SAP on Azure: Best Practices¶

Landing zone design, HA/DR architecture, monitoring, backup, cost optimization, and CSA-in-a-Box integration for SAP workloads on Azure.

Overview¶

This document consolidates best practices for running SAP on Azure, drawn from Microsoft's SAP Center of Excellence, SAP-certified architecture patterns, and CSA-in-a-Box deployment experience. These practices apply to all SAP deployment models: SAP on Azure VMs (self-managed), RISE with SAP on Azure, and HANA Large Instances.

1. Landing zone design¶

Subscription topology¶

Follow the Azure Landing Zone (ALZ) enterprise-scale pattern with SAP-specific subscriptions:

Management Group Hierarchy
├── Tenant Root Group
│   ├── Platform
│   │   ├── Management (Log Analytics, Sentinel, Monitor)
│   │   ├── Identity (Entra ID, DNS)
│   │   └── Connectivity (Hub VNet, Firewall, ExpressRoute)
│   ├── Landing Zones
│   │   ├── SAP Production (sub-sap-prd)
│   │   │   ├── rg-sap-hana-prd
│   │   │   ├── rg-sap-app-prd
│   │   │   └── rg-sap-network-prd
│   │   ├── SAP Non-Production (sub-sap-nonprod)
│   │   │   ├── rg-sap-hana-qas
│   │   │   ├── rg-sap-hana-dev
│   │   │   └── rg-sap-app-nonprod
│   │   └── CSA-in-a-Box Data (sub-csa-data)
│   │       ├── rg-fabric-workspace
│   │       ├── rg-purview-governance
│   │       └── rg-ai-integration
│   └── Sandbox (sub-sap-sandbox)

Best practices¶

2. High availability architecture¶

HANA HA with availability zones¶

Zone 1                              Zone 2
┌─────────────────────┐            ┌─────────────────────┐
│ HANA Primary (M128s)│            │ HANA Secondary      │
│ ASCS                │            │ ERS                 │
│ App Server 1        │            │ App Server 2        │
│ ANF data/log (zone1)│            │ ANF data/log (zone2)│
└─────────────────────┘            └─────────────────────┘
         │                                  │
         └──────── HSR (syncmem) ───────────┘
         │                                  │
         └──── Azure Load Balancer ─────────┘
                 (Standard, zone-redundant)

HA best practices¶

3. Disaster recovery¶

DR architecture¶

DR best practices¶

4. Monitoring with Azure Monitor for SAP Solutions¶

What to monitor¶

Configure Azure Monitor for SAP¶

# Create Azure Monitor for SAP Solutions resource
az workloads monitor create \
  --resource-group rg-sap-monitoring \
  --name monitor-sap-prd \
  --location eastus2 \
  --app-location eastus2 \
  --managed-rg-name rg-sap-monitor-managed \
  --routing-preference Default

# Add HANA provider
az workloads monitor provider-instance create \
  --resource-group rg-sap-monitoring \
  --monitor-name monitor-sap-prd \
  --provider-instance-name hana-prd \
  --provider-settings '{
    "providerType": "SapHana",
    "hanaHostname": "10.10.1.10",
    "hanaPort": "30015",
    "hanaDatabase": "SYSTEMDB",
    "sqlPort": "30013",
    "hanaDbUsername": "MONITOR_USER",
    "hanaDbPasswordUri": "https://kv-sap-secrets.vault.azure.net/secrets/hana-monitor-password"
  }'

5. Backup strategy¶

Backup matrix¶

Backup best practices¶

6. Cost optimization¶

Reserved Instances¶

Cost optimization best practices¶

# Snooze non-production SAP VMs (Azure Automation)
# Schedule: Stop at 19:00, Start at 07:00 (weekdays)
az vm deallocate --resource-group rg-sap-nonprod --name vm-hana-dev --no-wait
az vm deallocate --resource-group rg-sap-nonprod --name vm-hana-sbx --no-wait
az vm deallocate --resource-group rg-sap-nonprod --name vm-app-dev --no-wait

7. CSA-in-a-Box integration best practices¶

Data integration patterns¶

Analytics best practices¶

Governance best practices¶

AI best practices¶

8. Security best practices¶

9. Operations runbook checklist¶

Daily operations¶

• Verify HANA backup completion (Azure Backup dashboard)
• Check HSR replication status (Azure Monitor for SAP)
• Review SAP system log (SM21) for errors
• Check ABAP dump log (ST22) for new dumps
• Monitor HANA memory utilization (< 80%)
• Review batch job failures (SM37)

Weekly operations¶

• Review Azure Advisor recommendations
• Check HANA alert monitoring (HANA cockpit or ACSS)
• Review security audit log for suspicious activity
• Validate ANF snapshot policy execution
• Check Azure Cost Management for anomalies

Monthly operations¶

• Test backup restore (select one system)
• Review VM right-sizing recommendations
• Update SAP kernel if patches available
• Review Purview data classification scan results
• Update Fabric Mirroring table selection if schema changes

Quarterly operations¶

• Full DR drill (HANA takeover + app restart)
• SAP security review (user access, authorization)
• Cost optimization review (RI utilization, snooze compliance)
• Performance baseline comparison (SAPS, response times)

Last updated: 2026-04-30 Maintainers: CSA-in-a-Box core team Related: Infrastructure Migration | Benchmarks | Federal Migration Guide | SAP to Azure Migration Center