building blocks to be delivered through technology components and technology services, in a way that addresses the Statement of Architecture Work and stakeholder concerns
  • Identify candidate Architecture Roadmap components based upon gaps between the Baseline and Target Technology Architectures
This figure outlines the step towards developing the technology architecture. The objectives within this phase are also listed.
This figure lists information sources.

There are a variety of content sources for the artifacts created in the Technology Architecture phase. The above images provides you with an overview that lists the recommended information sources.

Links:

The Deployment/Landscape of Technology Architecture

The following image outlines the deployment/landscape of the Technology Architecture. It describes the functions of the Software Distribution Diagram and the Environments and Location Diagram.

The following image outlines the deployment/landscape of the Technology Architecture. It describes the functions of the Software Distribution Diagram and the Environments and Location Diagram.

Note

The Software Distribution Diagram belongs to the Application Architecture. However, it provides the input for and may finally lead to the Environment and Location Diagram which provides a much higher level of detail of the Solution Building Blocks from the deployment and operational perspective. Use the Network and Communications Diagram for documentation of network communication lines / VPNs and so on.

The Environments and Location Diagram

The Environments and Location Diagram shows you the Solution Building Blocks that are deployed and operated in which data center location as well as the required physical connections between the Solution Building Blocks.

This figure is an introductory image that to the section on the Environments and Location Diagram. It points out that these diagrams show the geographical location of solution building blocks and the runtime environment-specific details.

The physical locations of the users and other external systems that need to interact with the Solution Components must also be considered (see Context Diagram in Architecture Vision) . This also visualizes which data is exchanged over public lines and where VPN security capabilities need to be added.

Purposes of the Environments and Location Diagram

The following image shows you which of your architecture building blocks and solution building blocks are deployed at which locations. You can also outline different deployment environments such as development, test, and production.

This figure illustrates and lists the purposes of the Software Distribution Diagram, the Deployment Environments, how to Choose Locations, and the Data Flow
Software Distribution Diagram
Pick up the previously created Software Distribution Diagram and evolve it into the Environments and Location Diagram.
Deployment Environments and Locations

Identify the deployment environments in which your Solution Building Blocks are running. Add more details to the "landing zones" of the Software Distribution Diagram by explicitly naming the data center providers, the data center location and infrastructure specific details per "landing zone".

Map the identified solution building blocks to the deployment environments.

Data Flow and required connectivity
Visualize the relationships of type request-response or information flow between the Solution Building Blocks. This helps to understand network requirements.

Environments and Location Diagram

Template

The following template can be used to create an Environment and Location Diagram.

This image outlines the template that can be used to create an Environment and Location Diagram.

Example

The following image provides you with an outline, which is an example of an Environments and Location Diagram.

This image provides you with an outline, which is an example of an Environments and Location Diagram.

Instance Strategy

The Instance Strategy and the SAP System LAndscape Model

Two typical decisions that need to be also taken during the Technology Architecture phase are the decisions about the Instance Strategy and the SAP System Landscape Model. These are not standard artifacts but important architecture decisions which must be documented.

This figure shows you the Instance Strategy and the SAP System Landscape Model. During the Technology Architecture phase, decisions need to be made about both as they are no standard artifacts but important architecture decisions. These decisions must be documented.

Instance Strategy

The Instance Strategy defines how many production systems will be needed per application: a single instance, systems by region or systems by business sector.

This figure tells you that the Instance Strategy defines how many production instances will be needed per application.

SAP Instance - Terminology Overview

The following image provides you with an overview of the terminology related to SAP Instance.

This figure provides you with a basic introduction to the terminology overview, that is, the SAP Landscape (Logical instance), the SAP Environment, the SAP Client, and SAP Instance.
SAP Landscape (Logical instance):
A collection of SAP environments that is used for a common release. For example, production support landscape or project landscape.
SAP Environment:
This is a collection of SAP Instances that is used for a common purpose - for example, Development, QA/Testing, or production environment. Other types can be Training, Pre-Prod/Staging, and Sandbox.
SAP Instance:
This is a single SAP instance of a given component with a specific role - for example, DEV or PRD residing on a separate hardware or partition.
SAP Client:
SAP Client is a logical and legally independent organizational entity and has its own set of user data and separate master records. For more details, see the following material.

SAP Client Concept

This figure illustrates the relationship between the Server, SAP Instances, and Client Independent Configuration.

The types of data in a client are as follows:

  • Master Data: Data that remains unchanged over a long period of time. Master data contains information that is needed again and again in the same way.
  • Transactional Data: Data relating to the day-to-day transactions.
  • (Client specific) Configuration: Configuration (often referred as customizing) is customizations which are done using the "IMG" or by editing the configuration tables directly.
  • Client Independent Configuration: Configuration (often referred as customizing) which is common across multiple clients.

Instance Strategy Overview

Instance strategy is used to describe typical scenarios, including productive landscape, development landscape and template considerations.

This figure describes the instance strategy in different forms: independent, full template - multiple production instances, partial template (global / local), and full template - single production instance.

There are different instance strategy approaches with their characteristics:

Independent:

  • Harmonized SAP release level
  • Completely independent development streams
  • Optional informal information and knowledge sharing

Partial Template (Global/Local):

  • Global development system for common template settings
  • Localization achieved through local development systems
  • Clear differentiation between global and local setting required

Full Template - Multiple Production Instances:

  • One global development system
  • Multiple SIT, PRD systems
  • Well organized transport procedures required

Full Template - Single Production Instance:

Globally centralized DEV, SIT and PRD environment

Seven Instance Strategy Patterns

There are seven Instance Strategy patterns. Each of these is presented in the following figures to illustrate the key differences.

Key differences are illustrated in this figure.

Elements of the ‘House’ Model: Instance Strategy

Elements of the ‘House’ Model: Instance Strategy

The graphical representation in the following figure outlines the elements of the "House" Model that will be used on the following images to explain the seven Instance Strategy patterns.

This figure illustrates basic architectural shapes, including the functions or lines of business, divisions (business units or models and a product portfolio cluster), shared services, regions, and central enterprise management

Single Instance

This figure illustrates the case of single instance.

In the case of single instance, you have benefits on transparency across the whole business, for example:

  • Central Control
  • Reporting and Integration
  • Easier Maintenance
  • Harmonization and Standardization

However, you will have constraints in terms of flexibility (for example, in the case of any change requirement, everybody has to talk to everybody), in addition to mentioning the following:

  • Global Complexity
  • Risk, Performance, Size
  • Ownership
  • Managing Downtime

In case you want to move towards a single instance, you need to assess the following:

  • Globalization Options and Constraints
  • Transaction and User Volumes
  • Competitive Advantage
  • Local Acceptance
  • Ability to Implement
  • Cultural Issues
  • Global network capabilities
  • Reliance on admin, maintenance, and testing tools

Divisional Split

This figure illustrates divisional split - split by business units or models

For all ERP split architecture patterns (divisional, functional, regional), there are benefits from the following:

  • Local Freedom of Choice, Time, and Approach which improves speed and agility
  • Local Independence
  • No Re-engineering Efforts

At the same time, ERP split architectures provide disadvantages in relation to the following:

  • Synergy potential
  • Redundancy and Incompatibility wrt systems, interfaces
  • Redundant Implementation / additional effort in Maintenance
  • No global processes

In case you want to move towards a single instance, you need to assess the following:

  • Global Costs of Incompatibility
  • Global Costs of Implementation and Maintenance

Regional Split

This figure illustrates regional split: split by geographical regions

Challenge in this pattern is the coordination across regions by, for example, Product Line or Business Unit:

  • How do the business units collaborate across the regions? Are the employees working in three different systems?
  • Or are there product lines which are used in a single region anyway?
  • Relationship with internal and external customers: directly to the external customers or between the regional systems (for internal customers)? Or via the headquarters system (acting as a commercial layer)

In the pure definition of a regional pattern, there is no shared service instance. However, in praxis, we always see when a regional pattern is in place that there are global instances for global functions.

Functional Split

There is a special topic that is often discussed, and that is if you could have separate SAP S/4HANA systems, one for finance, and one for order fulfillment and manufacturing, which we call here "functional split".

This figure illustrates the functional split: split by process clusters

The core of SAP S/4HANA was developed with the purpose of an "all-in-one" usage and one of the main benefits is the tight integration between the logistics modules and the finance modules.

While this setup is technically feasible in SAP S/4HANA, most of these companies who had such a setup perceived this as very suboptimal because it introduces additional reconciliation effort in the business and in IT. So, most of these companies are now moving away from a split architecture.

In the case of a split architecture with a separate finance system, also called Central Finance, the additional efforts and risks for operations are due to the following requirements:

  • A "shadow" finance application is needed in the logistics system.
  • Postings from the "shadow" finance applications need to be replicated to the core finance system, on total or line item level or with the Central Finance approach.
  • Finance master data and configuration have to be continuously synchronized between the two systems or-in the case of Central Finance-mapping rules need to be defined and continuously updated.

Impact of Split Architecture on Governance

High level of standardization does not always deliver maximum benefits. An optimal solution often lies in the middle and not at the extreme ends.

This figure represents the impact of split architecture on governance: centralization vs decentralization

Defining the instance strategy is about finding the "sweet spot" and deciding which from the previously introduced strategies is the best for the customers' SAP solutions.

Define the Instance Strategy: Best Practices

Best Practice - Part I

This figure shows you the remaining Instance Strategy options on the shortlist. This shortlist helps you find the option with the best fit for the company's situation.

There is a proven methodology for defining and agreeing in the SAP Instance Strategy:

  • Start with clear problem statement that describes the required decision and the way of achieving it. Decision stakeholders are identified.
  • Identification of decision alternatives (ideally no more than 3-4) that will be further evaluated out of a given set of all possible alternatives. The alternatives to be evaluated are described and documented.
  • Selection criteria are brainstormed then sorted, categorized and weighted.
  • Each alternative Instance Strategy option is scored against each criterion, either collaboratively or by individual assessments that are then aggregated.
  • Preliminary results are then reviewed as a group and discussed with stakeholders. Winning scenarios are reviewed and validated, and the final decision is documented and communicated, concluding with a clear description of the selected Instance Strategy and the evaluation process.
The 7 typical SAP architecture patterns
Start with the 7 typical architecture patterns introduced before.
Understand the patterns
Make the stakeholders involved familiar with the patterns and foster the understanding of their benefits and challenges. Discuss the stakeholder views on the patterns, considering the company's situation.
Discard least fitting options
Depending on the company's situation, some of the patterns can be quickly excluded. Discard the least fitting instance strategies options.
Shortlist of potential Instance Strategy options

Build a shortlist of the remaining potential Instance Strategy options relevant for the company's situation. The list ideally consists of not more than 3-4 option, which are described and documented for the subsequent evaluation process.

The remaining Instance Strategy options on the shortlist need to be evaluated now in more detail to find the option with the best fit for the company's situation.

Best Practice - Part II

This figure outlines the best practices regarding the definition of the Instance Strategy
Evaluation criteria
Create a catalog of evaluation criteria against which you would like to evaluate and compare the options.
Apply weighting
Some criteria might be more important, and hence be weighted higher than others. Decide on the weight of each criteria considering the company's situation.
Rate each Instance Strategy option against each criterion
Rate each Instancy Strategy option from the shortlist against each criterion.
Evaluation document - recommendation for best fit
Document the evaluation of the comparison and give a recommendation to the decision-making body for the best fit. Prepare all the required documents to take a decision.
Decision
Decision-making body to decide on the Instance Strategy.

Hints and best practices for creating the core artifact:

  • This process is an art, not a science - a certain degree of subjectivity is inherent in the process.
  • Defining the right set of stakeholders is essential to getting buy-in for the decision.
  • A collaborative approach is essential, with a core group of stakeholders participating in multiple face-to-face discussions. Responsible or accountable stakeholders who are remote or unable to participate in all workshops are likely not be properly engaged.
  • Take care to define key terms and phrases. It's typical for quite a bit of time to be required for "fleshing out" the meaning of terms and getting all stakeholders on the same page as to the implications and assumptions behind various statements.
  • Critical decisions with far-reaching impact such as the SAP Instance Strategy probably cannot be solved in an intensive 3-day workshop. It's often best to allow the process to occur over several weeks, as it allows for more research and fresh thinking.
  • Financial considerations can be challenging to include as evaluation criteria, especially if costs associated with each scenario are not fully known. It may be necessary to narrow the options by this process, and make the final decision once the financial implications can be calculated in detail.

Define the Instance Strategy: Best Practices

This image is a screenshot of the front cover of the whitepaper entitled Best-Practice Document SAP Production System Strategy for Large Enterprises

To view the whitepaper, choose the following link: https://d.dam.sap.com/a/JAAUmx/WhitePaper_ProductionSystemStrategy_v6_final.pdf

System Landscape Model

Overview

This figure shows you that the SAP System Landscape Model defines the number of environments to be used

The System Landscape Model enables the following:

  • Defines the number of environments to be used
  • Defines the roles and usage guidelines of each environment
  • Defines the sequence of environments in the transport path (this is integral to the defined roles of each environment)

Approach for Defining the System Landscape Model

There are several fundamental system landscape strategies commonly employed by SAP customers. Two of them are presented in the following figures to illustrate the key differences.

This figure provides you with a process flow that shows the Technology Architecture of the System Landscape Model

Only those environments that are essential to the change / release management approach are included in the following figures. SAP customers often have other environments - for example, Sandbox, Training, Pre-Production Testing but these are not included in the models for sake of simplicity.

System landscape model (as development and configuration staging) is also relevant for SAP Cloud products. The typical approach is first to start with ERP / SAP S/4HANA system because other Cloud-LoBs such as SAP SuccessFactors and CX as well as PaaS Cloud / SAP BTP typically mirror and follow S/4H N-tier landscape.

Each of the approaches presented have benefits and weaknesses. The SAP Architect needs to work collaboratively with Development, Maintenance and Testing teams, Implementation partners, and IT Operations stakeholders (for example, Release Management, Change Management and Support) to agree the most appropriate System Landscape Model for the enterprise situation.

As for the Instance Strategy, this process is an art, not a science - a certain degree of subjectivity is inherent in the process, and getting stakeholder buy-in for the decision is of critical importance.

This figure illustrates the Three-System Landscape Model

Three-System Landscape Model, the traditional SAP system landscape model:

Key Principles:

    • QA is a reliable predictor of the impact of changes on PRD
    • High commonality of configuration settings and RICEF objects between QA and PRD
    • All configuration and development work enters the landscape through DEV
    • Integrity of transport sequence is maintained
    • QA is periodically refreshed from PRD, and thus tends to have a large production-quality data set
  • Primary Limitation
    • Challenge of supporting new projects / rollouts in parallel with production support.
      • Integration testing in QA leaves no environment to properly support PRD.
      • Essentially, there is little/no distinction between projects and production support.

The actual system names vary a lot among SAP customers, and the examples here are just for illustration purposes.

QA is periodically copied from PRD and is roughly the same size.

Other systems such as Sandbox or Training may exist, but these are not a primary part of the transport management process.

Integrity of transport request sequence means:

Order of export from DEV = order of import to QA = order of import to PRD

Five-System Landscape Model

This figure outlines the five-system landscape model

The Five-System ("N+1") Landscape Model provides the maximum flexibility in a system landscape:

  • Net Change from Three-System Model
    • Second DEV environment (for example, "DPS") is added to create a separate DEV/QA pairing for both N and N+1, providing maximum isolation of projects and production support.
  • Key Principles:
    • N and N+1 enter the landscape through separate Development environments, and N-based changes are replicated to the N+1 landscape to ensure consistency.
    • N and N+1 have release independence, that is, they do not have to be at the same version/patch levels.
    • The N+1 landscape is assumed to be the primary DEV/QA landscape post-cutover, generally because the volume of changes in N+1 is significantly greater than N.

N+1 changes are brought to QA/PRD eventually, but only at the point of the project's go-live.

  • Primary Benefits:
    • Provides for independent governance of N and N+1, and clear segregation of project and production support changes.
    • Maintenance (upgrades, Support Packages) can be readily included in the scope of N+1.
  • Primary Limitations:
    • As DEV in the N+1 landscape is assumed to be the primary long-term development environment, all production support changes must be re-entered into it through automated or manual procedures.
    • The SAP transport system is not an ideal mechanism for propagation of these changes.
      • Transports can over-write work in progress in the target system.
      • Solutions in the N+1 environments are not assumed to be at the same version/patch levels as N.

SAP S/4HANA Cloud: 2-System Landscape

Depending on your installation, your SAP S/4HANA Cloud is based either on a 2-system landscape or on a 3-system landscape.

This figure outlines the SAP S/4HANA Cloud 2-System Landscape, especially the relationship between the 2-System Landscape, Quality system, and Production system.

The image above illustrates the following:

2-System Landscape
The 2-system landscape consists of a quality system and a production system.
Quality system
The quality system combines development, configuration, and testing activities. You can test your custom developments and configurations separately in the quality system before transporting them to the production system.
Production system
The production system is the system in which you work productively with the content provided by SAP and your custom developments from the quality system.

SAP S/4HANA Cloud: 3-System Landscape

As of September 1, 2022, SAP has made generally available SAP S/4HANA Cloud, 3-system landscape.

This figure outlines the SAP S/4HANA Cloud, especially SAP Central Business Configuration, Development, Test, and Production.

The above image illustrates the following:

3-System Landscape

The 3-system landscape consists of a development system, test system, and production system. Development and testing activities are separated into two dedicated systems. This separation makes it possible to have advanced development projects in the 3-system landscape, enabling developer extensibility options.

Configuration content in the 3-system landscape is always provided by SAP Central Business Configuration, which is connected only to the development system.

Development system
The development system provides a safe environment for development projects that include advanced coding projects. The development system is divided up into two tenants with specific purposes: the customizing tenant and the development tenant.
Test system
When you've finalized your development and configuration projects in the development system, you can transport them to the test system. In the test system, you can test both your custom developments and configurations before forwarding them to the production system.
Production system
The production system is the system in which you work productively with the developments that you created and the content that you configured in the development system and tested in the test system.

For further information, see https://help.sap.com/docs/SAP_S4HANA_CLOUD/a630d57fc5004c6383e7a81efee7a8bb/aa60b129af7b4ce8ae052618c8315d29.html

Three-System Landscape with Starter System

In the Explore phase of the SAP Activate roadmap, the fit-to-standard workshops take part, in which the standard processes of SAP S/4HANA Cloud are reviewed, to determine how they fit with the business requirements. The functionality of SAP S/4HANA Cloud is demonstrated in the starter system, so that one can see how the solution can meet the requirements.

This figure illustrates the Three-System Landscape with Starter System in SAP S/4HANA Cloud

The Starter System includes configuration and master data for your selected cloud solution for targeted enablement of the project team on SAP standard processes and to be host environment of the Fit-to-Standard workshops. It is decommissioned one month after the Production System is delivered.

SAP Business Technology Platform: Account Model Overview

Account Model Overview

This figure outlines the SAP Business Technology Platform. Account Model Overview. It tells that each subaccount holds resources that can be consumed by apps, user who are allowed to work in the subaccount, apps deployed and running in the subaccount, data written by apps running in the subaccount, and the configuration for apps running in the subaccount. Each subaccount is assigned to a Global account and resides in a Region.

Global Accounts

A global account is the realization of a contract you or your company has made with SAP.

A global account is used to manage subaccounts, members, entitlements and quotas. You receive entitlements and quotas to use platform resources per global account and then distribute the entitlements and quotas to the subaccount for actual consumption. There are two types of commercial models for global accounts: consumption-based model and subscription-based model.

Global accounts are region- and environment-independent. Within a global account, you manage all of your subaccounts, which in turn are specific to one region.

Directories

Directories allow you to organize and manage your subaccounts according to your technical and business needs.

A directory can contain directories and subaccounts to create a hierarchy. Using directories to group other directories and subaccounts is optional - you can still create subaccounts directly under your global account.

You can create a hierarchical structure that is 7 levels deep. The highest level of a given path is always the global account and the lowest is a subaccount, which means that you can have up to 5 levels of directories.

Directories allow you to do the following:

  • Group and filter directories and subaccounts
  • Monitor usage and costs for contracts that use the consumption-based commercial model

In addition, you can also add the following features to your directories (optional):

  • Manage Entitlements: Enables the assignment of a quota for services and applications to the directory from the global account quota for distribution to the directory's subaccounts. When you assign entitlements to a directory, you express the entitlements and maximum quota that can be distributed across its children subaccounts. You also have the option to choose the auto-assignment of a set amount of quota to all subaccounts created or moved to that directory. Subaccounts that are already in the directory when you select that option will not be auto-assigned quota.
  • Manage Authorizations: Enables authorization management for the directory. For example, it allows certain users to manage directory entitlements. You can only use this feature in combination with the Manage Entitlements feature.

Subaccounts

Subaccounts let you structure a global account according to your organization's and project's requirements with regard to members, authorizations, and entitlements.

A global account can contain one or more subaccounts in which you deploy applications, use services, and manage your subscriptions. Subaccounts in a global account are independent from each other. This is important to consider with respect to security, member management, data management, data migration, integration, and so on, when you plan your landscape and overall architecture.

Each subaccount is associated with a region, which is the physical location where applications, data, or services are hosted. The specific region is relevant when you deploy applications and access the SAP BTP cockpit using the corresponding cockpit URL. The region assigned to your subaccount doesn't have to be directly related to your location. You could be located in the United States, for example, but operate your subaccount in Europe.

The entitlements and quotas that have been purchased for a global account have to be assigned to the individual subaccounts.

Global accounts and subaccounts are completely independent of user accounts.

Relationship between Subaccounts, Orgs, and Spaces

When you enable the Cloud Foundry environment in one of your subaccounts, the system automatically creates a Cloud Foundry org for you. The subaccount and the org have a 1:1 relationship and the same navigation level in the cockpit (even though they may have different names). You can create spaces within that Cloud Foundry org. Spaces let you further break down your account model and use services and functions in the Cloud Foundry environment.

Regions

You can deploy applications in different regions. Each region represents a geographical location (for example, Europe, US East) where applications, data, or services are hosted.

Regions are provided either by SAP or by our Infrastructure-as-a-Service (IaaS) partners Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and Alibaba Cloud. The third-party region providers operate the infrastructure layer of the regions, whereas SAP operates the platform layer and Cloud Foundry.

A region is chosen at the subaccount level. For each subaccount, you select exactly one region (that is one data center).

Selecting a Region

When you are deciding on the location of your Platform as a Service (PaaS), consider existing Software as a Service (SaaS) and Infrastructure as a Service (IaaS) and try to locate it close to those or even in the same data center. You can also optimize application performance (response time, latency) by selecting a region that's geographically close to your users. However, the selection of a region is also dependent on many other factors. First, check the availability of specific services in the individual regions. Second, ensure that you comply with security requirements, such as country- or industry-specific data privacy regulations. Third, consider the location of other cloud offerings you're using. You might have to locate your solutions in the same data center.

Setting Up Your Account Model

The hierarchical structure between global accounts, directories, and subaccounts lets you define an account model that accurately fits your business and development needs.

When you've signed your commercial contract with SAP, you'll receive access information and credentials for your global account. Use this account to manage the resources and entitlements for your development projects; it's the realization of your commercial contract with SAP. You'll also receive a bill for all resources used in your global account. If you require multiple global accounts for compliance or other reasons, you'll need to sign a dedicated contract for each one.

Note

SAP is currently migrating all global accounts from cloud management tools feature set A to the renovated cloud management tools feature set B. We're doing this migration as a phased rollout, which is why cloud management tools feature sets A and B currently coexist. One big change that came with feature set B is a renovated account model: with feature set B, you can use directories to group and manage subaccounts inside your global account. For more information, see Cloud Management Tools - Feature Set Overview. Ensure that you understand if your global account is already on feature set B.

Within a global account that is on feature set B, you can create up to five levels of directories to further structure your global account according to your business or technical needs. To actually develop and deploy applications, to use services, and to subscribe to business applications provided by SAP, you need to create subaccounts. Directories are optional, but highly recommended as they offer a way to organize your subaccounts and to manage entitlements or users for an entire group of subaccounts. This means you can distribute the resources that are assigned to your global account across directories, and from there to the subaccounts inside a directory. Directories and subaccounts let you structure a global account according to the requirements of your organization and projects with regards to users, authorizations, and quotas.

SAP Business Technology Platform: Account Model Directories

Create a Staged Development Environment

This figure breaks down what is in the global account to set up a staged development environment, in this case, a subaccount for DEV, a subaccount for TEST, and a subaccount for PROD. There is a recommendation in the figure: it states that we recommend that you create at least three subaccounts to set up a staged development environment, including one subaccount each for development, testing, and production.

Using Subaccounts to Create a Staged Development Environment

The number of subaccounts you create, and for which purpose, depends on your organizational setup and your use case.

Recommendation: In general, we recommend that you create at least three subaccounts to set up a staged development environment, including one subaccount each for development, testing, and production.

  • Development - For development purposes and for testing individual increments in the cloud.
  • Testing - For integration testing and testing in production-like environment prior to making it publicly available, to ensure quality delivery. In highly DevOps-driven companies, this subaccount is also used for production applications, as testing occurs in the development subaccount.
  • Production - For production applications.

Considerations For Creating Your Account Model

Although we recommend that you use subaccounts to create a staged development environment, you can also create subaccounts to do the following:

Note

If your global account is on feature set B, you can use directories to further structure your global account.

  • Separate development scenarios and projects to allow for easier configuration, for example, with regard to access restrictions.
  • Separate the work of different development teams.
  • Restrict access to applications and their administration, for example, by setting up "high-security" subaccounts with restricted access, or creating separate subaccounts to connect with your different back-end systems.
  • Share an SAP HANA database in one subaccount with similar projects managed in other subaccounts

Recommendation: We recommend to build an account structure that can easily scale once your organization gets larger or more projects are added. To start off with one subaccount per development stage (feature set A) or one directory that includes these three subaccounts (feature set B) and create more such subaccounts and directories, respectively, as the need arises.

Keep in mind the following considerations when creating different subaccounts:

  • Connections to on-premise systems must be made separately for each subaccount, which also means more work for your Cloud Administration Team. However, it might be easier for you to shut down all integration paths for a project if you've maintained them all in one subaccount. This also lets you control which application uses which on-premise connections.
  • When choosing a region for your subaccount, consider that the region should be close to your customers' geographic location to reduce network latency. In extension scenarios, choose a region that's close to the systems involved. Also, consider any legal requirements and the load distribution when choosing a region.
  • If your S/4HANA tenants need to be segregated for legal or regulatory reasons (for example, for the segregation of subsidiaries of a company), then you should use different subaccounts for their extensions.
  • If the DevOps or operations teams for applications within one subaccount are completely separate, you should consider creating separate subaccounts for them for better maintainability.

Special Considerations for the Cloud Foundry Environment

When you enable the Cloud Foundry environment in one of your subaccounts, the system automatically creates a Cloud Foundry org for you. The subaccount and the org have a 1:1 relationship and the same navigation level in the cockpit (even though they may have different names). You can create spaces within that Cloud Foundry org. Spaces let you further break down your account model and use services and functions in the Cloud Foundry environment.

You can use both subaccounts and spaces to develop applications and to use services. You must therefore decide, for example, whether to create different subaccounts or spaces within one subaccount to set up a staged development environment.

Consider the following:

  • Think of a subaccount as a tenant: Data access and data visibility segregation is done on subaccount level, not on application or Cloud Foundry space level. Keep in mind that services that are consumed by every app within a subaccount will gather messages from all of these services. If those should not be visible across applications, you need to create different subaccounts.
  • In general, we recommend that you create different subaccounts for a staged development environment, as shown below. This allows for dedicated user management between the different stages, as well as for dedicated data management in elastic services, such as SAP IoT Application Enablement.
  • You can then create a dedicated space for each application, extension, solution, or other project within these subaccounts if you don't need a dedicated user management for these applications and projects.
  • You can monitor the consumption of resources in your global account only per subaccount, directory, or Cloud Foundry space. Not per application. To monitor the resources consumed by a specific project, department, or application, create a dedicated subaccount, directory, or space for them.
  • Accurate billing is only possible for global accounts. For the consumption-based model, you can calculate costs according to usage, but note that this is only approximate. See Monitoring Usage and Consumption Costs in Your Global Account on https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/de6f0db8919f4e6f97e54bc4ddaf2ab8.html

Further information and considerations to decide whether to create separate subaccounts or separate spaces within the same subaccount can be found on https://help.sap.com/docs/BTP/df50977d8bfa4c9a8a063ddb37113c43/74eb32ef49804e6e8107338c4ed44d49.html

Account Models with Subaccounts

The following Account Models show ways to structure your global account into subaccounts. Note that all of them are just examples. They are not mutually exclusive and you can adapt them to your own needs.

When your global account is migrated to cloud management tools, feature set B, you will be able to make use of one more hierarchical level within your global account: with feature set B, you can additionally use directories and custom properties to group subaccounts.

For more information, see Cloud Management Tools - Feature Set Overview on https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/caf4e4e23aef4666ad8f125af393dfb2.html and Account Models With Directories and Subaccounts [Feature Set B] on https://help.sap.com/docs/BTP/df50977d8bfa4c9a8a063ddb37113c43/b5a6b58694784d0c9f4ff85f9b7336dd.html

Account Model Directories per Subsidiary

The figure outlines the Account Model Directories per Subsidiary

Account Models with Subaccount

The following Account Models show ways to structure your global account into subaccounts.

Note

All of them are just examples. They are not mutually exclusive and you can adapt them to your own needs.

Account Models With Directories and Subaccounts [Feature Set B]

With cloud management tools feature set B, we're introducing a more flexible account structure with directories.

Directories

Apart from structuring your global account into several subaccounts, you can group individual subaccounts into directories to manage, operate, and analyze such groups of subaccounts together. One global account can contain up to five levels of directories, and can contain n subaccounts each. All examples of using directories are based on Using Subaccounts to Create a Staged Development Environment and only use one level of directories.

Here are a few example use cases where directories help you manage your subaccounts:

  • Administrative reasons: Structure your global account according to the responsibilities within your organization. For example, give each subsidiary, department, or LOB their own directory.
  • Billing purposes: Structure your global account into directories for accounting purposes.
  • Geographical separation: Group subaccounts based on geographical locations to manage different local regulations or to improve network performance for groups that are located together.
  • Business scenario: Group subaccounts that belong to the same business scenario or according to other business needs. This gives you the option to control each business solution separately.
  • Resource limitations: Use the directory structure to control access to resources, limit usage by generating separate usage and cost reports, or define usage limitations, to give more resources to critical directories, or to enable different monitoring per directory. Alternatively, you could structure the subaccounts according to usage limits in different landscapes.
  • Technical reasons: Structure directories and subaccounts according to technical limitation and then add labels for virtual grouping or vice versa.

Account Model Directories per Subsidiary

In this account model, you create directories for each subsidiary of your company. Additionally, you can add labels, for example, for cost centers or owners of the individual subaccounts or directories.

Account Model Directories per Location

This image illustrates the Account Model Directories per Location

Account Model Directories per Location

In this account model, you create different directories for geographical areas. Additionally, for example, you can add labels to subaccounts that belong to the same departments in those locations. Alternatively, you could nest additional directories inside these ones.

Account Model Directories per Functional Area

This figure illustrates Account Model Directories per Functional Area

Account Model Directories per Functional Area

In this account model, you create a separate directory for each functional area. Within each of those directories, three subaccounts (for development, test, and production) are created. For each directory, the functional area can use their own identity provider and manage their entitlements. Additionally, you can make use of labels, for example for the person responsible, cost center, or other aspects that you need for reporting later on.

Account Model: Create a Staged Development Environment using Continuous Integration / Continuous Delivery

Overview

Create a Staged Development Environment Using Continuous Integration / Continuous Delivery

In this account model, a dedicated Development subaccount is created for each development project. Applications that are developed in these subaccounts are consolidated, tested, and published in one single Testing and Production subaccount.

This figure illustrates the Account Model: Create a staged development environment using Continuous Integration / Continuous Delivery

This account model is especially well suited for companies with a focus on continuous integration and continuous delivery, as it lets every development project decide separately about their environment. A central Testing and Production subaccount ensures a high degree of governance, data security, and compliance.

In the Cloud Foundry environment, consider creating separate Development spaces in one subaccount and a dedicated Testing and Production space in a Testing and Production subaccount, respectively.

When to Use Which Account Model

The Account Models shown above show you the ways to structure your global account into subaccounts. Note that all of them are just examples. They are not mutually exclusive and you can adapt them to your own needs. Determine which account model with subaccounts is the most appropriate for your needs.

More examples of account models can be found on Account Models with Subaccounts | SAP Help Portal on https://help.sap.com/docs/BTP/df50977d8bfa4c9a8a063ddb37113c43/049d331effa3434c8b55995f63f92f5f.html

Additional guidance to determine the right account model can be found on When to Use Which Account Model | SAP Help Portal on https://help.sap.com/docs/btp/sap-business-technology-platform/account-model#loio8ed4a705efa0431b910056c0acdbf377

There you can find tables that provide requirements with regards to the project and team setup as well as the services and resources involved. You can compare them against your own requirements and see which account model most closely matches. Take note and remember that the account models are a result of a best-practice approach. They are not mutually exclusive and you may want to use a combination of approaches, if, for example, you have different projects with different requirements.

Example: Extend SAP S/4HANA (Cloud or On-Premise)

The following example shows a possible BTP Account Model to extend SAP S/4HANA system landscape.

  • Mimic leading system landscape of staging
  • If leading system f.e. SAP S/4HANA has 3-tier such as DEV, QA and PROD then we have corresponding setup of subaccounts / spaces
This figure gives you an example of how to Extend SAP S/4HANA (Cloud or On-Premise).

Cloud Connector

If you want an application running on SAP BTP to access data from your on-premise back-end system, we recommend that you use the Cloud Connector. It's an on-premise piece of software that you'll need to install in your on-premise landscape, within the firewall. When it's configured and paired with your SAP BTP subaccount, a secure tunnel is established between SAP BTP (and all the services and applications that run on it) and the Cloud Connector. Communication between SAP BTP and the back-end system is routed by the Cloud Connector through a secure SSL tunnel.

For more information, consider Integrate and Test | SAP Help Portal on https://help.sap.com/docs/BTP/df50977d8bfa4c9a8a063ddb37113c43/84ddc25bf6024506b9c56fbbe4438169.html?q=connector

Log in to track your progress & complete quizzes