SAP BTP best practices for enterprise architecture, account management, security, and operations, with verification evidence tracked in the repository ledger. Use when planning BTP implementations, setting up account hierarchies, configuring environments, implementing authentication, designing CI/CD

SAP BTP Best Practices Related Skills sap btp cloud platform : Use for technical implementation details, CLI commands, and runtime configurations sap btp connectivity : Use for connectivity patterns, destination configuration, and Cloud Connector setup sap btp service manager : Use for service lifecycle management and programmatic service operations sap btp developer guide : Use for development workflows, CAP integration, and application patterns sap cap capire : Use when designing CAP applications on BTP or implementing multitenancy sap ai core : Use for AI Core platform setup, model deployment, and orchestration configuration sap cloud sdk ai : Use for SDK level AI integration in CAP or standalone BTP applications sap fiori tools : Use for UI deployment strategies and frontend application guidelines When to Use This Skill Use this skill when designing a BTP account model, setting up governance, choosing commercial/environment patterns, establishing security and authentication defaults, designing CI/CD and operations practices, or reviewing a BTP landscape before implementation. Quick Start 1. Identify the target account model: global account, directories, subaccounts, environments, and regions. 2. Choose the runtime path: Cloud Foundry, Kyma, ABAP Environment, or a hybrid portfolio. 3. Apply security defaults from [Security and Authentication]( security and authentication). 4. Use the relevant implementation skill for detailed execution: sap btp cloud platform , sap btp connectivity , sap btp service manager , sap cap capire , or sap fiori tools . 5. Record production specific gaps in the project plan before changing last verified . Documentation audited SAP BTP implementation guidance based on official SAP documentation. The last verified date remains stale until the source refresh and any live account checks are completed. Quick Links : Official Guide : [https://github.com/SAP docs/btp best practices guide](https://github.com/SAP docs/btp best practices guide) SAP Help Portal : [https://help.sap.com/docs/btp/btp administrators guide](https://help.sap.com/docs/btp/btp administrators guide) Table of Contents 1. [Platform Fundamentals]( platform fundamentals) 2. [Account Model Setup]( account model setup) 3. [Security and Authentication]( security and authentication) 4. [Connectivity]( connectivity) 5. [Governance and Teams]( governance and teams) 6. [Development]( development) 7. [AI Development]( ai development) 8. [Deployment and Delivery]( deployment and delivery) 9. [High Availability and Failover]( high availability and failover) 10. [Operations and Monitoring]( operations and monitoring) 11. [Cost Management]( cost management) 12. [Bundled Resources]( bundled resources) Platform Fundamentals Account Hierarchy Key Points : Global account = contract with SAP (one per commercial model) Directory = groups subaccounts (max 7 levels deep) Subaccount = deployed in specific region, enables runtimes Use labels for virtual grouping (Dev/Test/Prod, cost centers) Environments Environment Use Case Key Features Cloud Foundry Polyglot apps Multiple buildpacks, spaces Kyma Cloud native K8s Open source, namespaces ABAP ABAP extensions RAP, cloud ready ABAP Neo Legacy Migrate away HTML5, Java, HANA XS Commercial Models Consumption Based (BTPEA/CPEA): Flexible access, best for pilots Subscription Based : Fixed cost for known service needs Best Practice : Start with consumption based, move to subscription for stable workloads. Account Model Setup Simple Model (3 subaccounts) Best for: Initial implementations, single team, <3 projects Directory Model (scalable) Best for: Multiple teams, cost allocation, complex governance Naming Conventions Entity Convention Example Subaccount Natural language "HR Development" Subdomain Lowercase, hyphens hr dev acme CF Org Company prefix acme hr dev CF Space Consistent across stages hr recruiting Tip : Derive CF org/Kyma names from subaccount names for consistency. Security and Authentication Identity Provider Setup Always use SAP Cloud Identity Services Identity Authentication Critical Steps : 1. Add multiple administrators (different time zones) 2. Enable MFA for all admins 3. Configure security alerts 4. Set up backup admins in SAP ID Service Authorization Methods Method Best For Notes Provisioning Production, many users Centralized roles, automated offboarding Federation Simple scenarios Real time sync, but doesn't scale well Manual Testing only Quick setup, not production ready Destination Authentication Recommended : PrincipalPropagation SAP on premise systems OAuth2SAMLBearerAssertion Third party systems OAuth2JWTBearer User token exchange Avoid in Production : BasicAuthentication OAuth2Password See : references/security and authentication.md for complete guidance Connectivity Remote System Access Internet Services : Destinations with authentication On Premise Systems : Destinations + Cloud Connector Cloud Connector Lightweight on premise agent Secure tunnel to SAP BTP (no inbound ports) Fine grained access control Supports RFC and HTTP protocols Enables principal propagation Note : Each subaccount needs separate Cloud Connector config. Governance and Teams Required Teams Platform Engineering Team (Center of Excellence) : Manages cloud landscape infrastructure Handles account operations, build infrastructure Creates governance and compliance guidelines Does NOT manage individual application lifecycles Cloud Development Teams : Follow DevOps (develop AND operate) Responsible for application lifecycle Regular maintenance (e.g., UI updates every 6 months) Essential Documentation 1. Onboarding Doc : Organization, app IDs, timeline, tech stack 2. Security Doc : Data sensitivity, policies, auth framework 3. Services Catalog : Templates for destinations, builds, schemas Development Programming Models SAP CAP (Cloud Application Programming Model) : Framework with languages, libraries, tools Supports Java, JavaScript, TypeScript Enterprise grade services and data models ABAP Cloud : Modern ABAP for cloud ready apps RAP (RESTful ABAP Programming Model) Extensions for ABAP based products Development Lifecycle 1. Explore : Business opportunity, team roles 2. Discover : Use cases, technology options 3. Design : UX design, domain driven design 4. Deliver : Landscape setup, development 5. Run and Scale : Feedback, optimization AI Development SAP BTP provides AI capabilities through SAP AI Core for: Generative AI (LLMs, RAG) Narrow AI (classical ML) Key Resources : Repository: [SAP samples/sap btp ai best practices](https://github.com/SAP samples/sap btp ai best practices) Documentation: [https://btp ai bp.docs.sap/](https://btp ai bp.docs.sap/) Best Practices : Use service keys for secure authentication Implement PII data masking Build RAG with SAP HANA Cloud Vector Engine Configure content filtering Monitor model drift Use Cases : 20+ samples including chatbots, PDF extraction, procurement. CAP + AI Integration Patterns : Use SAP Cloud SDK for AI ( @sap ai sdk/orchestration ) inside CAP event handlers — never raw HTTP calls to LLM providers Bind AI Core service instance to CAP app via MTA (plan: extended ) — credentials are managed by BTP, not in code Always process LLM calls asynchronously in production: return 202 Accepted , process in background via cds.spawn . LLM responses can take 30 60 seconds, exceeding BTP load balancer timeouts Externalize prompts into JSON files or CDS entities so they can be updated without redeployment Use HANA Cloud Vector(1536) type in CDS entities for RAG scenarios with the HANA Vector Engine Allocate at least 512MB memory for Node.js containers processing large text payloads with the AI SDK Implement resilience: validate LLM outputs before writing to the database (prevent injection attacks), cache frequent responses for cost control See : references/ai development best practices.md for patterns and examples. For CAP specific code patterns, see sap cap capire skill. For SDK integration, see sap cloud sdk ai skill. Deployment and Delivery Deployment Methods Cloud Foundry/Neo : Package as MTA archive Deploy via: BTP Cockpit, CF CLI, Business Application Studio Kyma : Docker images (Dockerfile or Cloud Native Buildpacks) Helm charts for production Deploy via SAP Continuous Integration and Delivery CI/CD Approaches SAP Continuous Integration and Delivery : Low expertise required Ready to use infrastructure Direct SAP support Project "Piper" : High expertise required Jenkins based Open source community support Best Practice : Combine CI/CD with SAP Cloud Transport Management for governance + agility. See : references/deployment and delivery.md for detailed configs High Availability and Failover Multi Region Architecture Failover Implementation Four Core Principles : 1. Deploy in Two Regions : Near users and backend systems 2. Keep Synced : CI/CD pipeline or Cloud Transport Management 3. Define Detection : Monitor 5xx errors, timeouts 4. Plan Failback : Visual differentiation, user driven Legal : Check cross region data processing restrictions. See : references/failover and resilience.md for implementation details Operations and Monitoring Go Live Checklist 1. Deploy to production 2. Set go live timeframe (avoid quarter end) 3. Embed in SAP Fiori Launchpad 4. Provision business users 5. Configure role collections Monitoring Tools SAP Cloud ALM (Enterprise Support): Real User Monitoring Health Monitoring Integration and Exception Monitoring Job Automation Monitoring SAP Cloud Logging : Observability across CF, Kyma, Kubernetes SAP Alert Notification : Multi channel notifications (email, chat, ticketing) Cost Management Best Practices 1. Check Costs and Usage monthly 2. Provide minimal required entitlements 3. Use labels for cost allocation 4. Set up automated alerts (Usage Data Management + Alert Notification) Contract Strategies Consolidate subscriptions in one global account Use hybrid accounts for mixed workloads Note: Consumption credits non transferable between global accounts Bundled Resources This skill provides comprehensive reference documentation: Account & Governance references/account models.md (11K lines) Detailed account structure patterns Naming conventions and examples Cost allocation strategies references/governance and teams.md (13K lines) Platform Engineering team structure Onboarding processes Documentation templates Security & Connectivity references/security and authentication.md (13K lines) Complete auth methods comparison Destination configuration Kyma RBAC manifests Identity lifecycle management Deployment & Operations references/deployment and delivery.md (10K lines) MTA descriptor templates CI/CD pipeline configs Transport management setup references/operations and monitoring.md (11K lines) Go live procedures Monitoring setup guides Troubleshooting checklists High Availability references/failover and resilience.md (12K lines) Multi region architecture Load balancer configurations Failover automation scripts Templates & Examples references/templates and examples.md (18K lines) Complete code templates Kubernetes RBAC manifests MTA descriptors Helm charts CI/CD configs AI Development references/ai development best practices.md (6K lines)

sap-btp-best-practices