{"id":10831,"date":"2018-07-24T10:25:28","date_gmt":"2018-07-24T17:25:28","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=10831"},"modified":"2023-06-15T14:56:25","modified_gmt":"2023-06-15T21:56:25","slug":"protecting-sap-s-4hana-data-on-azure-at-microsoft","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-sap-s-4hana-data-on-azure-at-microsoft\/","title":{"rendered":"Protecting SAP S\/4HANA data on Azure at Microsoft"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Microsoft recently migrated our SAP environment to Azure on the S\/4HANA platform, and we\u2019re already seeing greater agility, scalability, and efficiency. We recognized the importance of proactively addressing SAP security issues in Azure, and so we developed a strategy to protect SAP assets and data with Azure security solutions and SAP tools. We intend our environment to be secure by design, with integrated systems, tight controls, and effective monitoring so that we can mitigate current and emerging security risks.<\/p>\n
At Microsoft, we recently migrated the enterprise\u2019s SAP environment to Microsoft Azure, as part of our planned transition from SAP ECC 6.0 to the new SAP S\/4HANA platform. We\u2019re already gaining the numerous business and operational benefits that Azure cloud infrastructure affords\u2014and seeing cost savings, too. Moving SAP, our longstanding enterprise resource planning (ERP) solution, onto Azure also marked the beginning of another new chapter: an expanded partnership with SAP. This collaboration enables customers to accelerate their business transformation with S\/4HANA on Azure by leveraging SAP\u2019s managed services and our robust Azure cloud infrastructure.<\/p>\n
The future solution for SAP on Azure represents an exciting milestone for Microsoft and SAP. It also presents security challenges and opportunities because of the complexity of managing critical enterprise solutions. We\u2019re taking this opportunity to design new capabilities and controls to protect our systems and data. We\u2019re also enhancing existing compliance processes and creating new ones to meet our ever-changing obligations. This multifaceted initiative provides an ideal platform for us to use while showcasing the modern engineering approach that we\u2019re developing at Microsoft.<\/p>\n
Our goal is to create an optimal integrated cloud security and compliance strategy for hosting the more complex, configurable, and user-accessible SAP S\/4HANA solution. Our strategy focuses on protecting Microsoft assets and data in a high-profile environment, while streamlining compliance with existing regulations such as Sarbanes-Oxley (SOX) and new ones such as the General Data Protection Regulation (GDPR).<\/p>\n
Our S\/4HANA security-redesign initiative is underway and incorporates the robust Microsoft enterprise-security framework and principles that we have developed over time. It also leverages the Azure-specific security framework that has positioned Azure as a cloud services leader, and it will incorporate the security tools and technology that SAP and its partners have developed. Furthermore, we will integrate industry best practices in every facet of the security infrastructure that we build for S\/4HANA on Azure. This allows us to be agile, efficient, and provide scalability in our SAP environment.<\/p>\n
The current Microsoft SAP security design, developed over the past two decades, has been expanded and improved to meet our needs as our SAP-data footprint has grown. Like many large enterprise organizations, we use the SAP solution to run most of our business operations. Today, our SAP environment includes approximately 600 application servers and is our largest internal application running on Azure, supporting approximately 10,000 business users. Managing security and privacy has become increasingly more challenging, because of the sheer size of our SAP environment and the ever-evolving risk environment.<\/p>\n
For Microsoft and other enterprises that are moving operations to cloud services and continually implementing technologies that expand user capabilities, security (cybersecurity in particular) is a chief concern. Mitigating those concerns is the driving factor behind the multifaceted approach that we\u2019re taking in designing our future SAP security infrastructure and privacy capabilities.<\/p>\n
The transition to SAP S\/4HANA gives Microsoft an ideal opportunity to modernize and streamline our overall security and governance, risk management, privacy, and compliance capabilities so that we can address current and future needs, and challenges as they arise. Our approach is to build and enhance security and compliance, by design, into the entire SAP S\/4HANA solution. At every step in the process, our Business, Compliance, Audit, Engineering\/IT operations, and design teams have been working together with our product groups to ensure that the standards and processes we develop are seamlessly and effectively integrated into the final framework. This differs from the traditional approach that many enterprises use, which entails first developing products and then adding security layers or controls to the finished product.<\/p>\n
In addition to incorporating Azure\u2019s inherent security structure\u2014Azure is already an industry leader in this realm and has more certifications than any other cloud provider\u2014our future framework will feature a highly integrated compliance solution. We also plan to better use our technology capabilities and include automation wherever feasible. We will automate the following areas (and others as we identify them):<\/p>\n
Because S\/4HANA introduces new functionality, we are also using this opportunity to redesign SAP application security and interface authorizations and ensure that we deploy single sign-on (SSO) utilizing Azure Active Directory (Azure AD) across all systems and applications. The modernized authorization framework better aligns with our overall organizational structure. Additionally, it simplifies the S\/4HANA user experience and provides us with more flexibility and scalability to adapt to changes and growth within Microsoft.<\/p>\n
Although we\u2019ll keep many of our traditional application-level security concepts in the future system, the new infrastructure must accommodate the additional complexities of S\/4HANA database access as SAP interface options and user capabilities expand. These interfaces include Fiori Gateway, mobile devices, and the S4 application layer. Changing business practices, such as direct user database access and new cybersecurity risk vectors, also pose challenges in database security for all enterprises. We\u2019ll accommodate this evolving environment with the design of our future-state SAP security and compliance framework.<\/p>\n
The key driver of our SAP-on-Azure security strategy is ensuring that we create a highly flexible, scalable, and automated environment built on top of the Azure platform. Other objectives include:<\/p>\n