SAP RISE on Azure deployment guide

RISE with SAP on Azure bundles S/4HANA, the HANA database, Azure capacity, and SAP managed operations into one subscription. The price turns on the user model, not on Azure consumption.

How does SAP RISE on Azure actually work?

RISE with SAP is a subscription. SAP is the prime contractor. SAP provisions the S/4HANA Private Cloud Edition, the HANA database, and the Azure capacity underneath, then operates the basis layer for you. You consume the result.

The Azure region is real Microsoft infrastructure, but you do not hold the Azure agreement. SAP does. That single fact reshapes how you negotiate, audit, and exit. SAP publishes the model on its RISE with SAP product page, and Microsoft documents the landing zone on its Azure for SAP workloads guidance.

Who runs what under the bundle?

Responsibility splits across three parties. Knowing the split before signature stops finger pointing during an incident.

• SAP: S/4HANA, HANA, basis operations, patching, and the Azure capacity provisioning.
• Microsoft: the physical Azure region, network backbone, and platform availability.
• You: functional configuration, custom code, integrations, identity, and the ExpressRoute circuit.

Which Azure regions and residency rules apply?

Not every Azure region is offered under RISE. SAP maintains a supported region list and pairs regions for disaster recovery. If your data residency rules require a specific country, confirm availability in writing. SAP describes its data center footprint in the SAP Trust Center.

What changes commercially when RISE runs on Azure?

The metric changes. A traditional license plus Azure consumption model becomes a single FUE subscription. That removes one negotiation and concentrates all leverage on the user count and the service tier.

What is inside the subscription and what is not?

The bundle covers compute, the database, and managed basis. It does not cover connectivity, third party tools, or your integration middleware. Map the gaps before you sign.

Is ExpressRoute and connectivity included?

No. ExpressRoute is your circuit and your cost. Size it for steady state plus peak batch windows. Microsoft explains the options in its ExpressRoute overview.

How do true up and true down work?

FUE adjusts at defined intervals. Most customers can true up easily but find true down restricted to renewal. Negotiate a downward path at signature, not after.

Where the common advice on SAP RISE on Azure is wrong

The standard account team pitch is that RISE on Azure removes infrastructure cost risk because SAP owns the capacity. We disagree. In most of the RISE on Azure estates we have benchmarked, the infrastructure was never the real exposure. The FUE user model was. SAP sizes the opening count high, and connectivity sits outside the bundle. The buyer side move is to run an independent usage review first, then negotiate the FUE band and a true down path before you ever discuss the Azure region. The region is settled engineering. The user count is money.

30 to 40

RISE on Azure deals benchmarked

20 to 35%

Opening FUE overstatement

12 to 25%

HA and DR price swing

Source: Redress Compliance advisory engagement file, 2024 to 2025.

The Azure region is settled engineering. The user count is the number that follows you for three years.

Which architecture choices must you model before signature?

Three choices shape both cost and resilience. Decide them with your own architects, then hold SAP to the result in the order form.

How should you set high availability and disaster recovery?

Pick recovery targets from business need, not from a default tier. A tighter recovery time costs more. Write the recovery point and recovery time objectives into the contract so they are testable.

What integration pattern keeps you flexible?

Favor loosely coupled integration through SAP Integration Suite or your own middleware. Avoid patterns that only work inside one region.

• Identity: federate to Entra ID for single sign on across the estate.
• Data: keep extraction interfaces documented for the exit case.
• Network: design ExpressRoute with a failover path, not a single circuit.

What should a buyer verify before signing RISE on Azure?

Run these checks before the order form is final. Each one is cheaper to fix before signature than after.

How do you confirm region and residency?

Get the named region, the paired DR region, and the residency commitment in writing. A verbal assurance is not a contract term.

• Region: named primary and DR region in the order form.
• Residency: country level commitment where regulation requires it.
• Audit: right to evidence of where data physically sits.

What exit path protects you?

Confirm how you get your data out, in what format, and over what window. The exit clause is the clause that gives you renewal leverage three years from now.

What to do next

1. Run an independent FUE usage review before SAP proposes a count.
2. Separate connectivity and integration costs from the RISE quote.
3. Define recovery point and recovery time objectives, then price HA and DR to them.
4. Get the named region, paired region, and residency commitment in writing.
5. Negotiate a true down path and a downward FUE band at signature.
6. Document data extraction format and timeline in the exit clause.
7. Benchmark the final quote against comparable RISE on Azure deals before you sign.

Frequently asked questions

Do we buy Azure directly under RISE on Azure?

No. Under the standard RISE order form you buy the bundle from SAP, and SAP provisions the Azure capacity. You do not hold a direct Azure agreement, which changes how you negotiate and exit.

What drives the price of RISE on Azure?

The Full Use Equivalent user count drives the price, not Azure consumption. Model your user mix before SAP proposes a count, because the opening figure often runs well above what you can defend.

Is every Azure region available under RISE?

No. SAP offers a supported subset of Azure regions and pairs them for disaster recovery. If residency rules require a specific country, confirm availability and the paired region in writing before signature.

Is ExpressRoute included in the subscription?

No. ExpressRoute is your circuit and your cost. Size it for steady state plus peak batch windows, and design a failover path rather than relying on a single circuit.

Can we use Entra ID for single sign on?

Yes. Identity stays your responsibility, and most customers federate S/4HANA to Microsoft Entra ID for single sign on across the estate. Plan the identity design before go live.

How do true up and true down work on RISE?

True up to a higher FUE count is usually straightforward. True down is often restricted to renewal, so negotiate a downward band and a true down path at signature rather than after.

What happens to our data if we leave RISE?

Your exit depends on the contract. Confirm the extraction format, the timeline, and any assistance before signing, because the exit clause is your main source of renewal leverage later.

How is RISE on Azure different from RISE on AWS?

The commercial model is the same FUE subscription. The differences are regional availability, connectivity options, and identity integration. Choose the hyperscaler your estate already runs on where possible.