SAP Community - SAP Build Work Zone, advanced edition

SAP UX Q3/2025 Update – Part 1: AI, Joule, SAP Build Work Zone, SAP Mobile Start

2025-07-29T07:30:00.042000+02:00

This series of posts gives an overview of user experience innovations in the cloud from the last six months, covering our whole portfolio, such as AI and Joule, SAP S/4HANA Cloud Public Edition 2508, SAP SuccessFactors, as well as covering innovations in our UI technologies for building great UX.

In this first post, we’ll look at the latest cross-suite UX innovations, coming from Joule, SAP Work Zone and SAP Mobile Start.

Here are the links to the other posts in the series published so far:

Before we get started: if you haven’t already seen them, do have a look at the overview of public cloud UX innovations I posted in Q1/2025 (parts 2 to 7 are linked in part 1):

SAP User Experience Q1/2025 Update – Part 1: Many New Innovations Available (AI, Joule and More).

This upcoming series of posts includes Joule and AI UX highlights from individual products within the SAP Business Suite, but for a more comprehensive overview of our recent AI innovations, not just UX related, have a look at:

Joule User Experience Innovations

Joule is the AI-powered copilot for SAP systems, offering a powerful new user experience, using natural language to access our cloud products and providing a seamless flow for the user wherever they are, on desktop, laptop or mobile devices.

First, we’ll have a look at the latest generic or cross-product UX innovations, before I give you some pointers to the product-specific innovations as well as news about developing custom capabilities.

Cross-Product Joule UX Innovations

This section covers these user experience innovations:

Joule Analytical Pattern.
Joule supports multiple conversations.
Use Joule in 11 languages.
Joule stand-alone: Joule for Consultants
Joule in Microsoft 365 Copilot and Microsoft Teams
Joule Agents.

Joule Analytical Pattern

This new pattern is available in all products which give users access to our Joule copilot. This new pattern is powered by SAP Analytics Cloud, with data from models that are indexed by the Just Ask feature of SAP Analytics Cloud.

Figure 1: Example Joule Analytical Pattern. Alt Text: an animated GIF showing how a user asks Joule “Show me sales commission by agend for model bike sales”, and how Joule shows a horizontal bar chart for top 5 sales commissions per sales agent.

As you can see in figure 1, users can now access analytical insights from the product they are working in, without having to first navigate to SAP Analytics Cloud, making work more efficient and hence also more enjoyable.

The example in figure 1 is what we call a descriptive question, but Joule can respond to a wide range of queries:

Descriptive questions, such as “What is the total revenue for Q1?” or “Show me sales by region in 2025”.
Comparative analysis, such as “Compare sales between 2023 and 2024" Or How do profits in Germany compare to France?”
Time series analysis, such as “Show me sales by month” or “Show the trend of customer acquisitions over the last 6 months”.
Top / Bottom N analysis, such as “Show me top 5 sales by store” or “List the bottom 3 regions in terms of sales”.

Find out more in this blog post:

Introducing Analytical Insights in Joule: Empowering Smarter Decisions, Instantly.

With the introduction of this new pattern, Joule now supports four interaction patterns:

Informational pattern, for querying written documents, such as SAP documentation in the SAP Help Portal, or customer policies etc.
Navigational pattern, for finding and navigating to applications.
Transactional pattern, for interacting directly with business applications.
Analytical pattern, for answering analytical queries directly in Joule.

Joule Supports Multiple Conversations

When having a conversation with Joule, you can ask follow-up questions, building on the previous questions and answers in the conversation, since Joule keeps the context.

Now you can initiate up to ten conversations in parallel, with Joule keeping the context for each of the conversations, so that when you return to a previous conversation you can continue where you left off. Figure 2 shows what this looks like.

Figure 2: Joule supports multiple conversations. On the left, a conversation was started by asking “How many languages does Joule support”. On the right, you see how active and expired conversations are shown. Alt Text: On the left, Joule replies with “Joule currently supports eleven language officially” and then lists them, below the answer a link to the source document “Joule Multi Language Support” is provided. On the right, the conversation history sidebar is visible on the left, overlaying half the screen, with a button “+ New Conversation” at the top, followed by a section “Active” with two conversations and a sectin “Expired” with four. The bottom contains a link to “Settings” and on to “AI Notice”.

You can return to conversations within 8 hours. To start a new conversation, simply click on “New Conversation”. The old conversation will be listed in the “Active” section, as you can see in Figure 2. The title of the conversation is automatically created by Joule using AI; users can rename the titles when they return to the conversation. Joule supports a maximum of 10 active conversations.

After 8 hours, the conversation expires but is not deleted. It is kept read-only in the “Expired” section, as shown in Figure 2. Conversations are finally deleted 7 days after the creation date.

In the browser, Joule can be expanded to fill the screen, as shown in Figure 3.

Figure 3: Joule expanded to full-screen mode, showing the conversation history sidebar and the chat side by side. Alt Text: The same information is shown as on both screens of Figure 2, since the conversation history sidebar does not overlay the chat, and the chat is shown on the right with much more screen width.

Find out more in the documentation:

Using the Joule Web Client.

Use Joule in 11 Languages

Figure 3 shows that you can ask Joule which languages it supports, and it will answer with the list of 11 languages. Here they are in alphabetical order, with the variant of the language in brackets.

Chinese (Simplified)
English (US)
French (France)
German (Germany)
Greek
Japanese
Korean
Polish
Portugese (Brazil)
Spanish (Spain)
Vietnamese

Joule Stand-alone – Joule for Consultants

In addition to providing Joule embedded in our products, we have a design pattern called Joule stand-alone, which we use for Joule for Consultants. With this pattern, Joule can be started directly, without first opening an SAP product and then opening Joule via the icon in the shell header. Joule stand-alone is opened in full screen, as shown in Figure 4.

Figure 4: Joule for Consultants using the Joule stand-alone pattern. Alt-Text: Joule full-screen, with one active conversation “Can you explaine about SAP Clean Core”, followed by a comprehensive answer, and scrolling options for reading the entire text”.

By supporting this pattern, people can open up Joule for Consultants directly and start asking questions about implementing or extending SAP products. Since in this case Joule is stand-alone, as the name suggests, the conversations you have there are not visible in the Joule instance that is embedded in our products, and vice-versa.

Joule in Microsoft 365 Copilot and Microsoft Teams

How often have you been in a chat with a colleague and needed to find some information from an SAP system? Up until now this would involve you leaving the chat, going to a different window and navigating to the right SAP application to get what were looking for.

Now, you can chat directly with Joule in Microsoft Teams, use Joule in Microsoft Teams and Microsoft Teams Mobile as an app, and ask Joule questions directly in Microsoft 365 Copilot. To get an idea of how powerful this is, watch this video:

To get started, have a look at the documentation:

Integrating Joule with Microsoft 365 Copilot

Joule Agents

We are bringing SAP Business AI to the next level via Joule Agents, that can autonomously plan and execute multi-step workflows.

Why do I include this in a section on user experience updates? Aren’t Joule Agents a back-end thing? Well… the reason is simple: Joule Agents significantly enhance the overall user experience, as opposed to the user interface, because the system will do a lot more for you based on your requests. This means that the overall experience you have using SAP goes up a level, since you can get a lot done much more easily than before.

Joule Agents can be triggered from Joule directly, or embedded within applications. These four marketing videos show you examples of agents available today:

Finance: Dispute Resolution Agent (1:38 minutes)
Procurement: Sourcing Agent (1:48 minutes)
Sales and services: Account Planning Agent (1:24 minutes)
Human Resources: Performance and Goals Agent (1:34 minutes)

This example for customer service agents goes into more detail:

CX Agents (in SAP Discovery Center).

For a general overview of Joule Agents, have a look here:

Joule Agents on sap.com.
AI Agents in Action (blog post).
Envision the Future of Generative AI with SAP's AI Agents (blog post).
How SAP’s AI Agent Architecture Enables Unprecedented Automation and Decision Augmentation (blog post by Philipp Herzig).

Product-specific capabilities

In addition to the above generic capabilities, our products provide a large number of Joule skills for getting your work done more efficiently, as well as a handful of the new agents discussed above. For a comprehensive overview of Joule capabilities, including product-specific skills available today, here’s where to go:

Joule Capabilities (a 484 page (!) PDF document from July 11th, 2025, including a list of What’s New)
Joule Capabilities (online documentation)

Customer-specific Joule skills

You can now build your own Joule skills using Joule Studio, which has now been made generally available. Read Michael Ameling’s overview blog post:

Joule Studio is generally available in SAP Build: Empower your business with intelligent automation

Joule on Mobile Devices – now for SAP SuccessFactors too

Joule has been available via SAP Mobile Start since Q1/2025 (as announced in this blog post), and is now also available directly from within the SAP SuccessFactors mobile app, supporting these three patterns:

Transactional: Joule can handle tasks like requesting time off, updating contact information, and even deleting phone numbers, directly within the chat interface.
Navigational: Joule can guide users to specific pages within the app based on their requests, such as directing them to where they can assign team goals.
Informational: Joule can access documentation and knowledge bases to answer questions about company policies, HR guidelines, and other relevant information, providing summaries and links to related resources.

Figure 5 shows two examples of the transactional pattern plus one example of the informational pattern (“Can I use my private car for my business trip?”).

Figure 5: Examples of Joule on the SuccessFactors Mobile App. Alt Text: The image shows three examples: The first shows the response to the request by a manager “View time off approval”, with the details of one request, including the employee's name, the time-off period, and the type of time-off (vacation). The user can view the details, approve, or decline the request. The second screen shows a conversation where the user asks if they can use their private car for a business trip, and the system responds that they can, providing details on the reimbursement policy. The third screen shows the user requesting one day of vacation leave on March 3, 2025. The system confirms the request and provides the details of the leave, including the start and end times, and the date the user will return to work.

Find out more here:

Further information on Joule

If you want an overview of what’s new, or want to set up Joule in your landscape, have a look at the documentation:

Joule documentation (including What’s New, What is Joule?, integration guide)
What is Joule? PDF file

For an overview of what is planned, have a look at the road map for Joule in the SAP Road Map Explorer:

Joule Road Map.

SAP Build Work Zone

SAP Build Work Zone users and administrators benefit from these recent innovations:

New Side navigation for SAP Build Work Zone, standard edition.
SAPUI5 version preview.
Mobile Start supports Work Zone, advanced edition.

New Side Navigation

As I announced in April, in my blog post Upcoming Design Updates for the SAP Business Suite (SAP Fiori for Web), we are introducing some design updates to all our products in the SAP Business Suite to further increase consistency, helping users to feel confident and at ease when using a suite of products – no unexpected surprises. One of these is the introduction of a navigation menu on the left side of the screen.

SAP Build Work Zone, standard edition, is the first product to support this new design. Figure 6 shows what it looks like when the navigation menu is expanded, while Figure 7 shows it collapsed.

Figure 6: Side navigation expanded for SAP Build Work Zone, standard edition. Alt Text: A screen showing a SAP Build Work Zone screen with a navigation menu on the left with four entries “Central Procurement”, “Global Support”, “My IT Experience” (selected), and “Self Services”. On the right various cards are shown in a section “Employee Information”.

Figure 7: Side navigation collapsed for SAP Work Zone, standard edition. Alt Text: similar to Figure 6, but with the navigation menu on the left collapsed to the width of an icon, with four icons shown representing the four navigation options.

SAPUI5 Version Preview

We have introduced a new feature that allows administrators to preview upcoming SAPUI5 versions in non-productive environments within SAP Build Work Zone, two weeks before they are adopted in the productive environment. Until now, the latest SAPUI5 versions were automatically adopted in production environments, which limited opportunities for early evaluation ahead of deployment.

By enabling the preview setting on specific non-productive sites, administrators can assess compatibility and performance with the upcoming version. This controlled testing environment helps identify and address potential issues, reducing the likelihood of disruptions in production. After the two-week preview period, the RTC version becomes the default, aligning all sites with the latest stable release.

When looking at the sites in the site directory, those sites for which the preview is switched on are indicated clearly, as shown in Figure X.

Figure 8: Site directory with a site where preview is turned on. Alt Text: the image shows a card from the site directory for a site called “Preview SAPUI5 Demo” with a green badge containing the text “SAPUI5 Preview Enabled”.

Read more about this feature in this blog post:

Introducing SAPUI5 Version Preview in SAP Build Work Zone.

SAP Mobile Start Supports SAP Work Zone, Advanced Edition

When using SAP Mobile Start with SAP Build Work Zone, advanced edition, you can now access your Workspaces or Feed Updates. As with the standard edition, your native and web apps are available within the Apps Screen of SAP Mobile Start, as well as in your Favorites Section on the Start Screen, based on your individual selection.

Tasks and Notifications from SAP Build Work Zone, advanced edition, are also integrated into SAP Mobile Start: they are shown next to your business tasks and situations in the To-Do sections and in the Notification Center. Figure 9 shows an example with notifications from the advanced edition.

This integration is automatically available to customers with SAP Build Work Zone, advanced edition or SAP SuccessFactors Work Zone if the SAP Mobile Start toggle is enabled in the Site Manager.

Figure 9: SAP Mobile Start notification center with notifications from SAP Build Work Zone, advanced edition. Alt Text: A list of two notifications: “Leave Request”, with a red text “Important” and “2 weeks ago”, and “Invite to Worskpace”, with text “Mustaq Ahmmed has invited you to join the workspace “Help & Support Workspace” and “2 weeks ago”.

Note that SAP Mobile Start is not the successor app for the SAP Build Work Zone Advanced mobile app. Find out more here:

Support of SAP Build Work Zone, advanced and much more: SAP Mobile Start V2.2 & 2.3 - Release Update.

SAP Mobile Start

Updated August 13th with information about the 2.4 release.

Beyond providing Joule natively for mobile devices, SAP Mobile Start has recently introduced a number of user experience improvements with their 2.2 and 2.3 releases. In addition to supporting SAP Build Work Zone, advanced edition, as described above, the main new features are:

Completed To-Dos are now displayed too (see Figure 10).
Site Switch allows you to directly switch between SAP Build Work Zone sites, without having to go through the onboarding process for each site.
The news tile can now also include images (see Figure 10).
News feeds that require authentication are supported now.
Design updates such as enhanced navigation bar for Apple iPad and a new fresher design for monitoring details on Apple Watch.
SAP Document AI integration.
Onboarding via deep links.
Top news, which gets shown prominently on the start screen.
Additional text with sensitive content can now be shown in notifications.

Figure 10: On the left, SAP Mobile Start showing completed To-Dos, on the right showing news with an image. Alt Text: On the left, the To-Dos section is selected, showing two To-Do cards, and the top half of a third card. The first one shows Maria Smith requested 180 days maternity leave, the second one that Quality Manager Donna Moore requested €47,600 spend. The right shows the start page, with a section Monitoring apps at the top, with two cards, followed by the News section, with one card listing two news items, the first of which has an image.

To find out more about the above recent innovations as well as what is planned in our road map, have a look at:

Continue Reading

I hope you enjoyed this first part, covering cross-product UX services. Here's a link to part 2, covering a large number of UX innovations which are generally available with SAP S/4HANA Cloud Public Edition 2508 and SAP Fiori launchpad:

SAP UX Q3/2025 Update – Part 2: SAP S/4HANA Cloud Public Edition 2508 and SAP Fiori Launchpad.

Do keep posting your experiences and recommendations yourself in the SAP Community, with the SAP Fiori and/or the User Experience tag! In case you are wondering how to get a list of the most recent blog posts on SAP Fiori and User Experience in our new SAP Community, use these links:

SAP Build Work Zone Gets Even More Powerful with AI-Powered Capabilities

2025-08-14T15:55:12.940000+02:00

In today’s dynamic business environment, where speed and precision are critical to success, the ability to access, create, and act on information quickly has become a competitive advantage. That’s why we’re excited to introduce the latest AI-powered capabilities in SAP Build Work Zone, advanced edition. They are designed to help your organization unlock greater productivity and smarter collaboration.

With the addition of AI-based text generation, summarization, and comment generation, you can now accelerate content creation, quickly distill key insights from lengthy documents, and actively engage with workspace content, all directly within your digital workplace.

As SAP Build Work Zone continues to evolve into an intelligent digital workspace, these new features bring built-in intelligence that reduces manual effort, accelerates decision-making, and enhances the overall employee experience. And this is only the beginning. We are continuously expanding SAP Build Work Zone, advanced edition with new AI capabilities that further elevate the digital employee experience. The features highlighted here represent the latest enhancements as of August 2025. For ongoing updates and deep dive into what’s coming next, stay tuned for future blog posts.

AI promotional model

To help you explore these new capabilities, we’re offering them under a promotional model (totally free of charge) until 30th June 2026. During this period, each global account is entitled to 100,000 AI requests per calendar month across all instances of SAP Build Work Zone, advanced edition. If the monthly quota is exceeded, users will receive a notification. The quota resets at the start of each month.

After the promotional period ends, AI features will be available under a commercial model of SAP AI core. If you choose not to activate the commercial offering, the features will be automatically disabled.

Availability

The AI capabilities are powered by SAP AI Core and are available in the following data centers:

AWS: Australia (Sydney), Brazil (São Paulo), Europe (Frankfurt), Europe (Frankfurt EU Access), Japan (Tokyo), Singapore, US East (VA)
Microsoft Azure: Australia (Sydney), Europe (Netherlands), US East (VA)
Google Cloud: Australia Southeast (Sydney), Europe (Frankfurt), India (Mumbai), KSA (Dammam – KSA Regulated Customers), US Central (IA)

Enabling the AI features

These AI-powered features can be enabled in the admin console. To get started, do the following:

Navigate to Administration Console > Feature Enablement > Features. Here you can select the AI features you want to activate. You’ll be prompted to review and accept the terms and conditions before proceeding.

Explore the new AI features

Once enabled using the steps above, you’ll find these capabilities integrated seamlessly into your workpages and workspace tools.

1. AI Summarization

This feature allows you to get the gist of long documents within seconds. AI Summarization helps you to condense large chunks of content such as wikis, blogs, workpages, and documents, into concise summaries.

To summarize a content item, navigate to the workspace’s Content list from the navigation bar and select the document you want to process. When the content is open, click the Summarize button located at the top of the screen.

The AI will then generate a summary that captures the key points of the original text.

This feature supports content up to 100K words, making it a perfect tool for quickly grasping the essentials without having to read through long texts.

2. AI Text Generation

With this feature you can create compelling content with a few simple prompts. This feature helps you generate contextual text directly within your workpages. It is great for drafting introductions, elaborating ideas, or kickstarting any type of content.

To use it, simply click on Add Content within a cell in your workspace editor and choose Text from the content list. The AI icon will be available to help you generate text.

A dialog box will appear where you can enter your prompt.

Based on this input, AI will generate relevant text, which may take a few moments to appear. Once the text is generated, you can further fine-tune the content to suit your style and requirements. Once you are satisfied you have the option to accept it, discard it, or generate a new version.

3. AI Comment Generation

Using this feature you can respond intelligently with AI-suggested comments. AI Comment Generation simplifies the process of engaging with content through contextual comments.

To put this feature, open the Content list and select the specific content item you’d like to respond to. At the bottom of the screen, the AI icon can help you generate text with AI.

Here you can enter a prompt or context.

AI will then suggest relevant comment options for you to accept, discard or retry.

You can use this feature to contribute to discussions, provide feedback, or interact with colleagues. The same text generation experience is available when writing a news feed as well.

*****

These AI-powered enhancements are just the beginning. At SAP, we're committed to helping you work more intelligently, engage more effectively, and innovate faster. Stay tuned as we continue to expand the AI capabilities in SAP Build Work Zone, empowering your teams like never before.

Learn more:

➤ SAP Build Work Zone on: sap.com / SAP Community

➤ SAP Application Development and Automation Community Group

➤ Joule is available in SAP Build Work Zone, standard edition

SAP Build Work Zone, advanced edition をデータリポジトリにした Document Grounding の設定手順

2025-08-29T10:43:51.689000+02:00

はじめに

SAP の生成AIアシスタント Joule には、Document Grounding の機能が提供されています。これにより、社内の業務ドキュメントの内容を元に迅速で的確な回答を生成できるようになります。例えば、従業員が社内ポリシーやマニュアルについて質問した際、Jouleは大規模言語モデルの知識だけでなく、会社内に保存された関連ドキュメントの内容を参照して回答します。従来この Document Grounding 機能は Microsoft SharePoint をデータソースとしてサポートしていましたが、SAP Build Work Zone, advanced edition 上のコンテンツも参照可能になりました。SAP Build Work Zone 上のワークスペースのパブリックコンテンツ（全ユーザーに公開されたドキュメントやページ）をJouleの提供する回答のソース情報として利用できるようになるため、社内ナレッジをより活用した回答が期待できます。

本記事では、SAP Build Work Zone をドキュメントリポジトリとして設定し、Jouleのドキュメントグラウンディングを有効化する手順を解説します。これにより SAP Build Work Zone, advanced edition 内に格納したPDFやWordファイル、ナレッジベース記事などをインデックス化し、ユーザーの質問に対してそれらのファイルの内容に基づく回答を Joule が生成できるようになります。なお、本記事の読者は SAP BTP や SAP Build Work Zone の基本的な知識を有していることを前提とします。

前提条件

本手順を開始する前に、以下の準備が整っていることを確認してください。

SAP BTP 環境と Joule のセットアップ: SAP BTP のグローバルアカウントおよびサブアカウントがあり、Joule のサブスクリプションが有効になっていること。

SAP Build Work Zone, advanced edition: SAP Build Work Zone, advanced editionが利用可能で、サイトが初期セットアップ済みであること。

アイデンティティと認証基盤: SAP Cloud Identity Services (Identity Authentication) でシングルサインオン基盤が整備され、Jouleと統合製品（SAP Build Work Zone）間でグローバルユーザーID（user UUID）が共有されていること。Joule導入時にIdentity Authenticationの信頼関係を設定済みであること。

SAP Build Work Zone 管理者権限: SAP Build Work Zone の管理コンソールにアクセスでき、機能の有効化や設定変更を行える管理者ユーザーとしてログインできる。

以上の前提を満たした上で、以下に示す手順に従って設定を行います。

全体構成図

公式なSAP Help Portalのセットアップガイドから、全体の俯瞰図を描いてみると以下のような形になると考えられます。
なお、こちらは個人的な見解であり、情報の正当性には細心の注意を払ってください。

【随時、更新します】

手順

今回は下記のSAP Help Portalの手順に則った上でセットアップを進めていきます。

GitHub上に手順をまとめたスクリプトを用意していますので、ぜひご活用ください。ただし、正確な手順はSAP Help Portalに準じます。

まずは下記の通り、GitHub上のリポジトリをクローンしましょう。

git clone https://github.com/watwatwhat/document-grounding-setup.git

下記コマンドを実行して、セットアップガイドスクリプトを起動しましょう。

./main.sh

このガイドは、インタラクティブに手順を実行することができるように設計されています。1~12までを順次選択しながら進んで行きましょう。

1. Document Grounding サービスの有効化

まず、SAP BTP上で Document Grounding のサービスインスタンスを作成します。このサービスがJouleで社内ドキュメントを取り扱うための技術的な基盤となります。

まずはセットアップガイドスクリプトを起動し、メニューから「1. Create Document Grounding Instance」を選択します。
Document Groundingのインスタンスの名前やそこに追加するサービスインスタンスの名前を決めて入力しましょう。今回の例では、それぞれ「document-grounding-other」「sb-document-grounding-other」としています。この入力値に基づいてセットアップの指示が表示されるので、その通りに設定を行いましょう。
（該当する公式ドキュメント：SAP Help Portal: Configure User Authentication）
BTP Cockpitでサービスの作成: JouleをサブスクライブしているサブアカウントのBTP Cockpitにログインし、「Service Marketplace」を開きます。サービス一覧から「Document Grounding」を検索し、該当のサービスを選択します。サービスインスタンスの作成: 「作成(Create)」ボタンをクリックします。プランはデフォルト（通常は data-manager プラン）を選択します。
Instance Nameには、 先ほど設定したインスタンス名を入力します。（例: document-docgrounding-other）Runtime Environment（実行環境）は「Other」を選択してください。Plan（サービスプラン）は「data-manager」を選択してください。入力後、「Create（作成）」を実行しインスタンスを作成します。
インスタンス作成後、一覧に表示された当該インスタンスを選択し、Service Bindingの作成を行います。「Create（作成）」ボタンをクリックします。サービスバインディングの名前も先ほど決めたものを入力しましょう。（例：sb-document-grounding-other）
作成後、サービスバインディングの名前をクリックし、サービスバインディングのURL をコピーしてください。
これを先ほどの待機しているセットアップガイドスクリプトに標準入力します。このように入力された必要情報はローカルの設定ファイルに保存されるようになっています。

2. Cloud Identity Services インスタンスの有効化

次に、Document Grounding サービスへセキュアにアクセスするための SAP Cloud Identity Services のインスタンスの有効化設定をします。ここでは SAP Cloud Identity Services上にJoule用のXSUAAインスタンスを作成し、クライアント証明書を発行してDocument Groundingサービスへのアクセスに利用します。

セットアップガイドスクリプトを起動し、「2. Create Cloud Identity Services Instance」を選択します。
インスタンスの名前とサービスバインディングの名前を決め、出力された手順に従ってBTP Cockpitからインスタンスを有効化します。今回はそれぞれ「cis-other」と「sb-cis-other」という名前にしています。
BTP Cockpit の Service Marketplace に戻り、「Cloud Identity Services」を検索して選択します。「create(作成)」をクリックし、プランは「application」、Runtime Environmentは「Other」を選択します。インスタンス名を先ほど決めた名前を入力します。（例: cis-other）入力が終わったら、「Next（次へ）」をクリックしましょう。
「パラメーター」設定画面が表示されたら、以下のJSONを入力します。これによって、Document Grounding サービスとの紐付けが行われます。

{ 
 "consumed-services": [ 
   { 
     "service-instance-name": "<Document Grounding インスタンス名>" 
   } 
 ] 
}

インスタンスが作成されたら、Service Bindings 部分にある「Create（作成）」ボタンより、サービスバインディングを作成します。
作成したCloud Identity Servicesインスタンスを選択し、「サービスキーを作成(Create Service Key)」します。サービスキー名先ほど決定したものを入力します。（例：sb-cis-other）サービスキー作成時に以下のパラメーターを指定します。これにより、このXSUAAインスタンスに紐づくOAuthクライアントのX.509証明書と秘密鍵が生成されます（有効期限365日)。

{ 
 "credential-type": "X509_GENERATED", 
 "validity": 365, 
 "validity-type": "DAYS" 
}

サービスバインディングが作成できたら、名前をクリックしてバインディングの内容を確認します。このうち、「clientid」と「authorization_endpoint」の値をコピーします。
セットアップガイドスクリプトに値を渡します。後ほどこの値を使ってCloud Identity Servicesからトークンを取得しますが、その時に利用する値が設定ファイルに書き込まれて保存されました。

3. 証明書の作成

上記Cloud Identity Servicesのサービスバインディングにより、認証に利用する証明書が発行されました。しかしこちらは改行文字の変換等の処理が必要です。このステップでは、その変換処理を行います。

セットアップガイドスクリプトを起動し、「3. Create Certificate Files」を実行します。これにより、credentials フォルダの配下に「cis_certificate.cer」と「cis_key.key」が作成されます。このファイルの内容を、それぞれCloud Identity Services のサービスバインディングに記載されている「certificate」「key」の内容に書き換えてください。
それぞれ記入が終わったら、「y」を入力して次に進みましょう。
次に変換処理後の証明書と秘密鍵ファイルの名前をどうするかを尋ねられますが、特に理由がなければそのままEnterでデフォルトの無難な名前が設定されるようにしています。この変換後のファイルは「credentials_adjusted」フォルダの配下に格納されるようになっています。

4. Document Grounding APIへの接続をテスト

これでDocument Groundingサービスへの操作を行う準備が整いました。まずは設定済みのドキュメント取り込みパイプラインを一覧表示するAPIを呼び出してみましょう。

セットアップガイドスクリプトを起動し、「4. Get Access Token 」を呼び出します。内部では、上記で用意した証明書ファイルと秘密鍵ファイルを用いて、Document Groundingサービス用のOAuthトークンを取得しています。下記のようなリクエストを送信しています。取得されたトークンは設定ファイルに保存されます。

curl --request POST \ 
    --url https://<authorization_endpointのドメイン>/oauth2/token \ 
    --header "accept: application/json" \ 
    --header "content-type: application/x-www-form-urlencoded" \ 
    --data "client_id=<上でメモしたclientid>" \ 
    --data "grant_type=client_credentials" \ 
    --cert ./doc-grounding.crt \ 
    --key  ./doc-grounding.key

続いてセットアップガイドスクリプトを起動し、「5. Test Document Grounding Endpoint 」を実行しましょう。これにより現在設定されているパイプラインの一覧が取得できます。初回実行であれば何もパイプラインは存在しないはずなので、 [] という空配列が返ってきます。

5. SAP Build Work Zone 側の外部統合に関する設定

続いて、SAP Build Work Zone 側で Document Grounding との連携を行うための設定を行います。（該当する公式ドキュメント：SAP Help Portal: Integration With Document Grounding）

SAP Build Work Zone Advanced Editionの管理者として Admin Console にログインし、「Feature Enablement（機能の有効化）」を開きます。
まず、SAP Work Zone側で外部連携する際に使用するOAuthクライアントを作成します。「External Integration」 -> 「OAuth Clients」に移動し、「Add OAuth Client」より新規OAuthクライアントを作成します。
適当な名前とIntegration URLを記入し、「Save」ボタンで保存します。今回は「Document Grounding OAuth Client」という名前および、本環境のJouleのURLをIntegration URLに入力しました。
保存が完了したら、「View」ボタンをクリックして発行されたOAuth認証情報を確認しましょう。
表示された「Key」と「Secret」をコピーしてください。
次に、「Feature Management」 -> 「Features」項目で 「Enable document grounding integration」 というオプションをオンにします。この設定を保存することで、SAP Build Work Zone, Advanced Edition と Document Grounding サービス間の統合機能がシステム内で有効になります。この際、通信に利用するOAuth Clientは先ほど作成したもの（例：Document Grounding OAuth Client）を設定します。
次に、SAP BTP のサブアカウントでこのS AP Build Work Zone のコンテンツにアクセスするための Destination を作成します。 Document Grounding サービスが SAP Build Work Zone 内のコンテンツにアクセスする際には、このDestination設定を経由します。BTP Cockpitの「Connectivity > Destinations」を開き、「新規作成(New Destination)」で以下のように設定します。なお、<DWS URL> は、Admin ConsoleのOverviewページから取得可能です。

プロパティ	値
Name	任意の名前（例：DocumentGrounding_WZAdv）
Type	HTTP
Description	任意
Proxy Type	Internet
URL	<DWS URL>
Authentication	OAuth2ClientCredentials
Client ID	Admin Console で発行したOAuth Client の「Key」
Client Secret	Admin Console で発行したOAuth Client の「Secret」
Token Service URL	<DWS URL>/api/v1/auth/token
Token Service URL Type	Dedicated
追加プロパティ	値
HTML5.DynamicDestination	true
SetXForwardedHeaders	false
HTML5.SetForwardedHeaders	false

セットアップガイドスクリプトに戻って「6. Configure Work Zone Integration」を実行し、設定したDestinationの名前を渡します。

6. SAP Build Work Zone 内のコンテンツのインデックス登録（パイプライン設定）

最後に、Document Groundingサービスに対して SAP Build Work Zone コンテンツを取り込み登録（インデックス化）する処理を設定します。これはパイプラインと呼ばれるスケジュールされたデータ取り込みジョブの登録で、設定後は定期的（1日1回）にWork Zone上のドキュメントをクロールし、最新内容がJouleに取り込まれます。

セットアップガイドスクリプトを起動し、「7. Create Work Zone Pipeline」を実行します。内部ではDocument Groundingサービスのエンドポイントに対し、先ほど取得したアクセストークンおよび証明書を用いてパイプライン作成APIを呼び出しています。以下のコマンドはその例です。

curl --request POST \ 
    --url "<ドキュメントグラウンディングのサービスキーURL>/pipeline/api/v1/pipeline" \ 
    --header "Authorization: Bearer <上で取得したaccess_token>" \ 
    --header "Content-Type: application/json" \ 
    --data '{ 
      "type": "WorkZone", 
      "metadata": { 
        "destination": "<前ステップで設定したDestination名>" 
      } 
    }' \ 
    --cert ./doc-grounding.crt \ 
    --key  ./doc-grounding.key

無事処理が完了するとパイプラインIDが返されます。このIDにより、Document Groundingサービス上で SAP Build Work Zone コンテンツを取得するパイプラインジョブが管理されます。パイプラインの作成と同時に初回実行が行われ、SAP Build Work Zone内のパブリックコンテンツ（アップロードされたドキュメント等）が読み込まれ、ベクトルインデックスが作成されます。以降は1日1回の頻度でWork Zone側の更新を自動反映します。手動で最新化したい場合はパイプラインAPIで適宜再実行することも可能です。（後述）

グラウンディングの準備とパイプラインの手動実行

これでDocument Groundingの機能を利用して、Jouleに回答を生成させる準備が完了しました。最後に、実際にドキュメントを読み込ませた上で回答させてみましょう。

今回はITセキュリティポリシーに関するサンプル文書を用意しました。こちらをSAP Build Work Zoneにアップロードしましょう。なお、現時点（2025/08/29）では、英語の文書に対してのみ、グラウンディングは動作するようです。
SAP Build Work Zoneのコンテンツページより、アップロードを行います。
また、このワークスペースの単位でも Document Grounding を有効化する必要があります。「Workspace Admin Settings」より設定に進みましょう。
Document Grounding の部分のチェックボックスを有効化して、「Save」より設定を保存します。
最後に、セットアップガイドスクリプトから「10. Trigger Pipeline」を実行して、パイプラインを手動実行します。
パイプラインの実行状態は、セットアップガイドスクリプトの「8. Check Grounding Status」より確認できます。うまくGroundingの取り込みが完了していると、「INDEXED」という表記が確認できます。

Document Grounding の実行

最後に、Document GroundingをJouleから実行し、SAP Build Work Zone, Advanced Edition上のコンテンツファイルの記述内容に基づいた回答が返ってくることを確認しましょう。

まずは上記の Document Grounding の設定を行う前の回答を見てみましょう。一般的な回答が返ってきており、詳細は管理者に問い合わせるように案内されます。
そして、下記が設定を行った後の回答です。しっかりと社内文書に基づいて回答が生成されていることが確認できます。ちなみに、Sourcesからドキュメント名をクリックすると、SAP Build Work Zone内の対象文書のページに遷移することができます。

まとめ

以上の手順により、SAP Build Work Zone, Advanced Edition に保存された社内ドキュメントをデータソースとして、Joule のドキュメントグラウンディング機能を設定できました。これにより、ユーザーがJouleに対して行う質問に対し、Work Zone内のファイル（PDFやWord文書など）の内容を根拠にした回答が生成されるようになります。たとえば社内規程集のPDFをWork Zoneにアップロードしパブリックに公開しておけば、Jouleに規程の詳細を尋ねた際にそのPDFから回答が引用されるようになります。

社内ナレッジを有効活用することで、Jouleの回答精度向上や信頼性の高い情報提供が期待できます。ただし前述の通り、現在この機能ではドキュメントがテナント内の全ユーザーにとって参照可能な情報源となる点に留意し、公開して問題ない情報のみをアップロードしてください。機能拡張により将来的にはユーザー権限に応じた応答制御なども行われる可能性があります。

最後に、設定に際して不明点があればSAPヘルプの公式ドキュメント（Integrating Joule with SAP Solutions内の「Set Up Document Grounding」節や、SAP Build Work Zone, advanced editionの「Integration With Document Grounding」ガイド）を参照してください。最新情報や制約事項が更新されている場合があります。本記事の手順を参考に、自社環境でJouleとWork Zoneを連携させ、社内文書に基づく高度なQ&Aシステムを活用してみてください。

参考資料

SAP Help Portal: Integrating Joule with SAP Solutions – Set up Document Grounding
https://help.sap.com/docs/joule/integrating-joule-with-sap/set-up-document-grounding

SAP Help Portal: SAP Build Work Zone, advanced edition – Integration With Document Grounding
https://help.sap.com/docs/build-work-zone-advanced-edition/sap-build-work-zone-advanced-edition/integration-with-document-grounding

🟡 Fun for Week 1: The Devtoberfest Scavenger Hunt 🔨🪙

2025-09-01T08:09:22.994000+02:00

The contest is now over.

Welcome to the Devtoberfest Scavenger Hunt, a chase around important SAP developer-related tools/sites, a challenge to construct a secret phrase, and a chance to win 1000s of points toward the Devtoberfest grand prize.

The hunt officially starts Sept. 25, with the release of the first clue during that day's SAP Developer News, and you have until the end of Devtoberfest, Oct. 24, to complete it.

To get all the clues make sure to SUBSCRIBE TO THIS POST!!

Learn more about the entire Devtoberfest event in @KevinR's post Devtoberfest 2025 Welcome!.

What you need to find

We have hidden a special phrase, which you need to figure out using the clues from several missions, described in the next section. Along your journey you will do the following:

Visit about 10 different locations related to SAP developers, mostly web sites that are designed to help you in your daily SAP development.
At each location, you will discover a set of hexadecimal digits.
Concatenate the digits together (in the order of the missions) to get one, 37-digit hexadecimal number.
Multiply that hexadecimal number by another secret number, for which we will give a clue.
Take the resulting 38-digit hexadecimal product, and convert it into the secret phrase, using each pair of digits as values for ASCII characters.
Enter the phrase, exactly (case-sensitive, no extra spaces), into the Scavenger Hunt tutorial.‌

Not until the SAP Developer News of Oct. 16 will you have all the pieces to be able to complete the phrase.

Example Hunt

As an example of what you will have to do, here's a short sample hunt (just a warm-up, no points will be earned). Each mission is independent of the other.

Mission	No. Digits	SAP Web Property	Instructions
1	7	SAP Developers YouTube Channel	Go to our SAP Developer YouTube channel. Open @Rekha_DR's video "SAP Build Process Automation (Part 1): Build your very first process". Watch it and find the secret 7-digit hexadecimal number in one of the info cards. You can also see the hex digits in the description.
2	6	SAP Community	Inside this blog post, use the Developer Tools on your browser to inspect the words "SAP Community" in the cell immediately to the left (in this very table) and find the 6-digit RGB ASCII code for the color of the text.
3	None (directly)		Concatenate the 2 sets of hexadecimal digits (13 in all), in order, and multiply the resulting hexadecimal number by the number of original SAP founders (you can easily find the number on the SAP Wikipedia page).

Convert the resulting hexadecimal number into a phrase, converting each pair of digits into a character using ASCII codes.

👉In this blog post, post a comment/picture about the phrase -- but NOT the phrase itself (like your experiences with or opinion about the phrase, or a picture of something belonging to you that reminds you of the phrase). You won't get any points, but it will be fun and you will be ready for the real scavenger hunt. If you have any trouble with this example hunt, post in the comments.

REMINDER: The above is just an example of how the real scavenger hunt will work. The real scavenger hunt instructions will be described in the rest of this blog post, as clues become available.

The (real) hunt

Below are the instructions for finding the hexadecimal digits for the actual scavenger hunt. We will release clues as follows:

In the SAP Developer News of Sept. 25, Oct. 2, Oct. 9, and Oct. 16.
In this blog each Monday during the first 3 weeks of Devtoberfest.

👉To be notified when a new clue is released, SUBSCRIBE TO THIS POST!!

‌ When you find the secret phase, just enter it into this Devtoberfest tutorial.

To guide you, we have created a second tutorial -- you do not have to use it, nor do you get any points from it. But you can enter the 1 to 6 digits from each mission to check if you received the correct digits for that mission.

Here are your missions

Mission	No. Digits	SAP Web Property	Instructions
1	2	SAP Developer News The Developer News comes out each Thursday with the latest about ABAP, CAP, BTP, SAP Build, UI5, Fiori, AI, and all your favorite SAP developer topics. All delivered by some of your favorite Developer Advocates, like DJ, Shilpa Shankar, Thomas Jung, Antonio Maradiaga, Nora von Thenen and the rest of the gang. Most episodes about 5 minutes. Also available as a Podcast.	Watch the Developer News of Sept. 25 for this mission's clue
2	6	Developer Forums in SAP Community Check the just-released new developer forums area of the SAP Community, where you can find info about your specific area of developer interest and ask fellow community members your questions. Use it to find other community members with the same skills as you.	Go to the new Developers area and the forums by going to the top-level menu of the SAP Community and then navigating to Developers > All Developer Forums. Check out the different topics and sub-areas (and feel free to ask any question you have about your work, or to answer someone else's). Now search for a forum post about "Devtoberfest Scavenger Hunt" for the next hex digits in the contest -- the post is in the forum topic that I cover as a Developer Advocate and which is the focus on Tuesday's of Devtoberfest.
3	4	SAP Business Accelerator Hub The SAP Business Accelerator Hub contains API reference guides, SAP Build templates, BAdIs for extensions, CDS data models, event descriptions and other artifact documentation that can help you with your development.	Explore the SAP Business Accelerator Hub, to check out all the artifacts available in SAP products for building your extensions. When you are ready: From the main page, click the SAP S4HANA Cloud Public Edition tile. Open the Sales Order (A2X) service (either v2 or v4). Under API Reference, open the Batch Requests resource, and check how many API calls that resource has. From the following table, take the 4 digits next to the number that equals the number of POST calls under Batch Requests. 1 = 1D34 2 = 7823 3 = D2C6 4 = 1098 5 = A1A2 6 = E328 7 = 0ABF 8 = 3F11
4	2	sap-samples org in GitHub The SAP GitHub org sap-samples contains sample code, TechEd tutorials, CodeJam material and 100s of repos from which you can learn SAP development, from ABAP to CAP to SAP Build.	Go to the sap-samples org in GitHub, and check out all the sample repos to help you learn about SAP development. Watch the Developer News of Oct. 2, and learn which repo in the sap-samples org we want you to check out. Go to that repo and find the commit with the message "Devtoberfest Scavenger Hunt" (NOT the merge commit). Take the commit ID and then get the 8th and 16th characters, in that order. Those are the next 2 digits of the secret code.
5	4	SAP Help Portal SAP Help Portal is the main place for finding key documentation for SAP BTP services. You can now subscribe to page updates (including What's New items for the products of your choosing), get translations in about 30 languages for all documentation, content as a PDF, provide feedback, and more.	For this mission, check out 2 places on the Help Portal, and in each place you will get 2 hex digits for the secret code. First, go to the Help Portal and search for "Joule Studio". The first result will be for the product Joule Studio, the main Joule Studio documentation. On that page, find the Devtoberfest tile, which will contain your first 2 hex digits. Second, go to the SAP BTP release notes -- where you can see everything that's new for all BTP services, and you can even subscribe to receive an email whenever a new item is released in your specific service. Search for the Devtoberfest release note, and find the second set of 2 hex digits.
6	6	SAP Learning SAP Learning is your first stop for learning about SAP, including tutorials and certifications for all types of development, from ABAP backend to SAP Build Apps frontend -- plus CAP, Fiori, Gen AI, Integration Suite and more.	Go to SAP Learning and then in the top menu click Browse. Select the Developer role. Search for ABAP, and open the "SAP Certified Associate - Back-End Developer - ABAP Cloud" certification exam. This certification is for those who want to be expert in building ABAP applications based on the ABAP RESTful Application Programming (RAP) Model. Do the following calculation: Multiply the number of questions by the cut off score (between 0 and 100) by the exam time in minutes. Take that number and subtract 5894. Convert that number to hex, and pad with enough zeroes on the left to make it 6 digits. Those are your hex digits for this mission. For example, if the exam were 1 hour, with a cut off score of 50, and 35 questions, you would get the number *105,000. Subtract the number by 5894 to get 99,106* . Converting it to hex would yield 18322, and padding with zeros would yield the final answer of 018322
7	6	SAP Discovery Center The SAP Discovery Center lets you explore SAP BTP services and SAP Business AI capabilities. You can see pricing, in which region each service is available, and step-by-step guides (missions) for implementing different scenarios. Especially of note is the SAP Architecture Center, a centralized hub for SAP solution reference architectures, released in May.	This mission is divided into 2 parts, but all of it occurs inside the SAP Discovery Center. Go to the Discovery Center and search for "Joule Studio", which shows you all the missions, AI features and other artifacts related to Joule Studio. Open the "Set Up Joule Studio with SAP Build in BTP Enterprise Account" mission, which contains a project board for the task of setting up Joule Studio. On the Overview tab, you'll find the next 3 hex digits of the secret code. Now for the second part. Go back to the Home Page of the SAP Discovery Center. Click the "SAP BTP Guidance Framework" reference architecture tile. Open "SAP Architecture Center". Browse the catalog of reference architectures and open the "Extend Joule with Joule Studio" tile, to see the reference architecture. Find the picture of Kasimir the Cat, from which you can derive the next 3 digits of the secret code. HINT: We suggest you download the picture file and take a good look at the file. This is the toughest mission of all.
8	6	SAP Developers YouTube Channel The SAP Developers YouTube channel is where you will find Antonio's videos on Integration Suite, Rekha's videos on SAP Build Process Automation, DJ's livestreams on CAP … 1200 videos in all about SAP development. Make sure to subscribe to the channel.	Go to our playlists and see all the varied content we have. Now search for the DMS playlist (Document Management Service) and open the full playlist for DMS. Start playing the 4th video in the playlist called "Set Up DMS with SAP Build Process Automation". A few seconds into the video, you will discover the next 6 hex digits of the secret code.
9	1	SAP Roadmap Explorer The Road Map Explorer lets you see what's being planned for your favorite SAP products. Just search for the product and then you'll see planned features for each quarter.	Go to Road Map Explorer (you will need to log in with your SAP login). Search for Joule Studio's road map. Open any of the items and find the capability under the Capability View. The next hex digit -- just 1 digit -- is the first letter of the name of this capability. JUST IN CASE: If for some reason you cannot log into the Roadmap Explorer, here is a second clue for the same hex digit. Go to the SAP Developer Advocates, and find the advocate who specializes in SAP Build Apps. The digit is the first letter of his/her first name.
10	None (directly)	SAP Design System The SAP Design System site shows the visual elements, UI components, and technologies that come together to build out a cohesive experience for all SAP products and apps. Here you can explore the core building blocks that make up the SAP Design System.	For the final instructions, watch the Developer News of Oct. 16.

Good luck!

😸

SAP Build Work Zone Security

2025-09-02T08:56:52.779000+02:00

I've been spending quite some time recently diving deep into SAP Build Work Zone security, and let me tell you, it's a journey. Terms like #IAS, #BTP Subaccount #trusts, and #ShadowUsers can sometimes feel like a maze.

But then, an analogy clicked for me - the #DigitalMall and suddenly, the whole complex architecture started making perfect sense. I wanted to share this breakdown with all of you, hoping it helps.

Let's imagine SAP Build Work Zone as a bustling, modern Digital Mall, where users (you, the #shoppers) come to access various #stores (business applications) and "services" (collaboration features). Every security layer has a purpose, just like every part of a well run mall

#TheGrandOpening: Understanding this Digital Mall's Foundation

Before anyone even walks in, the mall has a master plan and a way to organize its offerings:

>>> SAP BTP Subaccount: Think of this as the Mall's Main Entrance & Security Gate. It's the primary gateway, controlling who can even step foot inside your digital space. It's where core permissions are managed.

>>> SAP Build Work Zone Tenant: This is your specific, unique instance of the Mall itself - your personalized shopping experience!

>>> #ContentManager: This acts like the Mall's Central Directory or Information Kiosk. It lists all the "stores" (your business applications) available within the mall, helping shoppers find what they need

>>> Content Providers: These are the "Department Stores" (like SAP S/4HANA
SuccessFactors) or even smaller "Boutiques" (your custom applications). They reside outside your immediate mall structure but integrate seamlessly, making their offerings available inside your Work Zone.

>>>>Stepping Inside: Your Identity & Basic Mall Access<<<<

Now, for the really crucial part: how does a "shopper" (your user) actually get into the Digital Mall, and how is their identity validated at the main entrance?

>>> #SAPCloudIdentityServices - Identity Authentication (IAS): The Mall's Central Security System / ID Proxy

This is the mandatory first stop for any user trying to enter your Work Zone mall. #IAS is your primary #IdentityProvider [IDP]

>>> #Proxy Mode: If your organization uses its own Corporate IdP (like Azure AD, Okta), IAS acts as a clever proxy. You authenticate against your corporate system, and IAS then receives that verified identity, federating it onward in a way Work Zone understands. It's seamless, you just show your corporate ID.

>>> #TheDigitalIdCard (SAML Assertion / OIDC Token): Once authenticated, IAS issues a secure token. This token is packed with vital information, essentially your digital "ID Card" that gets you past the main gate:

>>> #SubjectNameIdentifier (SNI): This is your main identifier (e.g., your Login Name or Employee ID). It's what the BTP Subaccount primarily uses.

#Assertion Attribute (often IAS UUID): This is a unique, stable, and persistent ID assigned by IAS. It's super important for internal Work Zone component communication later on, especially with the DWS (our "Community Center," which I'll cover in Part 2!)

---> Other standard user attributes like email, first name, last name.

SAP BTP Subaccount Trust Configuration: The Main Gate's Agreement with IAS

Your BTP Subaccount (the main gate) has a "trust agreement" with IAS. This allows it to confidently accept those digital ID cards (tokens) from IAS.

>>> #The XSUAA Shadow User: Your Mall Access Card. This is one of the most critical concepts

When a user successfully authenticates via IAS for the first time, a "Shadow User" record is either created or identified in the BTP Subaccount's internal user list. Think of this as your personal "Mall Access Card" record.

Why is it needed? Even if IAS knows who you are, the BTP Subaccount needs its own local record (the shadow user) to attach BTP Role Collections to it. These role collections are your "Mall-wide Privileges" (e.g., WorkZone_User, WorkZone_Admin) that determine what you can do across the whole Work Zone platform.

>>>> Crucial Point: If a shadow user doesn't exist (and automatic creation isn't enabled), login to Work Zone will fail because there is no local identity to attach permissions to.

Principal Propagation: Seamless Access to Department Stores!

Once you're in the mall and launch an app from an On-Premise Backend System (like an S/4HANA Fiori app via SAP Cloud Connector), you don't want to log in again, right?

This is where ##Principal Propagation comes in! Your identity (using the IAS SNI from the BTP trust) is seamlessly passed through the BTP Destination Service and SAP Cloud Connector directly to the backend system. The S/ 4HANA system then recognizes you and authorizes your access based on your roles within S/4HANA. It's like your Mall Access Card automatically opening the staff-only doors in a department store.

This is just the exciting first step of understanding Work Zone security. In Part 2, coming next.

The Digital Workplace Service (DWS) (the Mall's Community Center).

User and User List Provisioning (how the Community Center gets its member lists).

The critical differences between Internal vs. External Users (different types of Community Center members).

And how SCIM APIs are the "automated delivery trucks" for all this data!

Stay tuned for more insights, and in the meantime, I'd love to hear your thoughts or questions on this first part in the comments below!

Happy Work Zone-ing!

Lets connect and learn together ✌️

SAP Build Work Zone Meets Multi-Tenancy

2025-09-26T08:20:58.063000+02:00

Introduction

Multitenancy with SAP Build Work Zone - Managed App Router in CEP (Central Entry Point) Mode

Since the introduction of the SAP BTP Cloud Foundry environment, managing multitenant applications through the Central Launchpad Service, known as SAP Build Work Zone, has been a significant and continuous challenge.

As an alternative, multitenant solutions had to rely on the Portal Service supported via a standalone app router.Managing this standalone app router at the individual project or product level to meet all security and compliance standards was a cumbersome task.

This approach increased the cost of development and maintenance.

With SAP Build Work Zone's support for multitenancy, we can now leverage the out-of-the-box feature benefits of the Managed App Router.

Projects and products can shift their focus and energy towards actual business operations.

Pros:

Standard Support for Managed App Router
Easier Maintenance of Security and Reduced Development/Maintenance Efforts
Alignment with One SAP Approach aka Golden Path, Providing a Single-Entry Point for End Users/Customers
With CDM (Common Data Model) Support, Site and Content Maintenance Becomes Simplified
Best fitment for SAP-managed subaccount for end customers.

Cons:

In the SAP Managed Solution, an SAP Build Work Zone subscription is a prerequisite in the subscriber subaccount.

Step-by-Step Guide/Walkthrough of SBWZ in Multitenant Account in CEP Mode

➢ Build Time Activity - Site Content Creation via CDM.json

➢ Easy Maintenance of Site Config, Page/Space, Group/Catalogs

➢ Translation of site content Texts Group, Page/Space via i18n

➢ appId=> sap.app.id mentioned in the manifest.json file

➢ vizId => cross navigation semantic object action in the manifest.json

➢ Add Common Data Model (CDM) as part of MTA Build

➢ Define Common Data Model (CDM) destination – Identified by Business Solution Name defined in

manifest.json “sap.cloud”->“service”

➢ Define runtime destination for launchpad content

➢ Build the MTA application and deploy to the BTP provider subaccount.

➢ Verify the CDM and runtime destination in provider sub-account

➢ Export the destination

➢ Subscriber subaccount -> subscribe to the multitenant application

➢ Import the CDM & run time destination in subscriber subaccount

➢ CDM destination in subscriber subaccount, update client secret reference from provider subaccount.

➢ Runtime destination changes the URL to point to the subscriber subaccount subdomain.

➢ Subscriber subaccount -> SAP Build Work Zone subscription/entitlement should be there

➢Create a content channel in the subscriber subaccount Site Manager -> Content Channels by using the imported RT (runtime) and CDM (design time) destination.

➢ Once it is created, refresh it to reflect the site content in the subscriber subaccount.

➢ In Subscriber subaccount BTP cockpit map, the Role Collection [created by content channel] to Technical Role

➢ Assign the CIS/IAS user Group to Role Collection

➢ In Site Manager, a site is created automatically after channel creation/refresh

Configuring Multiple UI5 Apps in a Single Site Using CDM.json [CDM Merge] in CEP Mode

➢ Add the CDM file in your second UI5 app, having the same site ID but different groups, catalogs and roles.

➢ Keep the business solution name the same in manifest.json file

➢Deploy the app, subscribe, re-import destinations, update roles, and refresh the content channel. The site stays the same, but "Go to Site" shows all groups and catalogs.

What’s New in SAP Build – Q3 2025 Release Highlights

2025-09-30T16:14:25.210000+02:00

In Q3, we delivered several innovations across AI-powered development, ABAP project creation, modernized SAPUI5 and advanced mobile capabilities. SAP Build also reached a significant milestone with the introduction of MCP servers, allowing developers to boost productivity further with AI agents.

Check these out in our Top 10 Release Highlights from Q3 2025!

AI-powered development

1. Empowering developers with MCP Tools for SAP Build

Model Context Protocol (MCP) servers are now available for the following technologies: SAP Cloud Application Programming Model (CAP), SAPUI5 and SAP Fiori. This is a huge step forward for developers working with popular IDEs and coding assistants like GitHub Copilot, Cursor and more. With these MCP servers, we’re now providing a comprehensive set of tools designed to optimize your development workflow across various SAP technologies.

Learn more in the blog post.

2. SAP HANA Cloud SQL Statement Generation in Joule

Directly in SAP Build Code, the Joule panel now offers the new command /hana-sql-gen, which enables the generation of SQL statements from natural language directly in the panel. The generated statements can be reviewed and refined in the Joule panel. Suitable SQL statements can be either copied to a SQL console or directly executed inside the Joule panel after selecting a database connection on which to run the statement.

3. Expanded AI-powered capabilities in SAP Build Work Zone

SAP Build Work Zone continues to expand its AI capabilities, bringing new built-in features to an intelligent workspace with accelerated decision-making and improved employee experiences:

Integration of Joule in SAP Build Work Zone, advanced edition: By bringing Joule into SAP Build Work Zone, advanced edition, users can now enjoy the power of Joule within their digital workplace. This eliminates the hassle of system-hopping, reduces time wasted on searching for information, and allows employees to focus on what is important. (Note: Available in early October)

AI-powered text and comment generation: This enables employees to quickly create, summarize, and engage with workplace content. For example, project managers can generate project status updates in minutes, ensuring their team members stay aligned.

Learn more in the blog post.

Enhanced App Development & Automation

4. Availability of SAPUI5 1.136.x-legacy-free with deprecated code removed

SAPUI5 1.136.x-legacy-free with deprecated code removed is now available via cloud access. This means app developers can test their UI code for compliance to SAPUI5 best practices. This helps to future-proof an SAP Fiori app for future SAPUI5 versions and work on deprecated/outdated code. Developers can also provide feedback to the UI5 team.

Learn more in the blog post.

5. Create full-stack ABAP projects in SAP Build

You can now create full-stack ABAP projects or open an existing ABAP CSN as a project in SAP Build. You can also model your application using the CDS Graphical Modeler and generate ABAP development objects. By leveraging high productivity tools, this significantly accelerates time-to-market, improves collaboration and provides a standardized, compliant approach to building extensions.

Learn more in the Help Portal. ..And stay tuned! We’ll share more about this topic at SAP TechEd 2025.

6. Maintenance project for released process automation projects

For process automation, we’ve introduced the ability to create dedicated project versions based on an existing released version. This allows process owners to maintain parallel editable versions while keeping the latest version in place, enabling teams to focus on solving a problem without redoing everything from scratch.

Learn more in the Help Portal.

7. Outbox functionality for tasks in SAP Task Center

SAP Task Center, which provides a seamless user experience for accessing open tasks, now lets you view completed tasks in an outbox. This provides a complete view of historical data while reducing support requests and efforts around process automation instances.

New innovations for mobile

8. UI enhancements available for mobile development

The latest release of SAP Mobile Development Kit (MDK) is now available to customers, bringing with it multiple enhancements for UI creation. Developers can add a date range to their calendar controls, enable a read-only state, add required fields to forms, and much more.

Learn more in the latest blog post.

9. Support for new site experience in SAP Build Work Zone, advanced edition

Employees accessing their workspace content via SAP Mobile Start can now enjoy a new view mode with a more flexible structuring of content. They can quickly view workspace updates, company news or project dashboards, making it easier to organize and consume information in a personalized way. (Note: Available in early October)

10. Updates to SAP Mobile Start

As the native mobile entry point to all SAP business apps and content, SAP Mobile Start has released several new innovations that simplify employee tasks and optimize their user experience:

SAP Document AI integration: Allows users to upload documents and photos for automated processing. This streamlines document handling, cuts down manual work and ensures data accuracy throughout operations.

Enhanced push notifications with more detailed information: Load and display context-specific details directly in the push notification, providing more meaningful and informative messages.

Simplified onboarding via deep link: IT teams can invite users to onboard to SAP Mobile Start via an email or message and provide a deep link that the users can use to initiate a simplified onboarding process.

Top news on start screen: Shows the most important news in a larger format on top of the Start screen.

Learn more in the latest blog post and Help Portal.

Ready to see these in action?

Join us for the next What’s New in SAP Build Webinar on October 8th as we dive deeper into MCP servers in CAP, SAP Mobile Start innovations, and much more!

Sign up today for your preferred option:
🌐October 8th, 9:00-10:00am CEST (EMEA/APJ friendly): Register here
🌐October 8th, 5:00-6:00pm CEST (Americas friendly): Register here

SAP Build FAQ: Commercials, Getting Started and More

2025-10-03T15:08:38.806000+02:00

This FAQ provides an overview of SAP’s commercial offering of SAP Build. It covers the available commercial models for SAP Build and provides answers to questions that we most often hear regarding SAP Build commercial model, onboarding, metering and more.

What is the SAP Build Unified Offering? 

SAP Build has been designed as the optimal way to extend SAP S/4HANA Cloud and other business applications. Thousands of customers are already experiencing up to 3x faster development speeds with SAP Build according to recent analyst research — and now we’ve made it even better.

Combined with deep technical integration, SAP Builds unified offering empowers customers to quickly extend and personalize their business solutions using AI-powered application development and automation, while maintaining a clean core and eliminating additional licensing or budgeting complexity.

What is included in the Unified SAP Build Offering? 

Customers can access the full range of SAP Build capabilities through just four distinct SKUs.

SAP Build Base User is for end users who need to access applications, gain insights for day-to-day business needs, and approve tasks.

SAP Build Premium User includes all the features of the base user license, with added capabilities for end users to author content, monitor processes, customize pages and deploy attended bots.

SAP Build Developer includes all the features of the Premium User license, plus advanced capabilities for developers and architects who need full access to deployed assets.

SAP Build Runtime Application hosting and lifecycle management services that support the creation and execution for dev/test as well as production environments

How do I find out what is included in SAP Build? 

For a list of services that are included in SAP Build you can visit the SAP Discovery Center, for SAP Build following this link

To find out what is in each SKU, Base, Premium, Developer and Runtime you can visit the SAP Build Pricing Page here.

What commercial models are SAP Build provided in? 

Consumption Based Model: 

SAP BTP Enterprise Agreement (BTPEA)

SAP Cloud Enterprise Agreement (CPEA)

Pay-As-You-Go for SAP BTP

Subscription Based Commercial Mode: 

Service Plan for SAP Build Subscription

SAP Cloud ERP Private Edition: 

SAP Build Entitlements are included in the SAP Cloud ERP Edition

Find more about SAP Cloud ERP Edition here

Find out more about the SAP Build offering in SAP Cloud ERP Private Edition here

SAP Business Suite Packages:

Entitlements are provided in several of the SAP Business Suite packages

Partner:

SAP Build offers partners free access to SAP Build and other BTP Services.

SAP Build Test, Demo Development (the site requires you to be logged in as an SAP Partner)

How do I get started with SAP Build? 

SAP Build uses SAP BTPs Cloud Integration Automation (CIA) to quickly get customers and partners up and going on SAP Build. Find information on how to setup SAP Build here. For detailed instructions on the activation process, please share this blog post with your technical team

Does SAP Build include Joule Studio and Joule for Developer?  

Yes, SAP Build provides Joule for Developer and Joule Studio. Joule Studio is provided with the SAP Build Developer offering. Joule for Developer features are included, but will need to enable this through the free voucher SKUs. You can find more information on Joule for Developer here and Joule Studio here.

Are there specific service plans that are exclusive to the unified SAP Build offering?

The Joule Studio service is only offered in the SAP Build Developer SKU. Joule for Developer needs to be enabled through the free voucher SKU's and then can only be used with the SAP Build offering, SAP Build Code and Joule for Developer, BTP ABAP Environment. Visual Cloud Functions in SAP Build Apps is not available in the SAP Build unified SKU.

Can I migrate from the previous SAP Build SKU’s to the new SAP Build SKU? 

Upgrade you SAP Build licenses to access enhanced features and tools. Use build-specific plans for improved efficiently and customization in your projects.

For migration of services please refer to this help

Can I use both the Old and New Service plans within the same subaccount?

The old services cannot be enabled in the same subaccount as the new Build services. You will need to do a migration per the above migration guide.

How does metering work, for example if I use both SAP Build Base User and SAP Build Developer capabilities?

SAP Build operates on a metering model that relies on specific user roles to determine access and functionality within the platform, which include developer, base user, and premium user. Each user must have a global user ID created by an administrator, who also assigns the appropriate role collection to ensure that the correct authorization is granted.

This role assignment is critical; for instance, an SAP Build base user shouldn't be able to create new processes within SAP Build, as such permissions could lead to unintended alterations or disruptions in workflows. By understanding and correctly implementing these roles, organizations can effectively manage user capabilities while maintaining the integrity and security of their SAP Build environment.

For more detailed information on metering and roles visit this help location.

How can I learn more about SAP Build? 

SAP Build Basic Trial–Get hands-on experience with a free, 30-day trial, following a step-by-step tutorial on SAP Build.
SAP Discovery Center–Dive deeper with step-by-step guidance and best practices for implementing use cases.
SAP Learning –Develop SAP skills for free, anywhere, anytime, and at your own pace: SAP Build

Joule is Now Integrated into SAP Build Work Zone - Advanced Edition

2025-10-28T12:08:51.805000+01:00

Exciting News! Joule, SAP’s generative AI assistant, is now integrated into SAP Build Work Zone advanced edition and SAP SuccessFactors Work Zone making Joule available across all SAP Build Work Zone editions including SAP Build Work Zone standard edition, SAP Start, and SAP Mobile Start. This marks a significant step in empowering users to work faster and smarter, with seamless access to insights and information at their fingertips.

What is Joule?

Joule is SAP’s cutting-edge generative AI assistant, designed to bring intelligence and efficiency to every aspect of work. Leveraging its generative AI capabilities, Joule aims to understand your requests, retrieve information, and complete your tasks in a conversational way. You can describe the current task to Joule, who can help automate tasks or take you to places where you can find desired data. By using Joule, you can easily interact with the system and increase your productivity. Learn more about Joule here.

Now Available : Joule in SAP Build Work Zone, advanced edition

With our latest release, Joule is now integrated into SAP Build Work Zone, advanced edition. The artificial intelligence copilot tool enables users to simply ask a question or present a problem and receive replies from connected SAP systems.

Joule when used within SAP Build Work Zone, extrapolates productivity by providing step-by-step guidance within the site helping you navigate and manage content. Imagine you're trying to track the status of a purchase order. Instead of navigating through multiple screens, you simply ask Joule, “Has my purchase order been approved?”. Joule instantly provides the status and key details directly within its window in SAP Build Work Zone, advanced edition.

How to Get Started with the Integration

Before completing the Joule onboarding tasks, you'll need to ensure that you've met the required prerequisites for both SAP Build Work Zone, advanced edition and for Joule. For a list of these prerequisites, please refer to: Prerequisites.
You have ensured that the SAP Systems where you want to integrate Joule, are registered in the System Landscape page in the SAP BTP cockpit.
The SAP Solutions which are registered as Systems are visible in the Booster for selection. For more information, see Maintaining Unified Customer Landscape.
You must Configure Trust to the Identity Authentication Tenant and Configure User Attributes for Joule from the Identity Directory.
The Joule booster has to be run. For more information, see Run the Joule Booster.

Note : When running the Joule booster or formation, choose integration with only a single SAP Build Work Zone edition. Choosing both standard and advanced editions will cause the integration to fail.

Integrating Joule into your SAP Build Work Zone is straightforward. After successfully running the Joule booster and completing the integration between SAP Build Work Zone, advanced edition and Joule, a new setting becomes available in the Site Setting screen of your site.

Finally, as an administrator, navigate to the Site Settings screen and enable the Joule option under the Services section. Once enabled, the Joule icon will appear in the header of your runtime site, giving users instant access to the AI-powered assistant for enhanced productivity and elevated outcomes across business.

What’s Next?

Joule integration has transformed how we approach day to day activities within SAP Build . With SAP TechEd 2025 fast approaching, we are excited to showcase you our capabilities in our on-site and virtual sessions . This is just the beginning , stay tuned for more AI related latest updates as we bring further innovation to your SAP Build experience.

How AI is Transforming Your Digital Workspace

2025-11-06T18:00:00.064000+01:00

How AI is Transforming Your Digital Workspace

Introduction

The modern workplace has changed dramatically. Employees no longer rely solely on static intranets or scattered collaboration tools. Instead, they expect a connected, personalized experience that helps them cut through the noise and focus on meaningful work. Enter artificial intelligence (AI).

AI isn’t just another layer of technology- it’s rapidly becoming the backbone of digital workspaces. By surfacing the right information at the right time, automating repetitive tasks, and enabling smarter collaboration and self-service, AI is redefining how we work, learn, and engage every day.

With digital workspaces in SAP Build, these AI capabilities are already available today—helping organizations deliver intelligent, personalized employee experiences out of the box

The Rise of AI in the Digital Workspace

For years, digital workspaces have been a central hub for business applications, documents, apps, and communications in one place. Useful—but often overwhelming. Employees spent as much time searching for information as they did, acting on it.

Now, AI is filling the gaps. With intelligent copilots, content curation, and contextual answers, digital workspaces like SAP Build Work Zone have evolved from being a destination for information into an engine for productivity and engagement.

Core AI features available today in SAP Build digital workspaces

1. Chatbots & Virtual Assistants
With Joule, SAP’s AI copilot, workspace users can access information instantly. From answering HR questions to surfacing insights from reports, employees can rely on conversational AI to get what they need instantaneously.

Joule, SAP's AI copilot integrated into the digital workspace

2. Task completion with Joule Skills

One can enhance Joule capabilities by creating skills for it in Joule Studio. Connected with SAP systems and third-party applications, Joule can complete tasks like submitting time-off requests, approving workflows, or surfacing KPI dashboards—all from a single interface

3. Document Grounding Capabilities
Joule ensures information is both contextual and reliable when using workspace content to ground AI responses. For example, employees can ask “What’s our travel policy in Europe?” and receive an AI response sourced directly from workspace content or SAP SuccessFactors policies when it is enabled as an AI source.

4. Content generation and summarization using generative AI
SAP Build leverages generative AI to help users create and refine content—whether drafting announcements, summarizing updates, or suggesting language for a blog post—directly within the workspace.

Real-Life Examples in Action

Information access with grounded responses

Joule responds with answers grounded in the specific workspace content. Employees can query Joule with specific questions like “What is the holiday plan for next year in Germany" or “how can I apply for a sabbatical leave? Point me to the relevant file”.

Smart document summaries

Integrated AI services capture the highlights of a workspace document—policy highlights, key insights from data, or high-level overview of a blog.

Workflow Automation

From within SAP Build workspace, an employee can ask Joule to “create a purchase order” or “show current pipeline metrics.” The copilot triggers the workflow in connected SAP systems, making productivity seamless.

Intelligent content curation

Users can easily create blog posts, feed posts or even knowledge articles in the workspace using the native AI features with simple prompts like “create a workspace feed reminding members to fill their timesheet in a funny and casual tone”.

The Business Impact

Faster Information Access: Joule makes information searches 95% faster by surfacing insights and data instantly. Grounded insights reduce time spent searching for answers.
Reduced Manual Effort: Generative AI-assisted summarization and content creation free up employee time.
Better Governance: AI responses in SAP are backed by enterprise content, ensuring compliance and accuracy.

Preparing for the AI-Powered Workspace

Adopting AI in digital workspaces is not just about flipping a switch—it’s about preparing your organization:

Change Management: Train employees to adopt AI workflows and copilots in their daily work.
Governance: Define guardrails for AI-generated content, data privacy, and security.
Integration: Maximize value by connecting SAP Build with existing SAP and non-SAP applications, making copilots more powerful.

Conclusion

AI is no longer a future trend; it’s already embedded in the digital workspaces employees use today. With embedded AI and Joule, organizations don’t just imagine an intelligent workspace—they experience it

By weaving AI into daily workflows—whether through copilots, recommended learning, or curated content—SAP Build helps organizations unlock productivity, agility, and engagement at scale.

Ready to take the next step?

Learn more about these capabilities and their implementation from the following resources:

Joule - Document Grounding with SAP Build Work Zone, advanced edition (RAG)

2025-11-07T01:08:40.886000+01:00

Setting up Document Grounding for SAP Build Work Zone, advanced edition

Document grounding (SAP’s implementation of RAG) is a foundational Joule capability which can provide more comprehensive responses by drawing from business documents located in SAP and third-party repositories.

Grounding is a service designed to handle data-related tasks, such as grounding and retrieval, using vector databases. It provides specialized data retrieval through these databases, grounding the retrieval process with your own external and context-relevant data. Grounding combines generative AI capabilities with the ability to use real-time, precise data to improve decision-making and business operations for specific AI-driven business solutions.

Grounding converts user provided documents into vector representations which are stored as a database. The indexing pipeline preprocesses unstructured and semi structured data into chunks and embeddings and the retrieval pipeline takes incoming user queries and converts them into vector representations. The query vectors are used to search the database and retrieval relevant information.

Prerequisites: Before triggering the setup process, make sure that you’ve purchased the AI Unit SKU (8019164) OR AI Units SKU - 8018592. After you’ve done so, the entitlements for document grounding are automatically added to your global account. Validate if you can see the entitlement "Document Grounding" in Global Account -> Service Assignment area.

Document Grounding now supports two authentication mechanisms. Please check the Configure Access from SAP BTP before you start your setup.

This blog focuses on setting up Document Grounding with SAP Build Work Zone, advanced edition. If you need to setup Document Grounding for Microsoft Sharepoint, please refer to this blog written by Nagesh: https://community.sap.com/t5/technology-blog-posts-by-sap/joule-getting-started-with-document-grounding-setup-guide/ba-p/13739501

Document types supported for SAP Build Work Zone, advanced edition: Blog posts, DOCX, JPEG, JPG, JSON, Knowledge base articles, PDF, PNG, PPTX, TIFF, TXT, Wiki pages (https://help.sap.com/docs/joule/integrating-joule-with-sap/set-up-document-grounding)

Setup Steps

Step 1: Enable Document Grounding capabilities in SAP Build Work Zone, advanced Edition

Step 2: Enable Document Grounding for Workspaces & Sub-Workspaces in SAP Build Work Zone, advanced Edition

Step 3: Explore Content Locations — Blogs, Wikis, and Documents for Grounding

Step 4: Use an Existing Joule Subaccount or Create a New One to Set Up Document Grounding

Step 5: Create Certificate and RSA Key Files

Step 6: Run cURL commands to setup Document Grounding pipelines

Step 7: Verify and Test Joule

Step 8: Appendix

Step 1: Enable Document Grounding capabilities in SAP Build Work Zone, advanced Edition

Navigate to SAP Build Work Zone, advanced Edition → App Finder → Administration Console.

In the Administration Console, go to External Integrations → OAuth Clients, and click Add OAuth Client.

Enter a Name and an Integration URL for the OAuth client.

Note: The Integration URL is not validated, so you can enter any placeholder value.

After saving the OAuth Client, click View to display the Client Key and Client Secret.
Copy these values. You will need them later during the integration setup.

OAuth Client Key: dgkey123456

OAuth Client Secret: dgsecretabcdef

Navigate to Administration Console → Feature Enablement → Features
Enable the Document Grounding Integration feature, and then select the OAuth Client you created in the previous step.

From the Administration Console → Overview page, copy the DWS URL.
For example: https://abcdef.eu10-1.dws.workzone.ondemand.com

Step 2: Enable Document Grounding for Workspaces & Sub-Workspaces in SAP Build Work Zone, advanced Edition

Workspaces and Sub-Workspaces both need to be enabled for Document Grounding. Selecting only the "Workspace" does not automatically enable Document Grounding in "Sub-Workspaces"

Navigate to SAP Build Work Zone, advanced Edition → Workspaces → New Workspace, and select Public Workspace.

Note: Document Grounding is supported only for Public Workspaces. If you have an existing Private Workspace, you can convert it to a Public Workspace from the Workspace Admin Settings.

In the workspace, navigate to Workspace Admin Settings → Edit Workspace.

Select the checkbox for Document Grounding to enable grounding for the workspace and then click Save

Note: If your setup includes a Sub-Workspace, make sure to enable Document Grounding there as well.
Enabling it at the main Workspace level does not automatically activate it for any Sub-Workspaces.

You can also manage Document Grounding across all workspaces by navigating to SAP Build Work Zone, advanced Edition → Administration Console → Workspaces.

Step 3: Explore Content Locations — Blogs, Wikis, and Documents for Grounding

Documents in SAP Build Work Zone, advanced edition can be uploaded as individual files or referenced from other content areas such as Blogs, Wikis, and Knowledge Base articles.
In these cases, the entire page or article is treated as grounding content. All such sources are indexed and leveraged by Joule to provide accurate, context-aware responses based on your organization’s information.

3.a Content / Files:
In your workspace, go to Content to view existing files or upload new documents that will be used for document grounding.

3.b Knowledge Base:
In your workspace, go to Knowledge Base to create and manage knowledge base articles that can be used for document grounding.

3.c Blog or Wiki:
In the Content area, click Create to add a new Blog or Wiki page. These pages will be indexed and used as grounding content.

Step 4: Use an Existing Joule Subaccount or Create a New One to Set Up Document Grounding

Document Grounding must be configured in the same subaccount where Joule (or Unified Joule) is enabled.
Select the subaccount where Joule is already set up and verify that it is hosted in a supported region.

AWS: ap10 – Australia (Sydney), ap11 – Asia Pacific (Singapore), eu10 – Europe (Frankfurt), eu11 – Europe (Frankfurt, EU Access), jp10 – Japan (Tokyo), us10 – US East (VA)
Google Cloud: ap30 – Australia (Sydney), eu30 – Europe (Frankfurt), us30 – US Central (IA)
Microsoft Azure: ap20 – Australia (Sydney), eu20 – Europe (Netherlands), us21 – US East (VA)

For the latest list of supported regions, refer to the official documentation: Supported Regions for Document Grounding

4.a Scenarios for Setting Up Document Grounding

Depending on how SAP Build Work Zone is configured in relation to your Joule formation, there are four possible setup paths. As mentioned earlier, the Document Grounding service must always be added to the Joule subaccount.
However, depending on your environment, SAP Build Work Zone, advanced edition may be deployed in the same subaccount or in a different one.
The following options outline the supported configurations.

4.a.1 – Unified Joule Already Exists with SAP Build Work Zone, standard Edition

You already have Joule configured, and SAP Build Work Zone, standard Edition is part of the same Joule formation.
In this case:

Joule remains integrated with SAP Build Work Zone, standard Edition (the Joule icon will only appear there).
You can still use SAP Build Work Zone, advanced edition for Document Grounding, but it won’t display the Joule icon because only one system instance can be part of a Joule formation.

Steps

Navigate to your Joule subaccount in BTP Cockpit.
Go to Entitlements → Add.
Search for and add the “Document Grounding” service plan.

4.a.2 – Unified Joule Already Exists with SAP Build Work Zone, advanced edition

You already have Joule set up and integrated with SAP Build Work Zone, advanced Edition.
In this scenario, you can directly enable Document Grounding in the same subaccount.

Steps

Navigate to your Joule subaccount.
Go to Entitlements → Add.
Search for and add the “Document Grounding” service plan.

Reference (optional): For more details on Setting up Unified Joule for scenarios 4.a.3 and 4.a.4 below you can refer to the SAP Community Blog:
Joule End-to-End Setup Guide for All Lines of Business – Unified Approach

4.a.3 – Setting Up Unified Joule for the First Time and Connecting an Existing SAP Build Work Zone, advanced edition

You are enabling Unified Joule for the first time and want to use an existing SAP Build Work Zone, advanced Edition that resides in a different subaccount.
In this setup, the Joule subaccount will host Joule and Document Grounding services only—no Work Zone Standard—while your existing Work Zone Advanced Edition will be linked to Joule during the booster configuration.

Steps

Create a new subaccount in your global account to host Joule.
Navigate to Trust Configuration → Establish Trust and set up trust with Cloud Identity Services (CIS / IAS).
Go to Entitlements → Edit → Add Service Plans, and add:

Joule
Document Grounding

From your Global Account, open Boosters → Set Up Joule, and click Start.
When prompted, select your new Joule subaccount and proceed through the booster steps.
In the booster flow, choose to connect your existing SAP Build Work Zone Advanced Edition tenant to the Joule formation.
Complete the booster to finish the configuration. Once successful, Joule will be active in the Joule subaccount and integrated with your existing Work Zone Advanced Edition tenant.

4.a.4 – Setting Up Unified Joule for the First Time (SAP Build Work Zone, advanced edition in the Same Joule Subaccount)

You are setting up Unified Joule for the first time and intend to deploy SAP Build Work Zone, advanced Edition directly within the same Joule subaccount (rather than linking an existing external Work Zone tenant).
This configuration keeps all related services — Joule, Document Grounding, and Work Zone Advanced — together in one managed environment.

Steps

Create a new subaccount in your BTP Cockpit to host Joule and Work Zone Advanced.
Navigate to Trust Configuration → Establish Trust, and set up trust with Cloud Identity Services (CIS / IAS).
Go to Entitlements → Edit → Add Service Plans, and add the following:

Joule
SAP Build Work Zone – Advanced Edition
(add both advanced and advanced (application) service plans)
Document Grounding

From your Global Account, open Boosters → Get Started with SAP Build Work Zone, advanced Edition, and complete the booster to provision the Work Zone Advanced tenant.
Refer to the official help documentation for detailed guidance:
Onboarding to SAP Build Work Zone Advanced Edition
After Work Zone Advanced is successfully provisioned, open Boosters → Set Up Joule, and click Start.
Select your newly created subaccount and proceed through the Joule booster steps.
When prompted, choose SAP Build Work Zone, advanced Edition to integrate it with Joule.

Optional Steps

If you would like to enable Joule in SAP Build Work Zone, advanced edition, refer to the following blog for detailed guidance:
🔗 Joule is Now Integrated into SAP Build Work Zone, Advanced Edition

If you would like to enable Joule in SAP Build Work Zone, standard edition, follow the steps described in this blog:
🔗 Activate Joule with SAP Build Work Zone and SAP Mobile Start

After completion of Step 4.a.1 or 4.a.2 or 4.a.3 or 4.a.4 proceed to create a Destination

4.b Create Destination

In your Joule Subaccount, navigate to Destinations → Create → From Scratch. Enter a Name for the destination. Add the values provided below

Name: HGDGBWZ924 (You can have any name)

Property	Value
URL	The URL is https://<DWS URL>/api/v1/dg-pipeline/metadata Check DWS URL in the SAP Build Work Zone, advanced edition -> Admin Console -> Overview E.g: https://abcdef.eu10-1.dws.workzone.ondemand.com/api/v1/dg-pipeline/metadata
Type	HTTP
Proxy Type	Internet
Authentication	OAuth2ClientCredentials
Client ID	Enter the value of the OAuth client Key from BWZ Advanced created in Step 1 OAuth Client Key: dgkey123456
Client Secret	Enter the value of the OAuth client Secret from BWZ Advanced created in Step 1 OAuth Client Secret: dgsecretabcdef
Token Service URL Type	Dedicated
Token Service URL	Enter your <DWS URL>/api/v1/auth/token E.g: https://abcdef.eu10-1.dws.workzone.ondemand.com/api/v1/auth/token Check DWS URL in the BWZ Advanced -> Admin Console -> Overview
Additional Properties	(Click New Property and manually add these properties to the destination)
HTML5.DynamicDestination	true
SetXForwardedHeaders	false
HTML5.SetXForwardedHeaders	false

4.c Create Document Grounding Service Instance

In your Joule Subaccount, go to Service Marketplace → Document Grounding → Create.

Select Runtime Environment: Other
Enter an Instance Name: for example, groundingcli
Click Create

Create a Service Binding for the Document Grounding Instance

In your Subaccount, navigate to Instances & Subscriptions → Instances
Select your Document Grounding Service Instance, then proceed to "Create Service Binding"

Enter a Binding Name, for example: groundingkey, and click Create

Copy the mTLS Document Grounding Service Binding URL (MTLS URL) for later use.

E.g: https://mtls.rage.c-1111.kyma.ondemand.com

4.d Create Cloud Identity Services Instance

In your Subaccount, navigate to Services → Service Marketplace → Cloud Identity Services → Create.

Plan: application
Runtime Environment: Other
Instance Name: groundingCIS

Then click Next (do not click Create yet).

In the Parameters section, enter the following JSON — replacing <doc-grounding-instance-name> with the Document Grounding Service Instance Name you created earlier (E.g: groundingcli) — and then click Create.

{
   "consumed-services":[
      {
         "service-instance-name":"<doc-grounding-instance-name>"
      }
   ]
}

In your Subaccount, navigate to Instances & Subscriptions → Instances
Select your Cloud Identity Services Instance, then proceed to "Create Service Binding"

Enter a Service Binding Name, for example: cisSK, and provide the following parameters. Then click Create

{
    "credential-type": "X509_GENERATED",
    "validity": 365,
    "validity-type": "DAYS"
}

Download the Service Binding file for the Cloud Identity Services instance.

Step 5: Create Certificate and RSA Key Files

You’ll now create two files required for secure communication between Document Grounding and Cloud Identity Services (CIS).

Open the CIS Service Binding file and copy the following values:

clientid
authorization_endpoint

Then, update the authorization_endpoint by replacing /oauth2/authorize with /oauth2/token

E.g: clientid: aaa-bbb-ccc-ddd-eee

E.g: authorization_endpoint: https://abc2wxyz.accounts.ondemand.com/oauth2/token

Copy the certificates (there are 2 certificates) from the CIS Service Binding file (Starting with "----BEGIN CERTIFICATE---- to ----End CERTIFICATE----" and RSA key (Starting with ----BEGIN RSA PRIVATE KEY---- to ----END RSA PRIVATE KEY----) to VSCode (or Notepad++)

In VSCode press Ctrl+H and enter "\n" in Find and "," in Replace. Select "Match Case" and click "Replace all"

After that enter "," in Find and "\n" in Replace. Select "Match Case" and "Use Regular Expression" and click "Replace all"

You will see "2 Certificates" and "1 RSA Key" similar to the screenshot below

Save the two certificates into a single file and save it as a .crt file.
Example: DocumentGrounding.crt
Save the RSA private key as a .key file.
Example: DocumentGrounding.key

Step 6: Run cURL commands to setup Document Grounding pipelines

In this step, you’ll use Bruno (or any API client such as Postman) to execute cURL commands that create and configure Document Grounding pipelines in your Joule subaccount.
These pipelines establish the connection between SAP Build Work Zone, advanced edition content and the Document Grounding service.

6.a Install Bruno and Create a Collection

Install Bruno: Download and install the Bruno API Client.

Open Bruno and click Create Collection

Provide a Name for the collection, for example: DGcollection, choose a Location to save it, and click Create.

Before proceeding, ensure you have the following two URLs ready:

IAS URL (of Joule Subaccount): https://abc2wxyz.accounts.ondemand.com
Document Grounding Service Binding URL (mTLS): mtls.rage.c-1111.kyma.ondemand.com

In Bruno, perform the following steps:

Select your collection (DGcollection).
Go to Client Certificates.
For the Domain, enter your IAS URL — abc2wxyz.accounts.ondemand.com
Select the Certificate File (DocumentGrounding.crt) and the Key File (DocumentGrounding.key).
Click Add to save the configuration.

Repeat the same process for the Document Grounding Service Binding URL:

Domain: mtls.rage.c-1111.kyma.ondemand.com
Certificate File: DocumentGrounding.crt
Key File: DocumentGrounding.key

Click Add to save the configuration.

6.b Create a Bearer Token

In this step, you’ll generate an OAuth 2.0 bearer token to authenticate subsequent API calls for creating Document Grounding pipelines.

In Bruno, select your collection (DGcollection).
Click New Request and enter:
- Name: Get Bearer Token
- URL: Your CIS URL followed by /oauth2/token
  Example: https://abc2wxyz.accounts.ondemand.com/oauth2/token
Click Create.

Add Parameters

client_id: (from your Cloud Identity Services binding file cisSK.json) Example: aaa-bbb-ccc-ddd-eee
grant_type: client_credentials

Add Headers

content-type: application/x-www-form-urlencoded
accept: application/json

Change the method from GET to POST, click Save, then click the → (Send) button.

You will receive a response similar to the example below.
Copy the access_token, as it will be used in the next step to create the Document Grounding Pipeline

{
  "access_token": "xyzxyzxyzxyzxyzxyzxyz",
  "token_type": "Bearer",
  "expires_in": 3600
}

💡Tip: The bearer token is temporary — it expires after the duration shown in expires_in (in seconds).
You’ll need to generate a new access token each time you perform Document Grounding operations in the future (for example, to create, update, or refresh pipelines)

6.c Create a Pipeline

In Bruno, click New Request under your DGcollection.

Method: POST
URL: Your mTLS URL from the Document Grounding Service Binding, followed by /pipeline/api/v1/pipeline
Example: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline
Click Create.

Add Headers

content-type: application/json
Authorization: Bearer <your_access_token>
Example: Bearer eyJqa3UiOiJ…………….odHRwczovL2F6cjJpe

Add Body

Change the Body type to JSON and paste the following:
The destination is the name of the "Destination" created in your Joule subaccount" (Step 4.c)

{
  "type": "WorkZone",
  "metadata": {
    "destination": "HGDGBWZ924"
  }
}

Click Save, then click → (Send) to execute the request

If the request is successful, the response will display a pipelineId.
This confirms that the Document Grounding Pipeline has been successfully created and linked to your SAP Build Work Zone, advanced edition workspace. Copy the pipelineId from the response (E.g: pipelineId: aa11-bb22-cc33-dd44)

Setup Complete

Your Document Grounding setup is now complete.
All configurations between SAP Build Work Zone, advanced edition, Joule, and Document Grounding have been successfully established.

Beyond the initial setup, you can perform additional operations using Bruno or cURL, such as:

Get all pipelines – retrieve a list of existing Document Grounding pipelines.
Delete a pipeline – remove an inactive or obsolete pipeline.
Trigger a pipeline – manually refresh or re-index workspace content.

These advanced operations will be detailed in the Appendix section in the end.

Step 7: Verify and Test Joule

Now that the setup is complete, it’s time to test Joule. If you already have Unified Joule set up, you can launch Joule directly from the application. (E.g: Successfactors, Ariba, S/4 Private Cloud, IBP etc.)

If this is a new setup, launch Joule by navigating to Subaccounts → Instances & Subscriptions → Joule Instance, click the instance name to open it, and when you see “The service is up and running,” copy the URL and append /joule — for example: https://rigunifiedjoule-test-sge254ddd.eu10.sapdas.cloud.sap/joule

Before launching Joule, create a Role Collection under Subaccount → Security → Role Collections, add the end_user role, assign the role collection to your user in Subaccount → Security → Users.

Ask Joule questions related to your SAP Build Work Zone, advanced edition content (files, wikis, blogs, or knowledge base articles) that were included in the grounding configuration. If everything is working correctly, Joule should return context-aware answers derived from your organization’s grounded documents.

Step 8: Appendix

After completing the setup, you can manage and maintain your Document Grounding pipelines using additional API operations in Bruno or cURL. These include viewing all existing pipelines, deleting or re-creating a pipeline, manually triggering executions, and checking their status.

8.a. Get All Pipelines

Use a GET request to retrieve all existing Document Grounding pipelines in your Joule subaccount. This allows you to verify which pipelines are active and view their associated destinations.

In Bruno: Select your collection (DGcollection) → click New Request → name it Get All Pipelines
Enter the MTLS URL followed by /pipeline/api/v1/pipeline
E.g: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline

Add headers, save, and click → (Send😞 You will see all existing pipelines
accept: application/json
Authorization: Bearer <access_token>

Note: You need to get a new Bearer token if the previous token is expired. Check step 6.2 to get a new Bearer token

8.b. Delete a Pipeline

Use a DELETE request with the specific pipelineId to remove a pipeline that’s no longer needed or was incorrectly configured.

In Bruno: Select your collection (DGcollection) → click New Request → name it Delete Pipeline.

Enter your mTLS URL followed by /pipeline/api/v1/pipeline/<pipelineId>
Example: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline/aa11-bb22-cc33-dd44

Add headers, save, and click → (Send):
content-type: application/json
Authorization: Bearer <access_token>
Once executed, the pipeline with the given ID will be deleted successfully

8.c. Trigger a Pipeline

Use a POST request to manually trigger a pipeline execution. This can reindex or update metadata for all grounded documents in the selected pipeline.

In Bruno: Select your collection (DGcollection) → click New Request → name it Trigger Pipeline
Enter your mTLS URL followed by /pipeline/api/v1/pipeline/trigger
Example: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline/trigger

Add Body

{
  "pipelineId": "aa11-bb22-cc33-dd44",
  "metadataOnly": false
}

Add Headers, save, and click → (Send):
accept: application/json
Authorization: Bearer <access_token>

Once executed, the pipeline will start executing.

8.d. Check Pipeline Execution/Grounding Status of the documents

To check status of individual documents (files, wiki, knowledge article etc.)

In Bruno: Select your collection (DGcollection) → click New Request → name it Check Grounding Status.
URL: https://<your-mtls-url>/pipeline/api/v1/pipeline/<PipelineID>/documents
Example: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline/aa11-bb22-cc33-dd44/documents

Add Headers, save, and click → (Send):
accept: application/json
Authorization: Bearer <access_token>

8.e. Check Pipeline Status & Total executions

Replicate steps from 8.d and use "status" and "executions" instead of "documents" in the URL. You will get final status or total number of executions of the pipeline

URL: https://<your-mtls-url>/pipeline/api/v1/pipeline/<PipelineID>/status OR executions

Example: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline/aa11-bb22-cc33-dd44/status
Example: https://mtls.rage.c-1111.kyma.ondemand.com/pipeline/api/v1/pipeline/aa11-bb22-cc33-dd44/executions

SAP Work Zone vs. Analytics Cloud vs. Fiori Launchpad – Unified Analytics Comparison (Decision Tree)

2025-11-10T01:03:45.137000+01:00

In today's data driven world, enterprises need an intuitive and efficient digital workspace that unites business processes, analytics, and collaboration. SAP offers several powerful solutions like SAP Work Zone, SAP Analytics Cloud (SAC), and SAP Fiori Launchpad, while many organizations also extend their ecosystems with non-SAP BI tools such as Microsoft Power BI and Tableau. Selecting the right entry point depends on factors like data architecture, user experience, and the level of integration needed between SAP and non-SAP systems.

With more than 15 years of experience across SAP Analytics and Business Intelligence implementations, I have witnessed how organizations evolve their analytics strategies from siloed reporting to fully integrated decision environments. Through these diverse engagements, it is clear that tools like SAP Work Zone, SAC, Fiori Launchpad, and external BI platforms can coexist to deliver a unified, connected, and scalable analytics landscape. When combined with modern data platforms like Snowflake or SAP Datasphere / SAP Business Data Cloud(BDC), they empower enterprises to turn information into real-time insight.

Let's explore how each of these tools fits within a unified analytics ecosystem and how organizations can determine the right combination to maximize business value.

The Contenders: A Quick Overview

SAP Fiori Launchpad: The gateway to SAP applications, offering a role based, personalized user experience.
SAP Analytics Cloud (SAC): SAP's flagship analytics platform, combining BI, planning, and predictive capabilities in one solution.
SAP Work Zone: A digital workplace that integrates SAP and non-SAP applications, fostering collaboration and productivity.
Non-SAP BI Tools (Power BI, Tableau): Industry leading analytics platforms known for flexibility and advanced visualization.

SAP Fiori Launchpad: The Trusted Entry Point

SAP Fiori Launchpad has been a cornerstone of SAP's user experience strategy. It is the go to interface for accessing SAP S/4HANA FICO and other SAP applications.

Strengths:

Role based access to transactional applications and operational data.
Seamless integration with SAP systems.
Consistent, intuitive user experience.

Limitations:

Limited to SAP applications, no native support for non-SAP tools.
Lacks advanced analytics and collaboration features.

Best For: Organizations that primarily use SAP systems and need a streamlined interface for transactional workflows.

SAP Analytics Cloud (SAC): The All-in-One Analytics Powerhouse

SAP Analytics Cloud is SAP's answer to modern analytics needs. It combines BI, planning, and predictive analytics in a single cloud based platform.

Strengths:

Unified platform for reporting, dashboards and predictive analytics.
Deep integration with SAP source systems like SAP S/4HANA .
Built-in collaboration features for team based planning.

Limitations:

Limited flexibility for non-SAP data sources compared to tools like Power BI or Tableau.
Steeper learning curve for non-SAP users.

Best For: Organizations heavily invested in SAP systems that want a single platform for analytics and planning.

SAP Work Zone: The Digital Workplace Revolution

SAP Work Zone is a relatively new addition to the SAP ecosystem, designed to create a unified digital workplace. It integrates SAP and non-SAP applications, making it a versatile tool for modern enterprises.

Strengths:

Unified access to SAP and non-SAP applications.
Built-in collaboration tools like chat, news feeds, and document sharing.
Customizable workspaces for teams and projects.

Limitations:

May be overkill for organizations that only need analytics or transactional access.
Requires additional configuration for seamless integration with non-SAP tools.

Best For: Organizations looking to enhance collaboration and provide a single point of access for SAP and non-SAP tools.

SAP Work Zone, together with the SAP Analytics Cloud Catalog, now carries forward and enhances the capabilities of the earlier SAP Analytics Hub. While Analytics Hub focused primarily on report cataloging, Work Zone extends that vision into a full digital workplace integrating analytics, applications, and collaboration in a single experience.

Non-SAP BI Tools: Power BI and Tableau

While SAP tools excel in their native ecosystem, non-SAP BI tools like Microsoft Power BI and Tableau offer unmatched flexibility and visualization capabilities.

Strengths:

Superior data visualization and user friendly interfaces.
Extensive connectivity to non-SAP data sources like Snowflake, AWS, and Google BigQuery.
Strong community support and third party integrations.

Limitations:

Limited native integration with SAP systems.
May require additional middleware for seamless data flow.

Best For: Organizations with diverse data sources that prioritize visualization and flexibility over deep SAP integration.

The Hybrid Approach: SAC for SAP, Power BI for Non-SAP

Across several SAP Analytics implementations, a hybrid approach has consistently proven effective for unifying enterprise reporting.
SAP Analytics Cloud (SAC) is typically used for SAP source systems, leveraging its deep integration with SAP S/4HANA, along with robust planning capabilities.
Microsoft Power BI complements this by connecting to non-SAP systems such as Snowflake, offering flexibility, advanced visualization and ease of consumption for broader business audiences.

This approach allows us to:

Maintain a single source of truth for SAP data within SAC.
Leverage Power BI's advanced visualization capabilities for non-SAP data.
Use Snowflake as the central data warehouse to integrate data across the organization.

Which Tool Should Be the First Point of Enterprise Access?

The answer depends on your organization's priorities:

If SAP integration is key: Start with SAP Fiori Launchpad or SAP Work Zone, depending on whether you need transactional access or a collaborative digital workplace.
If analytics is the focus: Use SAP Analytics Cloud for SAP data and Power BI or Tableau for non-SAP data.
If collaboration and integration are critical: SAP Work Zone is the clear winner, providing a unified interface for SAP and non-SAP tools.

Visualizing the Decision: A Comparison Chart & Decision Tree

To make this easier, here’s a quick comparison chart:

Feature	SAP Fiori Launchpad	SAP Analytics Cloud	SAP Work Zone	Power BI/Tableau
SAP Integration	Excellent	Excellent	Excellent	Limited
Non-SAP Integration	None	Limited	Excellent	Excellent
Analytics Capabilities	Basic	Advanced	Basic	Advanced
Collaboration Features	None	Moderate	Advanced	Limited
Best For	SAP Transactions	SAP Analytics	Unified Workplace	Non-SAP Analytics

Figure: Decision Tree among the available Tools

Final Thoughts

In today's complex analytics environment, there is no single solution that fits every organization. Success lies in aligning technology choices with business objectives, data strategy, and user needs. The most forward-thinking enterprises design flexible analytics ecosystems, balancing governance, agility, and usability to ensure analytics becomes an enabler, not a barrier.

Based on experience across multiple SAP programs, hybrid architectures often offer the strongest foundation. SAP Analytics Cloud (SAC) provides deep integration and governance for SAP data, while platforms like Power BI or Tableau enhance visualization and flexibility for non-SAP data sources. Combined with centralized data hubs like Snowflake or SAP Datasphere or SAP Business Data Cloud (BDC), this model ensures consistency, scalability, and end-to-end insight.

As SAP continues to innovate, solutions such as SAP Work Zone and the SAC Catalog are transforming how users access, share, and collaborate on analytics content. They bridge the gap between SAP and non-SAP systems, creating a truly unified workspace for both business and IT teams.

Ultimately, the goal is not to choose a single tool but to build an integrated analytics ecosystem, one that empowers users at every level to make data driven decisions confidently. Whether an organization adopts a purely SAP centric approach or a hybrid model, the future of analytics lies in seamless connectivity, collaboration and intelligent decision making.

Onboarding to SAP Build Work Zone, Advanced Edition for SAP BTP Subaccount

2025-11-21T09:43:25.952000+01:00

Step 1: Prerequisites

Open your Identity Authentication admin environment.
1. Open your SAP BTP Subaccount
2. Click on Trust Configuration under security tab
3. Select Custom Identity Provider for Applications
4. In the Identity Provider click on Administrator Console
Choose the User Groups tile.
Click + Add and create the following groups:

Note: The Name and Display Name must be identical. They must match exactly as listed below to align with the Identity Provisioning transformation code. If you modify any name, update the transformation logic accordingly.

Workzone_Admin
Workzone_Area_Admin
Workzone_Support_Admin
Workzone_Page_Content_Admin
Workzone_End_User
Workzone_User_Type_public

4. Navigate to User Management.

5. Assign yourself to the Workzone_Admin group.

Step 2: Run the Booster

In the SAP BTP cockpit, open your Global Account.
From the left-side menu, select Boosters.
Locate Get Started with SAP Build Work Zone, Advanced Edition and click Start.

Step 3: Post-Booster Configuration

Connect Your Subaccount to Identity Provisioning

Prerequisites:

The integration with the Identity Provisioning service supports only one active Identity Authentication tenant. Before you start the configuration, open the cockpit, Security Trust Configuration, and verify that you have only one active Identity Authentication trust configuration in the list. The default IdP, sap.default, is not relevant to the flow and can be ignored for this requirement. After the connection is formed, you can configure additional active IdPs.
If you already have an active Identity Authentication tenant, you are required to reconnect it to the Identity Provisioning service after you've modified it.

Connector Setup for User & Group Provisioning:

Note: This step is required only if you don't already have an active tenant with SAP Build Work Zone, advanced edition connector configured for your subaccount.

Open the Site Manager:
- In BTP cockpit, navigate to Services → Instances and Subscriptions.
- Open the subscription for SAP Build Work Zone, advanced edition.
From the left menu, go to Settings → Identity Provisioning.
Click Connect.

Step 4: Run the Configurator

Access the Site Manager as follows: In the SAP BTP cockpit, Services Instances and Subscriptions, click on the subscription to SAP Build Work Zone, advanced edition in the Subscriptions table to access the application.
Open the Configurator screen from the left-side menu.

4.1 Create a Destination to SAP SuccessFactors (Optional)

The step Create a Destination to SAP SuccessFactors is optional and can be skipped if not required.

4.2 Set Up Environment

In this step, select the domain type - Default and then click Trigger Setup to complete the configuration steps required for the setup of your tenant.

4.3 Configure Identity Authentication and Identity Provisioning

In this step, you'll need to manually configure Identity Authentication and Identity Provisioning to enable user authentication and user provisioning.

4.3.1 : Create an app in Identity Authentication

Download the metadata(This will be used in step 4)
Open the administration console for SAP Cloud Identity Services. To do so, in SAP BTP cockpit, go to Security -> Trust Configuration, click the link pointing to your active Identity Authentication and add /admin to the URL.
Go to Applications & Resources -> Applications and click +Add to add a new application from type SAP BTP Solution. Provide a meaningful name such as SAP Build Work Zone, advanced edition. Select the protocol type SAML 2.0.
Open the SAML 2.0 Configuration editor of the application you've created, and upload the service provider metadata file that you’ve downloaded from the configurator. Save your changes.
Open the Subject Name Identifier editor of the application, and change the basic configuration attribute from User ID to Global User ID.

4.3.2 Set Identity Authentication as a source system

In the administration console for SAP Cloud Identity Services, go to the Administrators tile and create a technical user (of type System)
Client ID will be automatically generated
Under the Secrets click on Add button give a meaningful description and click Save.

Note: A secret will be generated, copy this and save it as won't be visible again

Make sure Manage Users and Manage Groups authorization roles are enabled for the technical user. This way, you can create, edit and delete users and groups in the Identity Authentication user store.
Go to Admin Console -> Identity Provisioning -> select source system -> Click on Add -> Give a name to a source system and select type Identity Authentication and save it.
Go to Properties -> and add properties as mentioned below:

Mandatory Properties
Property Name	Description & Value
Type	Enter: HTTP
URL	<Identity Provider URL from prerequisites Step 1>
ProxyType	Enter: Internet The Identity Authentication service is a cloud solution and is outside of your company on-premise infrastructure.
Authentication	Enter your authentication method: BasicAuthentication
User	<Client ID from Step 4.3.2 - (2)>
Password	<Secret from Step 4.3.2 - (3)>
Optional Properties
Property Name	Description & Value
ias.<property_name> scim.<property_name>	When using SCIM API version 2, property names start with ias prefix, for example: ias.user.unique.attribute. When using SCIM API version 1, property names start with scim prefix, for example: scim.user.unique.attribute. For more information, see List of Properties. Use the main search or filter properties by Name or System Type columns.
ias.user.filter	When specified, only those users matching the filter expression will be read. For example: name.familyName eq "Smith" and addresses.country eq "US" This filter will read only users whose name is "Smith" and are living in the United States. For more information, see Identity Directory SCIM API: User Search
ias.group.filter	When specified, only those groups matching the filter expression will be read. For example: displayName eq "ProjectTeam1" This filter will read only groups, whose display name is "ProjectTeam1". For more information, see Identity Directory SCIM API: Group Search
ips.failed.request.retry.attempts	Predefined value: 2
ips.failed.request.retry.attempts.interval	Predefined value: 60

4.3.3 Set SAP Build Work Zone, advanced edition as a target system using the following parameters

These parameters are already provided in the configurator tab in the site manager copy all these values mentioned in this step and add it in the target system.

Go to Admin Console -> Identity Provisioning -> select target system -> Click on Add ->

In Details tab give a name to a target system and Type should be SAP Build Work Zone, advanced edition.
Go to Properties tab and maintain below mentioned properties and Save it.

Mandatory Properties
Property Name	Description & Value
Type	Enter: HTTP
URL	From the above screenshot Integration url should be added here
ProxyType	Enter: Internet
Authentication	BasicAuthentication
User	Provide the value OAuth Client Key mentioned in the above screenshot
Password	Provide the value OAuth Client Secret mentioned in the above screenshot

Optional Properties
Property Name	Description & Value
ias.<property_name> scim.<property_name>	When using SCIM API version 2, property names start with ias prefix, for example: ias.user.unique.attribute. When using SCIM API version 1, property names start with scim prefix, for example: scim.user.unique.attribute. For more information, see List of Properties. Use the main search or filter properties by Name or System Type columns.
ias.user.filter	When specified, only those users matching the filter expression will be read. For example: name.familyName eq "Smith" and addresses.country eq "US" This filter will read only users whose name is "Smith" and are living in the United States. For more information, see Identity Directory SCIM API: User Search
ias.group.filter	When specified, only those groups matching the filter expression will be read. For example: displayName eq "ProjectTeam1" This filter will read only groups, whose display name is "ProjectTeam1". For more information, see Identity Directory SCIM API: Group Search
ips.failed.request.retry.attempts	Predefined value: 2
ips.failed.request.retry.attempts.interval	Predefined value: 60

4.4 Configure and Run Provisioning Job

Once both Source System and Target System is configured follow below steps to Run Provisioning Job.
Go to Source System already created in the step 4.3.2.
Go to the Jobs tab and Run Read Job.

4. Go to Identity Provisioning -> Provisioning Logs to verify the job logs, which should display a successful status.

As you complete each of these steps keep ticking the checkboxes and then last step would be to launch the Build Workzone.

Reference Documents:
https://help.sap.com/docs/build-work-zone-advanced-edition/sap-build-work-zone-advanced-edition/prerequisites?locale=en-US

https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/sap-build-work-zone-advanced-edition?locale=en-US

Building Pro-Code Extensions for SAP Mobile Start leveraging mobile native functionalities

2025-11-27T15:04:08.058000+01:00

We just concluded this year's SAP TechEd with two very insightful in-person events – SAP TechEd 2025 in Berlin (Nov 4–5) and SAP TechEd on Tour Bangalore (Nov 25–26). As depicted in the announcement blog post of my colleague Thilo Berndt, the mobile topics were again very well covered in various sessions and activities. As part of which, we were conducting a Hands-on Workshop both in Berlin and Bangalore called "CA260 – Learn how to build your own app and use it in SAP Mobile Start", which we would like to recap in this blog post and highlight the most interesting technical aspects.

Overview

SAP Mobile Start is the native entry point to the SAP Business Suite, to all relevant business processes, data, and content. It provides access to native or web-responsive business apps along with other content and critical business information. This includes notifications and consolidated views on tasks, approval workflows, and SAP S/4HANA situations. SAP Mobile Start provides business information from SAP Start, SAP Build Work Zone, standard edition, and SAP Build Work Zone, advanced edition. Non SAP content can be integrated as well. It runs on iOS, iPadOS and Android devices, on watchOS and Wear OS devices, and on Apple Vision

While one significant aspect of SAP Mobile Start is to provide access to SAP’s role-specific standard content, such as business applications and tiles exposed from SAP S/4HANA via SAP Build Work Zone, this year’s SAP TechEd Hands-On Workshop CA260 centered on the ease of building pro-code extensions using SAP Build and specifically SAP Build Code with the SAP Cloud Application Programming Model (CAP). Participants were able to experience the necessary steps in building and deploying such a pro-code extension, as well as how to specifically utilize mobile native capabilities within that extension, such as Widgets (e.g. on the iOS Home and Lockscreen) and (Push) Notifications.

The session material and exercises are available on Github within the repository SAP-samples/teched2025-CA260. We do highly recommend checking out the exercises and trying them out on your own development system environment. This blog post will provide a brief overview of the most important steps and technical activities.

Please note that the session material on Github as well as some screenshots and code snippets in this blog post will contain usages of "###" as a placeholder for the participant number that was assigned in the hands-on workshop. Participants were instructed to replace these occurrences with their own participant number.

Building and Deploying the base version of the extension

The exercises started by building and deploying an initial version of the extension that the workshop is using as an example. As the initial version provided to participants, we are using a slightly modified version of the "Incidents Management" CAP sample application. The provided full-stack application and its dependencies are defined in the Multitarget Application descriptor (mta.yaml) which is being built and packaged into an mta archive (.mtar) during the build operation, which eventually gets deployed to the SAP Business Technology Platform (BTP), specifically SAP BTP Cloud Foundry environment. While the workshop is making use of SAP Build Code and its productivity tooling for developing full-stack applications with CAP, building the MTA project and deploying the build artifact to the SAP BTP, you can as well use your IDE of choice such as Visual Studio Code.

Screenshot: Overview of the project structure

With the deployment, the CAP application (in terms of the server logic) is running an application container on the Cloud Foundry Runtime. The UI of our full-stack application is realized using SAP Fiori Elements, which is generating the User Interface based on standard floorpans and UI annotations as part of the service definitions using CDS. The Fiori frontend application lives within the HTML5 Repository of the SAP BTP. While this would already be sufficient to expose our extension to SAP Build Work Zone and SAP Mobile Start as an application tile and run the frontend within the shell of SAP Build Work Zone using its managed Approuter, we want to have more control over the visual representation.

Frontend deployed to the HTML5 Repository; backend application deployed to Cloud Foundry

We can achieve this greater control by leveraging SAP Build Work Zone's content definition format – the Common Data Model (CDM). The definition of which is documented here and represents a standardized data structure for defining business apps, their visual representation, the required roles, and the logical hierarchical structure in which business apps shall be organized using a concept called "Spaces & Pages". Such CDM structure can be supplied to the HTML5 Repository during deployment of our extension. In the workshop's repository, this definition resides in the /workzone/cdm.json file.

Integrating the app into SAP Build Work Zone & SAP Mobile Start

For integrating our extension into SAP Build Work Zone, which makes it automatically available to SAP Mobile Start, we leverage a relatively new feature of the SAP Build Work Zone Channel Manager – defining a HTML5 Business Solution. While we could also create a regular Content Provider, using the new Content Channel type "HTML5 Business Solution" further simplifies the process as we are not required to manage any design-time destination. The HTML5 repository is merging all deployed HTML5 applications and their CDM definition from a common "Business Solution", making it available for selection as a joint Content Channel by the "Business Solution" dropdown.

Creation of a HTML5 Business Solution Content Channel in SAP Build Work Zone

This value used for merging multiple HTML5 application belonging to the same business solution is done via a dedicated property ("service" under "sap.cloud") in the web applications manifest.json. If you want to read more about HTML5 Content Consumption capabilities of SAP Build Work Zone, we can recommend this excellent blog post from our colleague Rupam who is part of the SAP Build Work Zone team.

{
  "_version": "1.65.0",
  "sap.app": {
    "id": "com.sap.ca260.###",
    "type": "application",
    [...]
  },
  [...]
  "sap.cloud": {
    "public": true,
    "service": "ca260###"
  }
}

After adding the Content Channel's role to our Site and making sure we have the role assigned to our desired users, we can see it exposed in SAP Build Work Zone using the browser as well as in SAP Mobile Start – Nice! As defined in the /workzone/cdm.json file, the application tile of our built extension is placed onto a Page with the title "Apps from Participant CA260-000", which itself is available under a Space named "Extensions from CA260".

Deployed application visible in SAP Build Work Zone and SAP Mobile Start

Extending the app to make use of Widgets on your mobile device

The steps to extend now our application in order for it to be configurable as a Widget, for example on the iOS Homescreen or the Lockscreen, are actually much easier than you might think. SAP Mobile Start offers multiple types of Widgets. The one we will be using here is the "Business Info Widget", which can be configured to display any KPI that is available to SAP Mobile Start. In technical terms this means that we need to enhance the application tile of our extension to become a "Dynamic App Launcher". In the simplest case, these are tiles showing a number coming from a connected data service. In more complex scenarios, these can also display criticalities, trend and more information around the selected KPI.

The process to transform our basic tile into a Dynamic App Launcher is fairly simple. Within our web application's manifest.json file, we can add the required definition to make it such a dynamic tile and connect it to our OData service for incidents available in our CAP application. For our example, let's point to the OData count of incidents and filter for incidents that are not in status closed using the status_code property. The needed configuration resides within the inbound definition under the node "indicatorDataSource". In order to make this change visible on our environment, the updated version needs to be deployed and the Content Channel needs to be synced.

Transforming the application tile into a DynamicAppLauncher

As a result, our application now appears a KPI tile on our Site and in SAP Mobile Start and we can monitor the automatically updated value both inside of SAP Mobile Start – for example when accessing the Page or by adding the app into my favorites on the Start tab of SAP Mobile Start. This fact allows us to configure the same Dynamic App Launcher tile as a Widget, for instance to our iPhone's Homescreen.

Pro tip: Why not mirroring your iOS Widget of open incidents to your Mac or configure the same on your Apple Watch as a watch face complication?

The Dynamic App Launcher tile appearing in SAP Build Work Zone and SAP Mobile Start

Implementing our own (push) notifications

Let's now go one step further and implement our own notifications from our CAP application. The beauty of the integration via SAP Build Work Zone and SAP's notification framework leveraging the SAP Alert Notification Service on BTP is, that such notifications will automatically appear on our SAP Build Work Zone Site in the browser, in SAP Mobile Start under the notification bell as well as be delivered as a mobile native push notification to the mobile devices on which you use SAP Mobile Start. That's a game changer for informing your users about a time critical situation directly from your pro-code extensions.

For CAP based extensions, we can make use of the @cap-js/notifications plugin. The plugin communicates with the necessary APIs using a Destination that needs to be created in the SAP BTP Subaccount in which the application will run. By default it expects the name for the Destination to be SAP_Notifications if not configured differently. The values for this Destination can be retrieved from the Settings of SAP Build Work Zone (Administrator role required).

For sending actual notification from our CAP service, we need to define our desired NotificationTypes first in the /srv/notification-types.json. These defined types represent the blueprint for the actual notifications to be sent. They include the texts for the actual notifications in all the languages that shall be supported with dedicated placeholders which will be filled when the notification is actually triggered in the service logic. Below you can see an example for such a type:

{
    "NotificationTypeKey": "IncidentCreated",
    "NotificationTypeVersion": "1",
    "Templates": [
      {
        "Language": "en",
        "TemplatePublic": "New Incident created",
        "TemplateSensitive": "New incident created by {{customer}}",
        "TemplateGrouped": "Incident Status Update",
        "TemplateLanguage": "mustache",
        "Subtitle": "{{description}}"
      },
      {
        "Language": "de",
        "TemplatePublic": "Neuer Vorfall eingegangen",
        "TemplateSensitive": "Neuer Vorfall von {{customer}}",
        "TemplateGrouped": "Vorfall Status Änderungen",
        "TemplateLanguage": "mustache",
        "Subtitle": "{{description}}"
      }
    ]
  }

Sending actual notification is fairly easy and can be done with very few lines of code. We first need to initialize the notifications plugin with cds.connect.to('notifications'), which creates a handle with which we can send notifications later. Sending notifications can be done with the function alert.notify. Here, we reference the desired NotificationType (defined before), recipients and further properties and data related to this specific notification we intend to send.

Coding used to send notification when incidents are created and closed.

As a result, we receive a push notification at the event of incident creation and closure. Already in the push notification displayed by the mobile operating system, we see the defined texts from our NotificationType with the specific values filled for the specific incident object. When tapping on this push notification, SAP Mobile Start shows the full notification in the dedicated area of the mobile app. Using "Open in Browser" brings us to this specific incident in our SAP Fiori Elements application where we could take further action. This is achieved by supplying the Intent Based Navigation (IBN) information of our app – consisting of the Semantic Object and Action defined in our web application's manifest. This allows SAP Mobile Start and SAP Build Work Zone to open the right application as a navigation target from the exposed content – in our case, the SAP Fiori Elements application running the HTML5 Repository and exposed to SAP Build Work Zone using the HTML5 Business Solution Content Channel. The deep link to the specific incident object is achieved by supplying a special navigation target parameter that SAP Fiori Elements supports for opening the desired "Inner App Route" – in our example, the Object Page of a specific incident using its ID. Feel free to check out how this was done for this specific example in the repositories' code.

The notification details visible in SAP Mobile Start and the deep-link navigation to the SAP Fiori Elements application

Outlook

We hope we were able to show, how easy it is to create pro-code extensions, deploy them to the SAP BTP, integrate them into SAP Build Work Zone & SAP Mobile Start. The demonstrated examples of mobile native widgets and push notifications hopefully showed the ease of leveraging the mobile native device capabilities. Beyond the content of the CA260 Hands-On Workshop of SAP TechEd 2025, we would like to give you an outlook to what else would be possible with this basis.

The beauty of using the HTML5 Business Solution Content Channel Exposure in SAP Build Work Zone is that we have the flexibility and feature set of the Common Data Model (CDM) available. We could further extend the /workzone/cdm.json file to make use of even richer visualization capabilities – for example by defining a declarative UI Integration Card. Such cards allow to achieve UI richt micro-experiences right on the Page's structure, for example displaying a short list of incidents with the most important information to get a brief overview as a processor. In the browser when consuming the page via SAP Build Work Zone, the card is rendered as a regular SAP UI5 UI Integration Card. In SAP Mobile Start, declarative cards are supported as mobile native UI elements. With a single declarative definition of such a card using the UI Integration Card framework, we can achieve native cross-platform support with a high quality user experience directly within SAP Mobile Start.

Having a UI Integration Card added to the Page in SAP Build Work Zone and SAP Mobile Start

For further information on SAP Mobile Start related features and topics, please check our SAP Mobile Start documentation. Visit SAP Mobile Experience Community Page and click “follow” to get the latest development and innovation of our solutions. We look forward to hearing about your experience with these hands-on exercises; please do share your thoughts and comments below.

User Provisioning with Microsoft Entra ID (AD) in Cloud Identity Service

2025-12-10T07:50:10.594000+01:00

(A Complete Step-by-Step Guide)**

Hi Folks,

After extensive analysis and hands-on troubleshooting with user provisioning in SAP Cloud Identity Services, I decided to document the entire process. My goal is to help others quickly and smoothly integrate Microsoft Entra ID (formerly Azure Active Directory) with SAP Cloud Identity Services.

If you are planning to onboard corporate users into SAP’s Identity Authentication Service (IAS) using Identity Provisioning Service (IPS), this guide will save you hours of effort.

Requirement

Sync all corporate users from Microsoft Entra ID into SAP Cloud Identity Services (CIS).
These users already exist in Entra ID and need to be replicated to IAS.
Avoid manual user creation in IAS.
By configuring IPS, we can schedule daily jobs to automatically sync new or updated users.
Use the synced users in SAP BTP applications
(especially those using CIS for authentication) to assign roles, groups, and access for our SAP Build Work Zone.

Analysis

After diving deep into SAP Help documentation and performing several tests, I consolidated the exact approach that fulfills the requirement. The complete activity consists of five main steps.

Five-Step Integration Process

Step 1: Perform App Registration in Microsoft Entra ID

This activity is typically handled by the Azure team.
Refer to SAP Help documentation for detailed instructions:
Microsoft Entra ID Integration
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/microsoft-entra-id

Once App Registration is complete, the Azure team will share the following information:

Application ID
Directory Tenant ID
Object ID
Client Secret Value
Client Secret ID
aad.domain.name

These parameters will be used in the Source System configuration of Identity Provisioning Service (IPS).

Step 2: Configure Microsoft Entra ID as a Source System in IPS

Follow the SAP Help documentation:
Microsoft Entra ID – Source System Configuration
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/microsoft-entra-id

Below is the Screen Shot which shows the Source System:

Below is an example of mandatory source system properties:

Property Name Value

aad.domain.name	`<CompanyName>.onmicrosoft.com`
aad.group.attributes	id,displayName,mailNickname
aad.user.attributes	id,mail,userPrincipalName,displayName,mailNickname,givenName,surname,mobilePhone,businessPhones
Authentication	BasicAuthentication
ips.trace.failed.entity.content	false
oauth.resource.name	https://graph.microsoft.com
OAuth2TokenServiceURL	https://login.microsoftonline.com/<Company Name>.onmicrosoft.com/oauth2/token
Password	Client Secret Value
ProxyType	Internet
Type	HTTP
URL	https://graph.microsoft.com
User	Application ID

Below the screenshot for same:

Step 3: Configure Identity Authentication (IAS) as the Target System

SAP Help documentation for IAS as a target:
Identity Authentication – Target System Configuration
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/target-identity-authentication

Important:
Select the correct Source System for this Target System.
Otherwise, IAS will attempt to read data from all existing source systems in IPS.

Below is the Screen shot of Target System for referece:

Mandatory IAS target system properties:

Property Name Value

Authentication	ClientCertificateAuthentication
ias.api.version	2
ias.user.unique.attribute	userName
ips.failed.request.retry.attempts	2
ips.failed.request.retry.attempts.interval	60
ips.trace.failed.entity.content	false
ProxyType	Internet
Type	HTTP
URL	https://`<CIS Domain Name>`.accounts.ondemand.com/

Step 4: Run the “Simulate Job”

Before performing the actual sync, run the Simulate Job from the Source System.

Below is the screen shot to run the Simulate Job:

This job allows you to check:

How many users will be read
What changes will be made
Any potential errors or mismatches

You can view results under Provisioning Logs in IPS.

Step 5: Run the “Read Job” (Actual User Sync)

This is the real provisioning job.

IPS reads users from Microsoft Entra ID
Then writes them into Identity Authentication Service (IAS)

Check Provisioning Logs for status, errors, or successful user creation.

Below is the screen shot for reference:

Optional: Schedule Recurring Provisioning Jobs

You can set up a scheduled job (daily, weekly, etc.) to automatically sync delta changes from Microsoft Entra ID into IAS.

This ensures user data stays consistently updated without manual intervention.

Summary

This guide provides all essential steps required to integrate Microsoft Entra ID with SAP Cloud Identity Services using Identity Provisioning Service (IPS). I hope it helps you streamline user onboarding and avoid manual user creation in IAS.

If you have any questions or face any issues, feel free to ask.

Regards,
Rohit Gera

Tribute to Thomas Volmering

2025-12-23T11:06:24.578000+01:00

📢 Today is @thomas_volmering's last day at SAP.

Thomas joined SAP 26 years ago, and I met him when he was head of Product Management for SAP Build Process Automation, before he became Head of Product for SAP Build. Together we worked on many communication projects for SAP Build, including technical blog posts that you can read here. 📰

Let me just say that it has been a great pleasure and also some fun working with him, and I thank Thomas a lot for that. 🙏🏻

Please join me in wishing Thomas the very best for what's to come! 👍🏻

Push UUID from IAS to S4HANA - Tasks list on BTP task Center is empty for S4HANA

2026-01-01T05:41:20.344000+01:00

Introduction:

After completing all prerequisites and following the SAP documentation to configure the Task Center for an SAP S/4HANA system, it is quite common to encounter a situation where no tasks are displayed in the Task Center—even though task creation appears to be working correctly in the backend.

This blog addresses one of the most frequently overlooked root causes behind this issue: the absence of a Global User ID (UUID) in the SAP S/4HANA system. Even when the Task Center is correctly configured on SAP BTP and tasks are visible in the pull cache, missing UUID mapping can prevent the Task Center from resolving the processor correctly, resulting in an empty Task Center UI.

In this blog, I will walk you through a critical but often missed step required to ensure tasks are displayed correctly in the Task Center. The focus is on establishing a one-way synchronization from SAP Identity Authentication Service (IAS) to SAP S/4HANA to push the UUIDs for existing users, without performing a full user provisioning or re-synchronization.

Solution:

Even after configuring the Task Center on HANA on-premise and completing all required steps on BTP, the Task Center may appear empty, as shown in the screenshot below.

When you check the Task Center pull cache, you can see that the task exists; however, it is still not displayed in the Task Center app. As shown in the screenshot below, the task appears with the processor name set to the SAP user ID. This situation occurs when a GUID (UUID) is not available in the SAP HANA system. In such cases, the system falls back to using the SAP user ID instead of the UUID. As a result, the Task Center is unable to correctly resolve the processor, and the task is not displayed in the Task Center app.

To resolve this issue, we need to ensure that a UUID is available in the SAP system. The steps to achieve this are explained below. Before updating the UUID in the SAP HANA system, the user profile in the SU01 screen appears as shown in the screenshot below.
SU01-->Goto-->External User ID(UID)

Please note that in this scenario, we are not synchronizing SAP users to IAS and then syncing the UUID back to the HANA system. Since the UUIDs and users already exist in IAS as a result of the SuccessFactors integration, we will establish a one-way synchronization from IAS to SAP S/4HANA solely to push the UUID into the system

To push the UUID (Global User ID) to SAP system please follow below steps.

Prerequisite:
1. Login to your Cloud Connector: Make sure your Cloud connectors connection from BTP to HANA has access to below BAPI/FM

PRGN_ROLE_GETLIST
BAPI_USER_GETLIST
BAPI_USER_GET_DETAIL
BAPI_USER_CREATE1
BAPI_USER_ACTGROUPS_ASSIGN
IDENTITY_MODIFY
BAPI_USER_DELETE
PRGN_ACTIVITY_GROUPS_LOAD_RFC

2. Create a technical user in SAP HANA, or reuse an existing technical user that is used to pull tasks for the Task Center. Ensure that this user is assigned the required role listed below. This technical user will be used to create the RFC destination in the BTP subaccount, which will later be used to create the target system in IAS

SAP_BC_JSF_COMMUNICATION

3. Create a RFC destination on the BTP account where your IAS is hosted by referring to below SAP guide.
https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/create-rfc-destinations

Note: If you prefer to create the RFC destination in a different subaccount - perhaps within the same sub account as SAP Work Zone or the Task Center- ensure that you create an Identity Access Management (IAM) service instance in that subaccount. This is required so that the RFC destination you create is visible in the IAS administration console.

After completing the prerequisites, log in to IAS and create the source and destination systems to perform the push.

Creating Source system: Because the users are already available in IAS, select Local Identity Directory as the source system.
Creating the Source system is straightforward.

{
    "user": {
        "mappings": [
            {
                "sourcePath": "$.id",
                "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:User']['userId']",
                "targetVariable": "entityIdSourceSystem"
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
            },
            {
                "sourcePath": "$.schemas",
                "targetPath": "$.schemas",
                "preserveArrayWithSingleElement": true
            },
            {
                "sourcePath": "$.userName",
                "targetPath": "$.userName",
                "optional": true,
                "correlationAttribute": true
            },
            {
                "sourcePath": "$.displayName",
                "targetPath": "$.displayName",
                "optional": true
            },
            {
                "sourcePath": "$.groups",
                "targetPath": "$.groups",
                "optional": true,
                "preserveArrayWithSingleElement": true
            },
            {
                "sourcePath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:User']",
                "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:User']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystem']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystem']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystemId']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystemId']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userId']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userId']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:enterprise:2.0:User']['employeeNumber']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:enterprise:2.0:User']['employeeNumber']",
                "optional": true
            }
        ]
    },
    "group": {
        "ignore": true,
        "mappings": [
            {
                "sourcePath": "$.id",
                "targetVariable": "entityIdSourceSystem",
                "correlationAttribute": true
            },
            {
                "sourcePath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']",
                "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']"
            },
            {
                "sourcePath": "$.displayName",
                "targetPath": "$.displayName"
            },
            {
                "sourcePath": "$.members",
                "targetPath": "$.members",
                "optional": true,
                "preserveArrayWithSingleElement": true
            }
        ]
    }
}

Create Target system: Here our target is SAP HANA. below refer below screenshots and code snippet to create the same. here the target system type is SAP Application Server ABAP. and please select the destination which you created in prerequisite step 3.
Make sure you skip operations for delete and create as we trying to do update only and you can also update the alias(email), groups roles to S4HANA along with UUID but here i am only focusing on UUID.

{
    "user": {
        "skipOperations": [
            "create",
            "delete"
        ],
        "mappings": [
            {
                "sourceVariable": "entityIdTargetSystem",
                "targetPath": "$.USERNAME"
            },
            {
                "sourcePath": "$.userName",
                "targetPath": "$.USERNAME"
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
                "targetPath": "$.SAPUSER_UUID.SAP_UID"
            },
            {
                "constant": "updateEntity",
                "targetVariable": "operationTypeVariable"
            },
            {
                "constant": "createEntity",
                "targetVariable": "operationTypeVariable",
                "scope": "createEntity"
            },
            {
                "condition": "$.active == false && '${operationTypeVariable}' == 'createEntity'",
                "constant": "X",
                "targetPath": "$.LOCK_LOCALLY"
            },
            {
                "condition": "'${operationTypeVariable}' == 'updateEntity'",
                "constant": "U",
                "targetPath": "$.LOCK"
            },
            {
                "condition": "$.active == false && '${operationTypeVariable}' == 'updateEntity'",
                "constant": "L",
                "targetPath": "$.LOCK"
            }
        ]
    }
}

Once the source and target systems are created, open the source system and perform a test run for a single user to ensure that everything is working correctly. After successful validation, you can remove the user filter and perform a mass update for all users in the system.

Once the update is completed you will be able to see UUID in SU01 user profile as below.

Also, The Task Center pull cache will have UUID for the processor field instead of the SAP user name and Tasks will be shown in the Task center as below.

Conclusion:

An empty Task Center—despite correct backend task creation and successful pull cache entries—can be misleading and time-consuming to troubleshoot. As demonstrated in this blog, the root cause is often the absence of a UUID in the SAP S/4HANA user master, which prevents the Task Center from resolving the task processor correctly.

By ensuring that the Global User ID (UUID) is pushed from IAS to SAP S/4HANA through a one-way synchronization, this issue can be resolved effectively without impacting existing user provisioning or SuccessFactors integrations. Once the UUID is updated in the SU01 user profile, the Task Center pull cache correctly reflects the UUID, and tasks become visible in the Task Center application as expected.

I hope this blog helps you avoid common pitfalls during Task Center setup and saves valuable troubleshooting time. Feel free to share your feedback or experiences, and happy learning!

Thanks and Regards,
Navyashree

Using SCIM API for User & User List management in SAP Build Work Zone, Advanced Edition

2026-01-02T18:53:19.672000+01:00

If you’ve worked with SAP Build Work Zone, advanced edition, you might have come across the SCIM 2.0–compliant API. This API is designed for managing Users and User lists, following the common specification.
Now, SCIM is a broad standard with many optional elements. SAP’s implementation focuses on the essentials, so not every optional detail is covered - but everything you need for user and list management is there.

Where does this SCIM API fit in the Work Zone landscape?

The SCIM API is utilized by SAP Identity Provisioning Service (IPS) to handle User and List management for the Digital Workplace Service component of both following variants- SAP Build Work Zone, Advanced Edition and SAP SuccessFactors Work Zone.

If you’re configuring IPS for Work Zone user provisioning, you’ll find detailed guidance in our help documentation.

IPS should always be used as the primary means of User provisioning & management in Work Zone.
But what if you want to go hands-on with the API yourself, for small scale user data adjustment or simply to check data? That is what we are going to cover in this blog.

Important resource to go through before attempting to use the API-> Using the SCIM API | SAP Help Portal

Key elements needed to use the SCIM API for User & List Management-

Digital Workplace (DWS) URL-> Administration Console -> Overview -> Custom Domain URL (for Jam instances not using custom domain, just the regular DC URL- jamX.sapjam.com)
SCIM API Client Key: Administration Console -> OAuth Clients -> SCIM Client (will have integration URL as http://www.simplecloud.info) -> Key
SCIM API Client Secret: Administration Console -> OAuth Clients -> SCIM Client (will have integration URL as http://www.simplecloud.info) -> Secret
SCIM API Token URL-> https://<DWS URL>/api/v1/auth/token

[A] GETTING THE SCIM API ACCESS TOKEN

First step in using SCIM API is getting the access token.

Using any suitable tool (like Postman) POST call needs to be made to the SCIM API Token URL, passing the SCIM API Client Key & Secret. This will return the Access token.

Steps (Postman tool used for this example):

Method: POST
URL: https://<DWS URL>/api/v1/auth/token
In the request Body:
- client_id: < SCIM API Client Key >
- client_secret: < SCIM API Client Secret >
- grant_type: client_credentials
Here is what the API call looks like in Postman-
After making the call by hitting “Send”, access token returned in Response-

[B] USING THE SCIM API TO VIEW, UPDATE OR DELETE USER

User management via SCIM API will require-

Access Token: from section [A] steps
User_UUID: Can be grabbed from the browser URL of any user profile page in Work Zone. The alphanumeric identifier at the end of the URL will be the UUid.
- Example URL: abcdemo.workzonehr.cfapps.us10.hana.ondemand.com/site#workzone-profile?sap-app-origin-hint=&/profile/wall/QljGDtyuvpRDK7epwV0GiU
- QljGDtyuvpRDK7epwV0GiUis the UUid.
SCIM User API URL: https://<DWS URL>/api/v1/scim/Users/<user_uuid>

Using the above User API URL and the User UUid,

GET calls can be made to view user data.
PUT calls can be made to update user data.
DELETE calls can be made to delete any user from Work Zone database.

[B.1] TO VIEW ANY USER RECORD

Method: GET
URL: https://< DWS URL >/api/v1/scim/Users/<user_uuid>
In the request Header,
- Authorization = bearer <access_token>
Here is what the API call looks like in Postman for one example User UUid:
And the Response after hitting “Send”

[B.2] TO UPDATE ANY USER RECORD

Method: PUT
URL: https://< DWS URL >/api/v1/scim/Users/<user_uuid>
In the request Header,
- Authorization = bearer <access_token>
In the request Body, user data request payload in DWS/Jam SCIM format.
Here is what the API call looks like for one example User-
If we submit this API call by hitting “Send”, the user will get updated with the payload data from the request body.

[B.3] TO DELETE ANY USER RECORD

Important: This delete operation is permanent & irreversible.

Method: DELETE
URL: https://< DWS URL >/api/v1/scim/Users/<user_uuid>
In the request Header,
- Authorization = bearer <access_token>
Here is what the API call looks like for one example User UUid:
If we submit this API call by hitting “Send”, the user will get deleted

[C] USING THE SCIM API TO VIEW OR DELETE USER LIST

Access Token: from section [A] steps
list_name: Name of the List
list_id: Has to be retrieved via API call, searching with List Name.
SCIM List API URL: https://< DWS URL >/api/v1/scim/Groups/<list_id>

[C.1] GET THE LIST ID

To search List ID for any List, same steps to be followed as viewing users, [B.1] section above, only changing to API endpoint /Groups:

URL: https://< DWS URL >/api/v1/scim/Groups? filter=displayName eq "<list_name>"

The API response will have the List ID in “id” field

[C.2] VIEW A LIST

To view SCIM data for any List, same steps to be followed as viewing users, [B.1] section above, only changing to API endpoint /Groups:

URL: https://< DWS URL >/api/v1/scim/Groups/< list_id >

[C.3] DELETE A LIST

To delete any List, same steps to be followed as deleting users, [B.3] section above, only changing to API endpoint /Groups:

URL: https://< DWS URL >/api/v1/scim/Groups/< list_id >

What’s New in SAP Build Q4 2025: Release Highlights

2026-01-28T11:57:02.493000+01:00

In Q4, we rolled out AI-powered enhancements for SAP UI5 development, digital experiences, and SAP Mobile Start, along with improved operational control and visibility for automating business processes. Most significantly, the agent builder in Joule Studio is now generally available, empowering developers to build custom Joule agents.

Check out our Top 10 Q4 2025 Release Highlights!

Enhancements and AI-Powered Development

AI-guided development for building agents in Joule Studio.

1. Building custom agents with Joule Studio

Now generally available, the agent builder in Joule Studio lets developers create custom Joule agents using natural language, Model Context Protocol (MCP) enabled integrations, multi-agent orchestration, and existing SAP Build content. With this capability, you can build scalable, production-grade agents designed to deliver real business impact across your enterprise.
Learn more in this blog post.

2. AI-powered capabilities in SAP Build Work Zone

Joule is now integrated across all SAP Build Work Zone editions, helping employees navigate complex workflows within their digital workspace using natural language queries. With context-aware answers, content generation, and proactive insights, Joule helps teams work more productively.
Learn more in this blog post.

3. Enhanced AI support for SAPUI5 development

With the new /ui5-create-app slash command in Joule for SAP Build Code, developers can now generate freestyle UI5 applications. The AI assistant/Joule guides the conversation, producing a ready-to-use, best-practice app as a starting point. This streamlines development, reduces setup effort, and helps teams follow consistent UI5 standards from the very beginning.
Learn more in this blog post.

How the AI-supported freestyle SAPUI5 app generation works. Learn more in this blog post.

4. Define status flows in SAP Cloud Application Programming Model (CAP)

The new status flow feature in CAP lets developers define application workflows with minimal effort using just three CDS annotations. With @flow.status, @from, and @TO, developers can mark status properties and define transitions, while the system automatically generates the necessary handlers and UI annotations. This reduces manual coding, provides a robust framework, and still allows developers complete control to override and customize the generated logic.
Learn more in the guide.

Enhanced Operational Control and Automation

5. Streamline migration to SAP Build Process Automation

With the “No Correlation” feature in Process Visibility, organizations can smoothly transition from SAP Workflow Management to SAP Build Process Automation. This feature enables tracking of legacy and new processes in a single, unified view without data duplication or reporting disruptions, helping organizations modernize their operations while maintaining visibility, accuracy, and performance.
Learn more in this blog post.

6. Expanded functionality for process automation

Template-based notifications: You can now compose template-based notifications using HTML as part of your process logic, enabling teams to design more flexible e-mails that fit complex business scenarios.

Learn more.
Preserve and combine results for Decision Tables: Decision Tables in process automation now support aggregating and preserving outputs from multiple tables. With the new append operation, users can accumulate results across multiple rule evaluations, enabling richer decision outcomes.
Learn more.

When opening an existing decision that uses list-type results, users will see a banner notification indicating that the behaviour has changed.

If the user clicks on “Update Decision Table Behavior”, the user gets to select to continue with the existing behavior or choose the new behavior to append the content to the result.
Enable or disable individual Decision rules: While modeling decisions in process automation, you can now activate or deactivate individual rules based on business requirements. The deactivated rules are skipped during execution but remain accessible, providing greater control of Decision artifacts.

Learn more.
Manage workflow tasks in process automation: Workflow monitoring applications now support assigning tasks to a group, improving flexibility and reducing manual effort. Administrators can search for users or groups, reassign running workflow instances, and receive clear confirmation or error messages, ensuring business continuity.

Learn more.

7. Expanded trigger options for SAP Build Process Automation

SAP Build Process Automation now offers enhanced trigger options that enable scalable automation across SAP and non-SAP systems:

Queue triggers to start a process: These triggers leverage UiPath Queue Management to start SAP Build Process Automation processes automatically, enabling the smooth automation of repetitive tasks. Learn more.
UiPath connector triggers: These event-driven triggers powered by UiPath Integration Service enable automation across non-SAP systems, providing real-time responsiveness to critical business activities with minimal configuration effort. Learn more.

Digital Experience & Mobile Start Innovations

8. Enhanced user experience for mobile and desktop in SAP Build Work Zone, advanced edition

SAP Build Work Zone, advanced edition now provides a coherent and intuitive navigation model across desktop browsers and SAP Mobile Start. Employees can quickly access the apps and business content they need on the go through structured spaces and pages. By organizing content into logical workspaces, essential tools open in seconds, reducing operational friction, minimizing errors, and enabling users to stay productive while moving between tasks.
Learn more in the Help Portal.

9. Updates to SAP Mobile Start

SAP Mobile Start adopts Apple's new Liquid Glass design language released with iOS 26.

SAP Mobile Start continues to elevate the mobile experience for end-users with several new features that improve usability, efficiency, and visual design:

Adoption of Apple’s Liquid Glass design: SAP Mobile Start now incorporates Apple’s new Liquid Glass design language introduced with iOS 16. This provides a more dynamic user experience and increases screen space as the navigation bar collapses when not needed.
Additional To-Do filter option “Group”: End-users can now filter their To-Dos by semantic groups defined in Task Center, making it easier to organize and prioritize tasks.
New compact list view for To-Dos: To-Dos can now be displayed in a more compact list view instead of the traditional cards view, allowing users to see more items at a glance and manage tasks more efficiently.

Learn more in the latest blog post.

10. Expanded content capacity in SAP Build Work Zone sites

SAP Build Work Zone sites can now host thousands of documents and translations without technical limits. This lets administrators build richer site architecture that supports multiple regions and languages while keeping content organized, giving employees faster access to a comprehensive and well-structured digital workplace.

Ready to see these in action?

Custom Domain Service in SAP BTP Build Work Zone (Standard Edition)

2026-02-03T06:12:27.191000+01:00

Hello Everyone,

After analyzing and successfully implementing Custom Domain Service in SAP Build Work Zone, Standard Edition, I’m writing this blog to share my learnings. This post explains the concept of Custom Domain Service in SAP BTP and provides end-to-end steps to configure and use it with SAP Build Work Zone.

This blog will help you get started with SAP Custom Domain Service in SAP BTP Build Work Zone (Standard Edition).

Business Requirement

Our client required the use of a custom (client-specific) domain instead of the SAP standard domain.

By default, when accessing an SAP Build Work Zone site, the URL looks like this:

https://<SubAccount>.launchpad.cfapps.<DataCenter>.hana.ondemand.com/site/<site-alias>#Shell-home

(Here, we are using SAP Build Work Zone – Standard Edition.). We can use it for advanced edition too.

The requirement was to replace this with a client-friendly URL, for example:

https://abc.com  
OR  
https://abcservices.abc.com

We initially tried redirecting traffic from
https://abcservices.abc.com to the SAP BTP Work Zone URL.
However, this approach didn’t meet the requirement because:

Network-level redirection works, but
The browser address bar changes to the SAP BTP URL,
The client URL (https://abcservices.abc.com) is no longer visible.

To solve this, we implemented SAP Custom Domain Service.

Prerequisites

Before starting the configuration, ensure the following prerequisites are met:

1. Enable Custom Domain Service

Add Custom Domain Service to your subaccount with the Standard plan.

Note: Another plan exists but is deprecated at the time of writing this blog.

SAP Help Document:
https://help.sap.com/docs/custom-domain/custom-domain-manager/initial-setup

Below is the screen shot from sub account for reference:

Please note SAP will charge based on how many certificate you have uploaded in the Cusotm Domain Manager irrespective of Number of Custom Domain.

2. Finalize Reserved and Custom Domains

Finalize your reserved domain and custom domains in advance.

Do’s:

Do not rush this step.
Finalize domains separately for Non-Prod (DEV & QA) and Prod subaccounts.
Changing domains later can be complex and time-consuming.

Dont’s:

Do not signed the CSR form Trusted CA authority because it involved cost and time.
If possible dont configure the Non Prod and Prod Custom domain in single custom domain manager because it will mess the things. Try to keep the Custom Domain Service for Production seperately.
Dont configure the Custom Domain Manager for Production untill you get success in the Non Prod environment.

3. Runtime Destination Naming

Ensure the runtime destination names are finalized as per project standards, as these are referenced by applications.

Implementation Steps

Step 1: Define a Default Site

A default site is the site that opens when no site ID is specified in the URL.

Key points:

A default site is configured per custom domain.
It does not affect all domains in the subaccount.
A custom domain can be mapped to only one entry point, which is why it’s mapped to the default site and not to a specific site. Below is the screen shot of the default site:

Step 2: Identify the Reserved Domain

The reserved domain should be the parent domain, for example:

abc.com or abcservices.abc.com

The custom domain is created using the reserved domain, such as:

wz.abcservices.abc.com

Step 3: Define Custom Domains for Applications

Create custom domains for the following applications as needed:

SAP Build Work Zone
On-Premise Backend Systems (S/4HANA, CRM, BW, etc.) – Optional
Identity Authentication Service (IAS) – Optional

IAS works with the SAP standard domain by default. A custom domain for IAS is optional.

IAS Considerations

In our case, we did not configure a custom domain for IAS because:

IAS requires a separate CSR and CA-signed certificate.
This involves additional cost.
Wildcard certificates used in Custom Domain Manager do not work for IAS.

Reference Documents:

Step 4: Configure Custom Domain Manager

Add the reserved domain and custom domains in Custom Domain Manager.

Required Roles:

Assign the following roles to the user (Default or Custom IAS):

Custom Domain Administrator – Manage configurations
Custom Domain Viewer – View configurations

Once roles are assigned, you can access Custom Domain Manager from the subaccount.

Step 5: Create SaaS Routes

Create a SaaS route for each custom domain.
These routes act as redirection endpoints for:

SAP Build Work Zone
Backend systems (if applicable)

Step 6: Create TLS Configuration

Create a TLS configuration for secure communication.

SAP Help Document:
https://help.sap.com/docs/custom-domain/custom-domain-manager/manage-tls-configurations

Step 7: Generate CSR (Certificate Signing Request)

Generate a CSR from Custom Domain Manager and get it signed by a trusted Certificate Authority (CA).

CSR Generation Options

Option A: Individual Certificates
Generate one CSR per domain, for example:

s4.abcservices.abc.com
crm.abcservices.abc.com
bw.abcservices.abc.com

Option B: Wildcard Certificate
Generate a wildcard CSR:

CN: *.abcservices.abc.com  
SAN: *.abcservices.abc.com, abcservices.abc.com

Certificate Signing Guidelines

Internal network → Internal CA is acceptable and all the applicaiton will work.
Public access → Internal CA will cause browser warnings as below and navigation to the backend
Use a trusted CA like DigiCert if you want to access the custom domain publically.

Important Notes:

Verify CN and SAN before submitting CSR.
Certificates are valid only for the Custom Domain Manager instance from which the CSR was generated.
Non-Prod certificates cannot be reused in Prod.
We have generated the Wild Card Certificate for Production and Single Certificate (Included all SAN) for Non Prod System. Below is the Certificate Screen shot:

DigiCert Reference:
https://docs.digicert.com/en/certcentral/manage-certificates/reissue-an-ssl-tls-certificate.html

(Optional) IAS CSR Generation

Wildcard certificates do not work for IAS.
A separate CSR and certificate are required.

We skipped IAS custom domain due to additional cost and renewal overhead.

Step 8: Upload and Activate Certificate

Once signed, upload the certificate to Custom Domain Manager.

The certificate package includes:

Actual certificate
Intermediate certificate
Root certificate

Certificate Chain Format

Actual Certificate  
+ Intermediate Certificate  
+ Root Certificate

Tips:

Combine the full chain in a text file.
Remove extra spaces or blank lines.
Activate the certificate after upload.

Once activated:

Certificate expiry days are visible.
Renewal can be planned proactively.

Final Result

After successful activation, SAP Build Work Zone is accessible using the custom domain:

https://wz.abccompany.company.com

Errors that can occur: After all the configuration, If you stuck in the IAS authentication while accessing the work zone and getting the below error then add the custom domain in the IAS application:

Add you custom domain in the following path in the IAS if not came automatically:

Login to IAS -> Applications & Resources -> Applications -> Select the Application of Build Work Zone -> Single Sign On -> OpenID Connet Configuraiton and then in the Redirect URIs andPost Logout Redirect URIs section add the URl as https://*.abcservices.abc.ae/** (Your custom domain so that IAS will trust this domain)

Conclusion

I hope this blog helps you understand the Custom Domain Service concept and implement it successfully in SAP Build Work Zone projects.

Happy learning and implementing! 🚀

Regards,
Rohit Gera