What's changed: Created AZ-120 Chapter 1 (Domain 1: target requirements & sizing (SAPS/HANA memory, SAP-certified VMs, supported scenarios, quota, licensing, cost), migration strategy (lift-and-shift/lift-shift-migrate/lift-shift-migrate to HANA, Azure Migrate); Azure environment (Azure RBAC, Entra ID auth, Azure Policy governance, management hierarchy, SAP landing zone); SAP RISE integration (managed SaaS-style, VNet peering/private endpoints/ExpressRoute, data archiving, Entra ID integration)).
1.2Azure environment and governance
Understand authorization and access control for SAP workloads, governance via Azure Policy, authentication, management hierarchy, and Azure landing zones for SAP.
SAP production landscapes are heavily regulated, so design access control, governance, and a standardized foundation (landing zone) on the Azure side.
1.2.1Access control and governance
Authorize with least privilege via Azure RBAC, and authenticate with Microsoft Entra ID (including single sign-on for SAP/SaaS apps). Enforce governance/compliance declaratively with Azure Policy (allowed regions, required tags, encryption, SKU restrictions). Distinguish RBAC ("who can do what") from Policy ("how resources must be").
1.2.2Management hierarchy and landing zones
The management hierarchy is management group → subscription → resource group, with policy/RBAC inheritance boundaries aligned to environment (prod/QA/dev) and billing. An Azure landing zone for SAP is a baseline environment standardizing network, identity, governance, and monitoring, enabling rapid, consistently governed deployment of SAP workloads. For "inherit standards org-wide," use management groups + Policy; for "standardize the SAP production foundation," use a landing zone.
Cues: "who can do what" = Azure RBAC. "how resources must be (enforce regions/tags/encryption)" = Azure Policy. "inherit org-wide" = management groups. "standardize the SAP foundation for rapid deploy" = Azure landing zone. Authentication is Entra ID (SSO).
Watch the mix-ups: (1) RBAC (delegation) vs Azure Policy (resource constraints). (2) Management group (inheritance boundary) vs resource group (placement unit). (3) A landing zone is a standardized baseline, not just one resource group. (4) Policy can deny/remediate, not only audit.
1.2.3Section summary
- Authorize = Azure RBAC (least privilege); authenticate = Entra ID (SSO); govern = Azure Policy (enforce constraints)
- Hierarchy = management group → subscription → resource group for inheritance boundaries
- Azure landing zone for SAP standardizes the foundation (network/identity/governance/monitoring)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to declaratively enforce org standards (allowed regions, required tags, encryption) on SAP resources. Best?
Q2. You want to delegate only SAP resource-group management with least privilege. Best?
Q3. You want a boundary to inherit policy and rights across all org subscriptions. Best?
Q4. You want to standardize the SAP foundation (network/identity/governance/monitoring) for rapid, consistently governed deployment. Best?
Q5. Which correctly distinguishes Azure RBAC from Azure Policy?