sap-btp-best-practices

SAP BTP Best Practices

Related Skills

• sap-btp-cloud-platform: Use for technical implementation details, CLI commands, and runtime configurations
• sap-btp-connectivity: Use for connectivity patterns, destination configuration, and Cloud Connector setup
• sap-btp-service-manager: Use for service lifecycle management and programmatic service operations
• sap-btp-developer-guide: Use for development workflows, CAP integration, and application patterns
• sap-cap-capire: Use when designing CAP applications on BTP or implementing multitenancy
• sap-ai-core: Use for AI Core platform setup, model deployment, and orchestration configuration
• sap-cloud-sdk-ai: Use for SDK-level AI integration in CAP or standalone BTP applications
• sap-fiori-tools: Use for UI deployment strategies and frontend application guidelines

When to Use This Skill

Use this skill when designing a BTP account model, setting up governance, choosing commercial/environment patterns, establishing security and authentication defaults, designing CI/CD and operations practices, or reviewing a BTP landscape before implementation.

Quick Start

1. Identify the target account model: global account, directories, subaccounts, environments, and regions.
2. Choose the runtime path: Cloud Foundry, Kyma, ABAP Environment, or a hybrid portfolio.
3. Apply security defaults from [Security and Authentication](#security-and-authentication).
4. Use the relevant implementation skill for detailed execution: sap-btp-cloud-platform, sap-btp-connectivity, sap-btp-service-manager, sap-cap-capire, or sap-fiori-tools.
5. Record production-specific gaps in the project plan before changing last_verified.

Documentation-audited SAP BTP implementation guidance based on official SAP documentation. The last_verified date remains stale until the source refresh and any live account checks are completed.

Quick Links:

• Official Guide: https://github.com/SAP-docs/btp-best-practices-guide
• SAP Help Portal: https://help.sap.com/docs/btp/btp-administrators-guide

---

Table of Contents

1. [Platform Fundamentals](#platform-fundamentals)
2. [Account Model Setup](#account-model-setup)
3. [Security and Authentication](#security-and-authentication)
4. [Connectivity](#connectivity)
5. [Governance and Teams](#governance-and-teams)
6. [Development](#development)
7. [AI Development](#ai-development)
8. [Deployment and Delivery](#deployment-and-delivery)
9. [High Availability and Failover](#high-availability-and-failover)
10. [Operations and Monitoring](#operations-and-monitoring)
11. [Cost Management](#cost-management)
12. [Bundled Resources](#bundled-resources)

---

Platform Fundamentals

Account Hierarchy

Global Account (SAP contract)
├── Directory (optional, up to 7 levels)
│   └── Subaccount (region-specific, apps run here)
│       ├── Cloud Foundry Org → Spaces
│       └── Kyma Cluster → Namespaces
└── Subaccount

Key Points:

• Global account = contract with SAP (one per commercial model)
• Directory = groups subaccounts (max 7 levels deep)
• Subaccount = deployed in specific region, enables runtimes
• Use labels for virtual grouping (Dev/Test/Prod, cost centers)

Environments

| Environment | Use Case | Key Features |

|-------------|----------|--------------|

| Cloud Foundry | Polyglot apps | Multiple buildpacks, spaces |

| Kyma | Cloud-native K8s | Open-source, namespaces |

| ABAP | ABAP extensions | RAP, cloud-ready ABAP |

| Neo | Legacy | Migrate away - HTML5, Java, HANA XS |

Commercial Models

• Consumption-Based (BTPEA/CPEA): Flexible access, best for pilots
• Subscription-Based: Fixed-cost for known service needs

Best Practice: Start with consumption-based, move to subscription for stable workloads.

---

Account Model Setup

Simple Model (3 subaccounts)

Global Account
├── Dev Subaccount
├── Test Subaccount
└── Prod Subaccount

Best for: Initial implementations, single team, <3 projects

Directory Model (scalable)

Global Account
├── Directory: HR
│   ├── hr-dev / hr-test / hr-prod
├── Directory: Sales
│   ├── sales-dev / sales-test / sales-prod
└── Directory: Central IT
    ├── api-management
    └── shared-services

Best for: Multiple teams, cost allocation, complex governance

Naming Conventions

| Entity | Convention | Example |

|--------|------------|---------|

| Subaccount | Natural language | "HR Development" |

| Subdomain | Lowercase, hyphens | hr-dev-acme |

| CF Org | Company prefix | acme-hr-dev |

| CF Space | Consistent across stages | hr-recruiting |

Tip: Derive CF org/Kyma names from subaccount names for consistency.

---

Security and Authentication

Identity Provider Setup

Always use SAP Cloud Identity Services - Identity Authentication

Corporate IdP → Identity Authentication (proxy) → SAP BTP

Critical Steps:

1. Add multiple administrators (different time zones)
2. Enable MFA for all admins
3. Configure security alerts
4. Set up backup admins in SAP ID Service

Authorization Methods

| Method | Best For | Notes |

|--------|----------|-------|

| Provisioning | Production, many users | Centralized roles, automated offboarding |

| Federation | Simple scenarios | Real-time sync, but doesn't scale well |

| Manual | Testing only | Quick setup, not production-ready |

Destination Authentication

Recommended:

• PrincipalPropagation - SAP on-premise systems
• OAuth2SAMLBearerAssertion - Third-party systems
• OAuth2JWTBearer - User token exchange

Avoid in Production:

• BasicAuthentication
• OAuth2Password

See: references/security-and-authentication.md for complete guidance

---

Connectivity

Remote System Access

• Internet Services: Destinations with authentication
• On-Premise Systems: Destinations + Cloud Connector

Cloud Connector

• Lightweight on-premise agent
• Secure tunnel to SAP BTP (no inbound ports)
• Fine-grained access control
• Supports RFC and HTTP protocols
• Enables principal propagation

Note: Each subaccount needs separate Cloud Connector config.

---

Governance and Teams

Required Teams

Platform Engineering Team (Center of Excellence):

• Manages cloud landscape infrastructure
• Handles account operations, build infrastructure
• Creates governance and compliance guidelines
• Does NOT manage individual application lifecycles

Cloud Development Teams:

• Follow DevOps (develop AND operate)
• Responsible for application lifecycle
• Regular maintenance (e.g., UI updates every 6 months)

Essential Documentation

1. Onboarding Doc: Organization, app IDs, timeline, tech stack
2. Security Doc: Data sensitivity, policies, auth framework
3. Services Catalog: Templates for destinations, builds, schemas

---

Development

Programming Models

SAP CAP (Cloud Application Programming Model):

• Framework with languages, libraries, tools
• Supports Java, JavaScript, TypeScript
• Enterprise-grade services and data models

ABAP Cloud:

• Modern ABAP for cloud-ready apps
• RAP (RESTful ABAP Programming Model)
• Extensions for ABAP-based products

Development Lifecycle

1. Explore: Business opportunity, team roles
2. Discover: Use cases, technology options
3. Design: UX design, domain-driven design
4. Deliver: Landscape setup, development
5. Run and Scale: Feedback, optimization

---

AI Development

SAP BTP provides AI capabilities through SAP AI Core for:

• Generative AI (LLMs, RAG)
• Narrow AI (classical ML)

Key Resources:

• Repository: SAP-samples/sap-btp-ai-best-practices
• Documentation: https://btp-ai-bp.docs.sap/

Best Practices:

• Use service keys for secure authentication
• Implement PII data masking
• Build RAG with SAP HANA Cloud Vector Engine
• Configure content filtering
• Monitor model drift

Use Cases: 20+ samples including chatbots, PDF extraction, procurement.

CAP + AI Integration Patterns:

• Use SAP Cloud SDK for AI (@sap-ai-sdk/orchestration) inside CAP event handlers — never raw HTTP calls to LLM providers
• Bind AI Core service instance to CAP app via MTA (plan: extended) — credentials are managed by BTP, not in code
• Always process LLM calls asynchronously in production: return 202 Accepted, process in background via cds.spawn. LLM responses can take 30-60 seconds, exceeding BTP load balancer timeouts
• Externalize prompts into JSON files or CDS entities so they can be updated without redeployment
• Use HANA Cloud Vector(1536) type in CDS entities for RAG scenarios with the HANA Vector Engine
• Allocate at least 512MB memory for Node.js containers processing large text payloads with the AI SDK
• Implement resilience: validate LLM outputs before writing to the database (prevent injection attacks), cache frequent responses for cost control

See: references/ai-development-best-practices.md for patterns and examples. For CAP-specific code patterns, see sap-cap-capire skill. For SDK integration, see sap-cloud-sdk-ai skill.

---

Deployment and Delivery

Deployment Methods

Cloud Foundry/Neo:

• Package as MTA archive
• Deploy via: BTP Cockpit, CF CLI, Business Application Studio

Kyma:

• Docker images (Dockerfile or Cloud Native Buildpacks)
• Helm charts for production
• Deploy via SAP Continuous Integration and Delivery

CI/CD Approaches

SAP Continuous Integration and Delivery:

• Low expertise required
• Ready-to-use infrastructure
• Direct SAP support

Project "Piper":

• High expertise required
• Jenkins-based
• Open-source community support

Best Practice: Combine CI/CD with SAP Cloud Transport Management for governance + agility.

See: references/deployment-and-delivery.md for detailed configs

---

High Availability and Failover

Multi-Region Architecture

Custom Domain URL
       │
    Load Balancer
       ├── Region 1 (active)
       └── Region 2 (passive/active)

Failover Implementation

Four Core Principles:

1. Deploy in Two Regions: Near users and backend systems
2. Keep Synced: CI/CD pipeline or Cloud Transport Management
3. Define Detection: Monitor 5xx errors, timeouts
4. Plan Failback: Visual differentiation, user-driven

Legal: Check cross-region data processing restrictions.

See: references/failover-and-resilience.md for implementation details

---

Operations and Monitoring

Go-Live Checklist

1. Deploy to production
2. Set go-live timeframe (avoid quarter-end)
3. Embed in SAP Fiori Launchpad
4. Provision business users
5. Configure role collections

Monitoring Tools

SAP Cloud ALM (Enterprise Support):

• Real User Monitoring
• Health Monitoring
• Integration and Exception Monitoring
• Job Automation Monitoring

SAP Cloud Logging:

• Observability across CF, Kyma, Kubernetes

SAP Alert Notification:

• Multi-channel notifications (email, chat, ticketing)

---

Cost Management

Best Practices

1. Check Costs and Usage monthly
2. Provide minimal required entitlements
3. Use labels for cost allocation
4. Set up automated alerts (Usage Data Management + Alert Notification)

Contract Strategies

• Consolidate subscriptions in one global account
• Use hybrid accounts for mixed workloads
• Note: Consumption credits non-transferable between global accounts

---

Bundled Resources

This skill provides comprehensive reference documentation:

Account & Governance

• references/account-models.md (11K lines)
• Detailed account structure patterns
• Naming conventions and examples
• Cost allocation strategies

• references/governance-and-teams.md (13K lines)
• Platform Engineering team structure
• Onboarding processes
• Documentation templates

Security & Connectivity

• references/security-and-authentication.md (13K lines)
• Complete auth methods comparison
• Destination configuration
• Kyma RBAC manifests
• Identity lifecycle management

Deployment & Operations

• references/deployment-and-delivery.md (10K lines)
• MTA descriptor templates
• CI/CD pipeline configs
• Transport management setup

• references/operations-and-monitoring.md (11K lines)
• Go-live procedures
• Monitoring setup guides
• Troubleshooting checklists

High Availability

• references/failover-and-resilience.md (12K lines)
• Multi-region architecture
• Load balancer configurations
• Failover automation scripts

Templates & Examples

• references/templates-and-examples.md (18K lines)
• Complete code templates
• Kubernetes RBAC manifests
• MTA descriptors
• Helm charts
• CI/CD configs

AI Development

• references/ai-development-best-practices.md (6K lines)
• Generative AI patterns
• RAG implementation
• 20+ use cases catalog

Progress Tracking

• Implementation status
• Coverage details
• Validation checklists

---

Administration Tools

| Tool | Use Case |

|------|----------|

| SAP BTP Cockpit | GUI for all admin tasks |

| btp CLI | Terminal/automation scripting |

| REST APIs | Programmatic administration |

| Terraform Provider | Infrastructure as Code |

| SAP Automation Pilot | Low-code/no-code automation |

---

Shared Responsibility Model

SAP Manages:

• Platform software updates/patches
• Infrastructure and OS monitoring
• BTP service monitoring
• Capacity management and incidents
• Global account provisioning
• HANA database operations
• Kyma kyma-system namespace

You Manage:

• Global account strategy and subaccount config
• Application development, deployment, security
• Role assignments and integrations
• Application monitoring and health checks
• Open source vulnerability scanning
• Triggering HANA revision updates

---

Last Updated: 2026-06-16

Review Progress: See SAP_SKILLS_REVIEW_PROGRESS.md

Next Review: Source refresh pending; do not advance last_verified without primary-source evidence.