Security and Encryption for SAP
Secure SAP on Azure with network controls (NSGs, Azure Firewall, Bastion), encryption at rest and in transit (ADE, SSE, CMK, HANA TDE, TLS), identity with Entra ID SSO, RBAC, Azure Policy compliance, and OS patching with Update Manager.
Defense in depth for SAP
🔧 Aisha reviews the security checklist. “SAP contains the most sensitive data in any organization — financial records, employee data, supplier contracts, manufacturing formulas. At TradeCorp, Carlos says security is job one. We need defense in depth: network controls, encryption, identity management, and continuous compliance.”
Carlos emphasizes. “Our industry regulators can audit us at any time. We need to prove that SAP data is protected in transit, at rest, and from unauthorized access.”
Think of it like securing a bank vault.
Network security is the outer walls and guards (who gets in the building). Encryption at rest is the vault door (data is scrambled even if someone breaks in). Encryption in transit is the armored truck (data is protected while moving). Identity management is the key card system (only authorized people access specific areas). Compliance is the auditor who checks that all locks work. You need all layers — no single layer is enough.
Network security
NSGs, Azure Firewall, and Private Endpoints
Reviewed in the networking module, now applied as a security discipline:
- NSGs — restrict traffic to known SAP ports (32xx, 33xx, 36xx, 3xx13/15/17) and trusted source IPs
- Azure Firewall — centralized egress filtering in the hub VNet. Block SAP VMs from reaching the internet directly. Allow only required endpoints (SAP support, OS update repos, Azure services)
- Private endpoints — access Azure PaaS services (Storage, Key Vault, Backup) over private IPs. SAP VMs never traverse the public internet to reach Azure services
- Azure Bastion — secure RDP/SSH access to SAP VMs without exposing management ports to the internet. Eliminates the need for jump boxes with public IPs
Exam tip: Bastion for management access
If the exam asks how to securely access SAP VMs for administration, Azure Bastion is the answer. It provides browser-based RDP/SSH through the Azure portal without public IPs on the SAP VMs. Jump boxes with public IPs are the legacy approach and not recommended.
Encryption at rest
| Method | What it encrypts | Key management | SAP awareness |
|---|---|---|---|
| SSE (Server-Side Encryption) | Azure Managed Disks — all data written to disk | Platform-managed or customer-managed keys (CMK) | Transparent to SAP — no configuration needed |
| ADE (Azure Disk Encryption) | Entire OS and data disks using BitLocker (Windows) or dm-crypt (Linux) | Keys stored in Azure Key Vault | Transparent to SAP — operates at OS level |
| HANA TDE | HANA data and log files within the database | HANA internal key management or Azure Key Vault integration | SAP-specific — encrypts database content independently of disk encryption |
| Customer-managed keys (CMK) | Used with SSE or ADE for customer-controlled key lifecycle | Azure Key Vault with customer-controlled rotation | Transparent to SAP — key management layer |
🔧 Aisha explains. “We use SSE with customer-managed keys as the baseline — every disk is encrypted by default. On top of that, HANA TDE encrypts the database content inside HANA. Belt and suspenders.”
When to use which
- SSE (default) — always enabled, platform-managed keys. No configuration needed.
- SSE + CMK — when compliance requires customer-controlled encryption keys with rotation policies
- ADE — when you need OS-level encryption visible in the guest (some compliance frameworks require it)
- HANA TDE — when you need database-level encryption independent of the infrastructure layer (data is encrypted even in HANA memory exports)
Encryption in transit
All SAP communication should be encrypted in transit. Different SAP protocols use different encryption mechanisms:
- HANA internal communication (data and log replication) — HANA’s built-in TLS/SSL encryption configured in HANA parameters
- SAP GUI connections — SNC (Secure Network Communications) for the proprietary DIAG protocol used by SAP GUI and RFC connections. SNC is not TLS — it is SAP’s own cryptographic layer for non-HTTP protocols
- Web Dispatcher to Fiori — HTTPS with TLS certificates (standard web encryption)
- RFC connections between SAP systems — SNC encryption (for the SAP-proprietary RFC protocol)
- HANA client connections — TLS on the HANA SQL port
- Azure Load Balancer passes through encryption — it does not terminate TLS or SNC for SAP
Identity and access management
Entra ID SSO for SAP
Microsoft Entra ID (formerly Azure AD) provides single sign-on for SAP applications using SAML:
- Users authenticate once in Entra ID and access SAP without re-entering credentials
- Configure SAP as a SAML enterprise application in Entra ID
- Map Entra ID attributes to SAP user attributes
- Supports conditional access policies (MFA, device compliance, location-based access)
- Works with SAP Fiori, SAP GUI for HTML, and SAP Business Technology Platform
RBAC for Azure resources
Azure RBAC controls who can manage SAP infrastructure:
- SAP Basis admins get Contributor role on SAP resource groups (manage VMs, disks, networking)
- Security team gets Reader + security-specific roles
- Developers get restricted access to dev/test resources only
- Use custom roles to limit dangerous operations (e.g., prevent VM deletion)
SAP BTP integration
SAP Business Technology Platform (BTP) can integrate with Azure services:
- Principal propagation from Entra ID to SAP BTP for unified identity
- Azure Private Link for secure connectivity between Azure and BTP
- Not heavily tested on AZ-120 but know it exists as an integration point
Compliance with Azure Policy
Azure Policy enforces organizational standards on SAP resources:
- Require encryption on all managed disks
- Enforce specific VM sizes (only SAP-certified SKUs)
- Require NSGs on all subnets
- Deny public IP addresses on SAP VMs
- Require tags on all resources (cost center, environment, SID)
- Audit compliance status for security reviews
OS patching with Update Manager
Azure Update Manager (formerly Update Management) automates OS patching:
- Schedule maintenance windows for SAP VMs
- Coordinate patching with SAP maintenance calendar
- Patch non-production first, then production after validation
- Supports both Linux (SLES, RHEL) and Windows
- Integration with Azure Automation for pre/post scripts (stop/start SAP services)
Knowledge check
TradeCorp's compliance team requires customer-controlled encryption keys for all SAP disks. What should Aisha configure?
Carlos needs to provide SAP Fiori users with single sign-on using their corporate credentials. What should Aisha configure?
Aisha needs to securely access SAP VMs for troubleshooting without exposing RDP/SSH ports to the internet. What should she use?
Summary
You now understand the complete security stack for SAP on Azure: network controls (NSGs, Firewall, Private Endpoints, Bastion), encryption at rest (SSE, ADE, CMK, HANA TDE) and in transit (TLS for HTTP/HTTPS, SNC for SAP GUI/RFC, HANA internal encryption), identity (Entra ID SSO with SAML, RBAC), compliance (Azure Policy), and patching (Update Manager). Defense in depth means no single layer is trusted alone.
Next, we add a security layer specifically designed for SAP: Microsoft Sentinel for SAP threat detection.
🎬 Video coming soon