Service offering

Azure Storage Account Integration

Connecting SAP BTP applications to Azure Blob Storage or ADLS Gen2 over the public internet introduces unnecessary network exposure and latency. SAP Private Link Service eliminates both by routing all traffic from your BTP subaccount directly to your Azure Storage Account over the Microsoft backbone — no public endpoints, no NAT, no data crossing the internet. We deliver the complete setup: Private Link instance, Private Endpoint, BTP Destination, storage firewall hardening, and Integration Suite adapter configuration.

SAP Private Link ServiceAzure Private EndpointAzure Blob StorageADLS Gen2BTP Destination ServiceManaged Identity AuthStorage Firewall HardeningIntegration Suite AdapterAzure RBAC

Connectivity Model

SAP Private Link Service routes traffic from your BTP subaccount directly to your Azure Storage Account over the Microsoft backbone via Azure Private Link — no public endpoints, no NAT, no data crossing the internet. We reference this standard SAP/Azure private-connectivity mechanism rather than re-explain it here; our job is delivering the connection, the approval automation, and the storage hardening around it.

Core Capabilities

Connectivity

Private Link Service Instance & Private Endpoint

Private Link instance and Azure Private Endpoint provisioned and connected, with automated connection approval — the step most manual setups miss — via Azure CLI or Terraform.

BTP Integration

BTP Destination — Private Endpoint Hostname

BTP Destination bound to the Private Link hostname with Managed Identity authentication, validated and tested from both CF and Kyma workloads.

Security

Storage Hardening — Deny Public, RBAC-Only Access

Storage firewall denies all public traffic once the Private Endpoint is validated; access is granted via minimum-scope Azure RBAC only.

Integration Suite

CPI iFlow Adapter Configuration

CPI adapters configured against the private Destination, with container structure and retry handling matched to your integration pattern.

What We Deliver

Private Link Instance & Endpoint

SAP Private Link service instance provisioned in your CF space or Kyma namespace. Azure Private Endpoint created in the designated VNet and subnet, scoped to your Storage Account. Connection approval automated via Azure CLI or Terraform, integrated with your provisioning pipeline. Private DNS zone configured to resolve the storage hostname to the private endpoint IP.

BTP Destination Configuration

BTP Destination of type HTTP created and bound to the Private Link hostname. Authentication configured per your security model — Managed Identity token flow, Service Principal OAuth2 client credentials, or SAS token. Destination validated via the BTP Destination service API. Connectivity smoke test from a CF application or Kyma function confirming private access to the storage account.

Storage Security Hardening

Storage Account network rules updated: public access denied, private endpoint subnet allowed. Storage firewall validated by confirming public access is rejected with a 403. Azure RBAC role assigned to the BTP service principal at container scope — minimum required permissions only. Managed Identity configured where applicable. Blob operation audit logging enabled via Azure Monitor Diagnostic Settings.

Container Architecture & Metadata Design

Azure Blob container structure designed for your integration pattern — inbox, outbox, archive, and staging containers with agreed naming conventions and metadata tagging strategy. Lifecycle management policies configured for automatic archiving and deletion of processed blobs. Access tiers configured per container based on access frequency.

Integration Suite Adapter Setup

CPI adapter configured to use the BTP Destination for private storage access — HTTP or SFTP adapter depending on the integration pattern. Error handling and retry logic validated for transient storage failures. File naming convention, metadata tagging, and archiving flow tested end-to-end with representative payloads. iFlow security review — no hardcoded credentials, adapter configured to use the Destination binding only.

End-to-End Validation & Monitoring

Full connectivity test: BTP app → Destination → Private Link → Private Endpoint → Storage Account, confirmed via live payload. Public access rejection confirmed with a 403 from outside the private network. Azure Monitor alert rules configured for storage availability, latency, and auth failures. Operational runbook covering: Private Link re-provisioning, role rotation, storage firewall rule updates, and DNS troubleshooting.

How Customers Benefit

Zero

Public Internet Exposure for Storage Traffic

All traffic between SAP BTP and Azure Storage flows on the Microsoft backbone. No storage endpoint is reachable from the public internet. Your security team gets a clean answer: this integration does not traverse the internet at any point.

Deny-All

Storage Firewall — Private Access Only

The Storage Account firewall denies all public traffic by default once hardened. Only the Private Endpoint subnet is allowed. Any attempt to access the storage from a public IP — including from within Azure, from other BTP subaccounts, or from the internet — is rejected before it reaches the storage layer.

No Keys

Managed Identity — No Static Credentials

Managed Identity or Service Principal OAuth2 token flow eliminates the need for SAS tokens or storage account keys in application configuration. No credential rotation schedule. No risk of a key leaking in a log or a git history. Access is governed by Azure RBAC with minimum-required permissions at container scope.

Auditable

Every Blob Operation Logged

Azure Monitor Diagnostic Settings capture every read, write, and delete operation on the storage account — caller identity, resource path, timestamp, and result. Combined with RBAC audit logs, this gives compliance and security teams a complete evidence trail without additional tooling.

Native

Works with Integration Suite Out of the Box

The BTP Destination binding pattern is the native way for Integration Suite iFlows to consume external services. Once the Destination is configured, any iFlow can reference the storage connection without embedded credentials or custom HTTP configuration — consistent with how all other BTP external connections are managed.

IaC

Reproducible via Terraform & CLI Automation

Private Endpoint provisioning, connection approval, DNS zone configuration, RBAC assignment, and storage firewall rules are all delivered as Terraform or Azure CLI automation — not a one-time portal walkthrough. Adding a new storage account to the same pattern is hours, not days.

How We Work

Network & Security Design

We review your Azure VNet topology, BTP subaccount structure, and Integration Suite landscape to design the Private Endpoint placement, subnet selection, DNS zone configuration, and RBAC model before any provisioning begins. Authentication method (Managed Identity vs Service Principal) agreed with your security team.

Private Endpoint & Private Link Provisioning

Azure Private Endpoint created via Terraform in the designated subnet. SAP Private Link service instance provisioned in the BTP CF space or Kyma namespace. Connection approved automatically via Azure CLI integrated into the provisioning pipeline. Private DNS zone configured and resolution validated — storage hostname resolves to private IP.

BTP Destination & Container Setup

BTP Destination created and bound to the Private Link hostname with agreed authentication configuration. Azure Blob container structure deployed with naming conventions, metadata tagging, and lifecycle policies. Destination validated via BTP API and smoke-tested from a CF application.

Storage Hardening & RBAC

Storage Account public access disabled — firewall updated to deny all public traffic, allow private endpoint only. Public access rejection confirmed with a 403 test from outside the private network. Azure RBAC role assigned to BTP service principal at container scope. Blob audit logging enabled via Diagnostic Settings.

Integration Suite Configuration & End-to-End Test

CPI adapter configured to use the BTP Destination. Integration Suite iFlow tested end-to-end with representative payloads — write, read, archive cycle confirmed. Error handling and retry logic validated. Monitoring alerts configured. Operational runbook covering Private Link lifecycle, RBAC rotation, and DNS troubleshooting handed over.

Architecture

Azure Storage Account Integration — Reference Architecture

Loading diagram…

Architecture reference: architecture.learning.sap.com

Ready to eliminate public storage exposure?

Let’s connect your SAP BTP and Azure Storage — privately, securely, and without public endpoints.

Tell us about your BTP subaccount structure, Azure storage requirements, and Integration Suite use cases — we’ll design and deliver a private connectivity setup that your security team can sign off on.

Get in touch →