SAP on Azure Government: Federal Migration Guide¶

Deploying SAP workloads on Azure Government for DoD financial systems (DFAS, GFEBS), civilian ERP, FedRAMP compliance, IL4/IL5, and ITAR considerations.

Federal agencies running SAP ECC for financial management, HR, logistics, and supply chain face the same December 2027 end-of-mainstream-maintenance deadline as commercial customers. Federal procurement timelines (Authority to Operate, FedRAMP authorization, appropriations cycles) add 6--12 months to migration planning. Federal organizations should begin planning immediately.

Overview¶

SAP runs mission-critical systems across the federal government. The Department of Defense uses SAP for DFAS (Defense Finance and Accounting Service) and GFEBS (General Fund Enterprise Business System). Civilian agencies use SAP for HR, finance, grants management, and procurement. This guide covers the specific considerations for deploying SAP on Azure Government, including compliance frameworks, VM availability, network architecture, and CSA-in-a-Box integration for federal analytics.

1. Federal SAP systems landscape¶

Department of Defense¶

Civilian agencies¶

2. Azure Government compliance for SAP¶

Compliance framework coverage¶

Azure Government vs commercial regions¶

3. SAP-certified VM availability in Azure Government¶

Not all SAP-certified VM sizes are available in every Azure Government region. Verify availability using az vm list-skus --location usgovvirginia --size Standard_M --output table before finalizing your deployment architecture.

Certified VM availability (check at deployment time)¶

# Check VM availability in Azure Government
az vm list-skus \
  --location usgovvirginia \
  --size Standard_M \
  --resource-type virtualMachines \
  --output table

4. Network architecture for federal SAP¶

Hub-spoke topology for federal SAP¶

Azure Government Region (US Gov Virginia)
┌──────────────────────────────────────────────────────────┐
│  Hub VNet (10.0.0.0/16)                                 │
│  ├── Azure Firewall (10.0.1.0/24)                       │
│  ├── Azure Bastion (10.0.2.0/26)                        │
│  ├── VPN Gateway / ExpressRoute (10.0.3.0/24)           │
│  └── DNS Resolver (10.0.4.0/24)                         │
│                                                          │
│  ┌─────────────────────────────────────────────────┐    │
│  │  SAP Spoke VNet (10.1.0.0/16) ── peered to hub │    │
│  │  ├── sap-db-subnet (10.1.1.0/24) → HANA VMs   │    │
│  │  ├── sap-app-subnet (10.1.2.0/24) → App srvrs │    │
│  │  ├── sap-web-subnet (10.1.3.0/24) → Web Disp  │    │
│  │  └── anf-subnet (10.1.4.0/24) → ANF delegate  │    │
│  └─────────────────────────────────────────────────┘    │
│                                                          │
│  ┌─────────────────────────────────────────────────┐    │
│  │  CSA-in-a-Box Spoke (10.2.0.0/16) ── peered    │    │
│  │  ├── data-subnet (10.2.1.0/24) → ADF, Purview  │    │
│  │  ├── analytics-subnet (10.2.2.0/24) → Fabric   │    │
│  │  └── ai-subnet (10.2.3.0/24) → Azure AI        │    │
│  └─────────────────────────────────────────────────┘    │
│                                                          │
│  ExpressRoute → DoD/Agency on-premises network          │
└──────────────────────────────────────────────────────────┘

ExpressRoute for federal connectivity¶

# Create ExpressRoute circuit for DoD network connectivity
az network express-route create \
  --resource-group rg-hub-network-gov \
  --name er-dod-network \
  --provider "Megaport" \
  --peering-location "Washington DC" \
  --bandwidth 1000 \
  --sku-tier Premium \
  --sku-family MeteredData \
  --location usgovvirginia

5. Federal SAP deployment on Azure Government¶

5.1 ACSS deployment in Azure Government¶

# Set Azure Government cloud
az cloud set --name AzureUSGovernment
az login

# Register provider in Gov subscription
az provider register --namespace Microsoft.Workloads

# Deploy SAP Virtual Instance in Gov region
az workloads sap-virtual-instance create \
  --resource-group rg-sap-gov \
  --name GFEBS-PRD \
  --environment Production \
  --sap-product S4HANA \
  --location usgovvirginia \
  --configuration @sap-gov-deployment-config.json

5.2 Federal security controls for SAP¶

5.3 CAC/PIV authentication for SAP¶

CAC/PIV Card → Azure AD Certificate-Based Auth → Entra ID
    → SAML Assertion → SAP NetWeaver → SAP Fiori

# Configure Entra ID for certificate-based authentication (CAC/PIV)
az rest --method PATCH \
  --url "https://graph.microsoft.us/v1.0/organization/<tenant-id>" \
  --body '{
    "certificateBasedAuthConfiguration": [{
      "certificateAuthorities": [{
        "certificate": "<DoD-Root-CA-cert-base64>",
        "isRootAuthority": true
      }]
    }]
  }'

6. IL4 and IL5 considerations for SAP¶

IL4 (CUI)¶

IL4 is the most common classification for federal SAP data. Most SAP financial, logistics, and procurement data is Controlled Unclassified Information (CUI).

IL5 (higher-sensitivity CUI, national security)¶

IL5 is required for SAP systems handling higher-sensitivity CUI or data with national security implications.

# Verify IL5-capable regions
az account list-locations \
  --query "[?metadata.regionCategory=='USGov'].{name:name, displayName:displayName}" \
  --output table

7. ITAR considerations¶

SAP systems in defense and aerospace may contain ITAR-controlled technical data. Azure Government provides ITAR compliance through:

8. CSA-in-a-Box for federal SAP analytics¶

Federal analytics architecture¶

SAP on Azure Government
    │
    ├── Fabric (Gov instance) → OneLake (CUI data)
    │       │
    │       ├── Power BI (Gov) → Financial reports, audit dashboards
    │       ├── Databricks (Gov) → ML for fraud detection
    │       └── Purview (Gov) → CUI classification, data governance
    │
    ├── Azure AI (Gov) → Process intelligence (check model availability)
    │
    └── Sentinel (Gov) → SAP security monitoring + SIEM

Federal compliance mappings in CSA-in-a-Box¶

CSA-in-a-Box provides machine-readable compliance control mappings that can be applied to SAP workloads:

9. Procurement guidance¶

Ordering vehicles for SAP on Azure Government¶

Last updated: 2026-04-30 Maintainers: CSA-in-a-Box core team Related: Security Migration | Infrastructure Migration | Best Practices