/sap-btp-best-practices

name: sap-btp-best-practices
description: |
  SAP BTP best practices for enterprise architecture, account management, security, and operations, with verification evidence tracked in the repository ledger. Use when planning BTP implementations, setting up account hierarchies, configuring environments, implementing authentication, designing CI/CD pipelines, establishing governance, building Platform Engineering teams, implementing failover strategies, or managing application lifecycle on SAP BTP.

  Keywords: SAP BTP, account hierarchy, global account, directory, subaccount, Cloud Foundry, Kyma, ABAP, SAP Identity Authentication, CI/CD, governance, Platform Engineering, failover, multi-region, SAP BTP best practices
license: GPL-3.0
metadata:
  maintainer: "Eduard Jiglau"
  maintainer_email: "hello@sap-ai-skills.com"
  website: "https://sap-ai-skills.com"
  version: "2.4.1"
  last_verified: "2025-11-27"

SAP BTP Best Practices

Related Skills

• **sap-btp-cloud-platform**: Use for technical implementation details, CLI commands, and runtime configurations
• **sap-btp-connectivity**: Use for connectivity patterns, destination configuration, and Cloud Connector setup
• **sap-btp-service-manager**: Use for service lifecycle management and programmatic service operations
• **sap-btp-developer-guide**: Use for development workflows, CAP integration, and application patterns
• **sap-cap-capire**: Use when designing CAP applications on BTP or implementing multitenancy
• **sap-ai-core**: Use for AI Core platform setup, model deployment, and orchestration configuration
• **sap-cloud-sdk-ai**: Use for SDK-level AI integration in CAP or standalone BTP applications
• **sap-fiori-tools**: Use for UI deployment strategies and frontend application guidelines

When to Use This Skill

Use this skill when designing a BTP account model, setting up governance, choosing commercial/environment patterns, establishing security and authentication defaults, designing CI/CD and operations practices, or reviewing a BTP landscape before implementation.

Quick Start

1. Identify the target account model: global account, directories, subaccounts, environments, and regions. 2. Choose the runtime path: Cloud Foundry, Kyma, ABAP Environment, or a hybrid portfolio. 3. Apply security defaults from [Security and Authentication](#security-and-authentication). 4. Use the relevant implementation skill for detailed execution: `sap-btp-cloud-platform`, `sap-btp-connectivity`, `sap-btp-service-manager`, `sap-cap-capire`, or `sap-fiori-tools`. 5. Record production-specific gaps in the project plan before changing `last_verified`.

Documentation-audited SAP BTP implementation guidance based on official SAP documentation. The `last_verified` date remains stale until the source refresh and any live account checks are completed.

**Quick Links**:

• **Official Guide**: [https://github.com/SAP-docs/btp-best-practices-guide](https://github.com/SAP-docs/btp-best-practices-guide)
• **SAP Help Portal**: [https://help.sap.com/docs/btp/btp-administrators-guide](https://help.sap.com/docs/btp/btp-administrators-guide)

---

Table of Contents

1. [Platform Fundamentals](#platform-fundamentals) 2. [Account Model Setup](#account-model-setup) 3. [Security and Authentication](#security-and-authentication) 4. [Connectivity](#connectivity) 5. [Governance and Teams](#governance-and-teams) 6. [Development](#development) 7. [AI Development](#ai-development) 8. [Deployment and Delivery](#deployment-and-delivery) 9. [High Availability and Failover](#high-availability-and-failover) 10. [Operations and Monitoring](#operations-and-monitoring) 11. [Cost Management](#cost-management) 12. [Bundled Resources](#bundled-resources)

---

Platform Fundamentals

Account Hierarchy

Global Account (SAP contract)
├── Directory (optional, up to 7 levels)
│   └── Subaccount (region-specific, apps run here)
│       ├── Cloud Foundry Org → Spaces
│       └── Kyma Cluster → Namespaces
└── Subaccount

**Key Points**:

• Global account = contract with SAP (one per commercial model)
• Directory = groups subaccounts (max 7 levels deep)
• Subaccount = deployed in specific region, enables runtimes
• Use labels for virtual grouping (Dev/Test/Prod, cost centers)

Environments

| Environment | Use Case | Key Features | |-------------|----------|--------------| | **Cloud Foundry** | Polyglot apps | Multiple buildpacks, spaces | | **Kyma** | Cloud-native K8s | Open-source, namespaces | | **ABAP** | ABAP extensions | RAP, cloud-ready ABAP | | **Neo** | Legacy | **Migrate away** - HTML5, Java, HANA XS |

Commercial Models

• **Consumption-Based** (BTPEA/CPEA): Flexible access, best for pilots
• **Subscription-Based**: Fixed-cost for known service needs

**Best Practice**: Start with consumption-based, move to subscription for stable workloads.

---

Account Model Setup

Simple Model (3 subaccounts)

Global Account
├── Dev Subaccount
├── Test Subaccount
└── Prod Subaccount

Best for: Initial implementations, single team, <3 projects

Directory Model (scalable)

Global Account
├── Directory: HR
│   ├── hr-dev / hr-test / hr-prod
├── Directory: Sales
│   ├── sales-dev / sales-test / sales-prod
└── Directory: Central IT
    ├── api-management
    └── shared-services

Best for: Multiple teams, cost allocation, complex governance

Naming Conventions

| Entity | Convention | Example | |--------|------------|---------| | Subaccount | Natural language | "HR Development" | | Subdomain | Lowercase, hyphens | `hr-dev-acme` | | CF Org | Company prefix | `acme-hr-dev` | | CF Space | Consistent across stages | `hr-recruiting` |

**Tip**: Derive CF org/Kyma names from subaccount names for consistency.

---

Security and Authentication

Identity Provider Setup

**Always use SAP Cloud Identity Services - Identity Authentication**

Corporate IdP → Identity Authentication (proxy) → SAP BTP

**Critical Steps**: 1. Add multiple