What's changed: Created AZ-120 Chapter 1 (Domain 1: target requirements & sizing (SAPS/HANA memory, SAP-certified VMs, supported scenarios, quota, licensing, cost), migration strategy (lift-and-shift/lift-shift-migrate/lift-shift-migrate to HANA, Azure Migrate); Azure environment (Azure RBAC, Entra ID auth, Azure Policy governance, management hierarchy, SAP landing zone); SAP RISE integration (managed SaaS-style, VNet peering/private endpoints/ExpressRoute, data archiving, Entra ID integration)).
1.3Integration with SAP RISE
Understand integrating RISE with SAP (managed SaaS-style SAP) with Azure: networking, compute/network/storage, data archiving, and identity/security design and implementation.
RISE with SAP is a managed SaaS-style SAP offering where SAP holds operational responsibility. Unlike self-managed SAP, the focus is integrating the SAP tenant (often a separate Azure subscription/tenant) with the customer’s Azure environment.
1.3.1RISE networking integration
Because the RISE SAP environment lives in an SAP-managed subscription, design private connectivity to the customer’s VNet. Connect via VNet peering and private endpoints, with ExpressRoute for hybrid, to integrate app tiers, surrounding services, and on-prem at low latency in a closed network. Clarify the boundary and responsibility split between RISE and the customer’s surrounding Azure services (compute/network/storage).
1.3.2Data, identity, and security integration
Integrate data management services (e.g., data archiving to Azure storage) to optimize long-term retention and cost. For identity integration, apply SSO/Conditional Access to RISE apps via Microsoft Entra ID, and fold security service integration (monitoring, threat protection) into the customer’s governance. Design around the split where SAP operates and the customer integrates plus runs surrounding services.
Cues: "RISE is a managed SaaS-style SAP operated by SAP." Connect SAP tenant and customer VNet "privately" = VNet peering/private endpoints; hybrid = ExpressRoute. "long-term retention/cost" = data archiving to Azure storage. Identity = Entra ID SSO/Conditional Access.
Watch the mix-ups: (1) RISE (SAP-managed) vs self-managed SAP (customer-operated). (2) The RISE SAP environment is in a separate subscription/tenant—design private connectivity. (3) Do not blur the responsibility boundary (SAP vs customer). (4) Avoid connecting over the public internet.
1.3.3Section summary
- RISE with SAP = managed SaaS-style operated by SAP; the customer handles integration and surrounding services
- Privately connect the SAP tenant and customer VNet (VNet peering/private endpoints, ExpressRoute)
- Archive data to Azure; integrate identity via Entra ID SSO/Conditional Access
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want low-latency, closed-network connectivity between the RISE with SAP environment (separate subscription) and the customer’s Azure VNet. Best?
Q2. Which is correct about operational responsibility in RISE with SAP?
Q3. You want to offload long-term SAP data to Azure to optimize cost and performance. Best?
Q4. You want to apply SSO and Conditional Access to RISE apps. Best?
Q5. Which correctly distinguishes RISE with SAP from self-managed SAP?