Sap Btp Best Practices

SAP BTP Best Practices

Related Skills

• sap-btp-cloud-platform: Use for technical implementation details, CLI commands, and runtime configurations
• sap-btp-connectivity: Use for connectivity patterns, destination configuration, and Cloud Connector setup
• sap-btp-service-manager: Use for service lifecycle management and programmatic service operations
• sap-btp-developer-guide: Use for development workflows, CAP integration, and application patterns
• sap-cap-capire: Use when designing CAP applications on BTP or implementing multitenancy
• sap-ai-core: Use for AI Core platform setup, model deployment, and orchestration configuration
• sap-cloud-sdk-ai: Use for SDK-level AI integration in CAP or standalone BTP applications
• sap-fiori-tools: Use for UI deployment strategies and frontend application guidelines

When to Use This Skill

Use this skill when designing a BTP account model, setting up governance, choosing commercial/environment patterns, establishing security and authentication defaults, designing CI/CD and operations practices, or reviewing a BTP landscape before implementation.

Quick Start

1. Identify the target account model: global account, directories, subaccounts, environments, and regions.
2. Choose the runtime path: Cloud Foundry, Kyma, ABAP Environment, or a hybrid portfolio.
3. Apply security defaults from Security and Authentication.
4. Use the relevant implementation skill for detailed execution: sap-btp-cloud-platform, sap-btp-connectivity, sap-btp-service-manager, sap-cap-capire, or sap-fiori-tools.
5. Record production-specific gaps in the project plan before changing last_verified.

Documentation-audited SAP BTP implementation guidance based on official SAP documentation. The last_verified date remains stale until the source refresh and any live account checks are completed.

Quick Links:

• Official Guide: https://github.com/SAP-docs/btp-best-practices-guide
• SAP Help Portal: https://help.sap.com/docs/btp/btp-administrators-guide

Table of Contents

1. Platform Fundamentals
2. Account Model Setup
3. Security and Authentication
4. Connectivity
5. Governance and Teams
6. Development
7. AI Development
8. Deployment and Delivery
9. High Availability and Failover
10. Operations and Monitoring
11. Cost Management
12. Bundled Resources

Platform Fundamentals

Account Hierarchy

Global Account (SAP contract)
├── Directory (optional, up to 7 levels)
│   └── Subaccount (region-specific, apps run here)
│       ├── Cloud Foundry Org → Spaces
│       └── Kyma Cluster → Namespaces
└── Subaccount

Key Points:

• Global account = contract with SAP (one per commercial model)
• Directory = groups subaccounts (max 7 levels deep)
• Subaccount = deployed in specific region, enables runtimes
• Use labels for virtual grouping (Dev/Test/Prod, cost centers)

Environments

Commercial Models

• Consumption-Based (BTPEA/CPEA): Flexible access, best for pilots
• Subscription-Based: Fixed-cost for known service needs

Best Practice: Start with consumption-based, move to subscription for stable workloads.

Account Model Setup

Simple Model (3 subaccounts)

Global Account
├── Dev Subaccount
├── Test Subaccount
└── Prod Subaccount

Best for: Initial implementations, single team, <3 projects

Directory Model (scalable)

Global Account
├── Directory: HR
│   ├── hr-dev / hr-test / hr-prod
├── Directory: Sales
│   ├── sales-dev / sales-test / sales-prod
└── Directory: Central IT
    ├── api-management
    └── shared-services

Best for: Multiple teams, cost allocation, complex governance

Naming Conventions

Tip: Derive CF org/Kyma names from subaccount names for consistency.

Security and Authentication

Identity Provider Setup

Always use SAP Cloud Identity Services - Identity Authentication

Corporate IdP → Identity Authentication (proxy) → SAP BTP

Critical Steps:

1. Add multiple administrators (different time zones)
2. Enable MFA for all admins
3. Configure security alerts
4. Set up backup admins in SAP ID Service

Authorization Methods

Destination Authentication

Recommended:

• PrincipalPropagation - SAP on-premise systems
• OAuth2SAMLBearerAssertion - Third-party systems
• OAuth2JWTBearer - User token exchange

Avoid in Production:

• BasicAuthentication
• OAuth2Password

See: references/security-and-authentication.md for complete guidance

Connectivity

Remote System Access

• Internet Services: Destinations with authentication
• On-Premise Systems: Destinations + Cloud Connector

Cloud Connector

• Lightweight on-premise agent
• Secure tunnel to SAP BTP (no inbound ports)
• Fine-grained access control
• Supports RFC and HTTP protocols
• Enables principal propagation

Note: Each subaccount needs separate Cloud Connector config.

Governance and Teams

Required Teams

Platform Engineering Team (Center of Excellence):

• Manages cloud landscape infrastructure
• Handles account operations, build infrastructure
• Creates governance and compliance guidelines
• Does NOT manage individual application lifecycles

Cloud Development Teams:

• Follow DevOps (develop AND operate)
• Responsible for application lifecycle
• Regular maintenance (e.g., UI updates every 6 months)

Essential Documentation

1. Onboarding Doc: Organization, app IDs, timeline, tech stack
2. Security Doc: Data sensitivity, policies, auth framework
3. Services Catalog: Templates for destinations, builds, schemas

Development

Programming Models

SAP CAP (Cloud Application Programming Model):

• Framework with languages, libraries, tools
• Supports Java, JavaScript, TypeScript
• Enterprise-grade services and data models

ABAP Cloud:

• Modern ABAP for cloud-ready apps
• RAP (RESTful ABAP Programming Model)
• Extensions for ABAP-based products

Development Lifecycle

1. Explore: Business opportunity, team roles
2. Discover: Use cases, technology options
3. Design: UX design, domain-driven design
4. Deliver: Landscape setup, development
5. Run and Scale: Feedback, optimization

AI Development

SAP BTP provides AI capabilities through SAP AI Core for:

• Generative AI (LLMs, RAG)
• Narrow AI (classical ML)

Key Resources:

• Repository: SAP-samples/sap-btp-ai-best-practices
• Documentation: https://btp-ai-bp.docs.sap/

Best Practices:

• Use service keys for secure authentication
• Implement PII data masking
• Build RAG with SAP HANA Cloud Vector Engine
• Configure content filtering
• Monitor model drift

Use Cases: 20+ samples including chatbots, PDF extraction, procurement.

CAP + AI Integration Patterns:

• Use SAP Cloud SDK for AI (@sap-ai-sdk/orchestration) inside CAP event handlers — never raw HTTP calls to LLM providers
• Bind AI Core service instance to CAP app via MTA (plan: extended) — credentials are managed by BTP, not in code
• Always process LLM calls asynchronously in production: return 202 Accepted, process in background via cds.spawn. LLM responses can take 30-60 seconds, exceeding BTP load balancer timeouts
• Externalize prompts into JSON files or CDS entities so they can be updated without redeployment
• Use HANA Cloud Vector(1536) type in CDS entities for RAG scenarios with the HANA Vector Engine
• Allocate at least 512MB memory for Node.js containers processing large text payloads with the AI SDK
• Implement resilience: validate LLM outputs before writing to the database (prevent injection attacks), cache frequent responses for cost control

See: references/ai-development-best-practices.md for patterns and examples. For CAP-specific code patterns, see sap-cap-capire skill. For SDK integration, see sap-cloud-sdk-ai skill.