SAP RISE on Azure deployment guide.

A buyer side reference for SAP RISE deployments that target Microsoft Azure as the hyperscaler underlay. Commercial mechanics, architecture choices and the checks to run before signature.

RISE with SAP supports three hyperscaler underlays. Microsoft Azure is the most common selection in customers already running M365 and Azure at scale.

RISE on Azure carries its own commercial and operational shape that differs from RISE on AWS or Google Cloud.

This page is the buyer side reference for the checks to run before signing a RISE on Azure deal.

How RISE on Azure actually works

Who runs what

• SAP runs the S/4HANA application, the HANA database and the BTP overlay.
• Microsoft provides Azure compute, storage and network under its own agreement with SAP.
• You own the integration plane, the master data and the custom code in the BTP overlay.

Regions and residency

Azure region coverage under RISE is broad but not the full Azure region list.

Confirm your residency region by name inside the CVR. A region not listed in the CVR is not a commitment.

Commercial mechanics that change on Azure

What is bundled

• Compute and storage for the S/4HANA workload.
• Standard backup retention to Azure cool and archive tiers.
• Network ingress and egress within a defined cap.
• Disaster recovery to a paired Azure region inside the contracted RPO.

ExpressRoute and connectivity

ExpressRoute connectivity is the standard private path between corporate networks and the RISE landscape on Azure.

Validate whether ExpressRoute charges sit inside the bundle or alongside it. Most CVR templates assume alongside.

True up and true down

RISE on Azure commitments can include a true up if S/4HANA workload grows.

Insist on a true down right at each anniversary as a counter to the seller default.

RISE on Azure looks simple on the seller slide. The CVR detail is where the real deal lives.

Architecture choices to model before signature

High availability and disaster recovery

Multi availability zone HA is standard inside a region.

Cross region DR with Azure paired regions is the typical pattern. Validate RPO and RTO numbers against business continuity policy.

Integration pattern

• Azure Synapse and Service Bus integrations need an explicit data exchange path.
• Private Link is the typical clean pattern for internal Azure workloads.
• Public internet integration is allowed but rarely the right design.

Identity and Entra ID

Microsoft Entra ID is the natural identity provider for RISE on Azure tenancies.

Plan the SSO and conditional access pattern before commit, not after.

Buyer side checks before signature

Region and residency confirmation

• Region listed in the CVR by name, not just by geography.
• Residency clause stating data does not leave the region.
• Failover region named in writing for disaster recovery.

Exit path

Confirm the data export format and the assistance commitment on exit.

An exit clause without a defined assistance scope is not a real exit clause.

Suggested reading

• RISE on AWS Deployment Guide. Cross vendor reading from the wider library.
• SAP RISE Negotiation Guide. Cross vendor reading from the wider library.
• SAP BTP Pricing and Licensing. Cross vendor reading from the wider library.

What to do next

1. Confirm the Azure region for production and DR in the CVR by name.
2. Validate the egress cap against your real integration volume.
3. Confirm ExpressRoute commercial treatment in writing.
4. Define RPO and RTO numbers in the order form, not the slide deck.
5. Plan the Entra ID and SSO pattern before signature.
6. Add a true down right and an uplift cap at each anniversary.
7. Brief security, infrastructure and finance jointly before signing.

Frequently asked questions

Do we buy Azure directly under RISE on Azure?

No. The commercial relationship runs through SAP. Microsoft provides the underlay under its own agreement with SAP. You do not get a Microsoft bill for the RISE compute.

Is every Azure region available under RISE?

No. SAP supports a subset of Azure regions for RISE. The list is broad but you still need to confirm your target region by name in the CVR.

Is ExpressRoute included?

Usually no. Most CVR templates assume ExpressRoute is purchased alongside the RISE bundle. Confirm the commercial treatment before commit.

Can we use Entra ID for SSO?

Yes. Entra ID is the typical identity provider for RISE on Azure tenancies. Plan the SSO and conditional access pattern before commitment.

What about M365 and Copilot integrations?

M365 and Copilot integrations are technically possible but commercially separate. Treat them as standalone projects with their own buyer side review.