SAP Community - SAP Build Work Zone, standard edition

How AI is Transforming Your Digital Workspace

2025-11-06T18:00:00.064000+01:00

How AI is Transforming Your Digital Workspace

Introduction

The modern workplace has changed dramatically. Employees no longer rely solely on static intranets or scattered collaboration tools. Instead, they expect a connected, personalized experience that helps them cut through the noise and focus on meaningful work. Enter artificial intelligence (AI).

AI isn’t just another layer of technology- it’s rapidly becoming the backbone of digital workspaces. By surfacing the right information at the right time, automating repetitive tasks, and enabling smarter collaboration and self-service, AI is redefining how we work, learn, and engage every day.

With digital workspaces in SAP Build, these AI capabilities are already available today—helping organizations deliver intelligent, personalized employee experiences out of the box

The Rise of AI in the Digital Workspace

For years, digital workspaces have been a central hub for business applications, documents, apps, and communications in one place. Useful—but often overwhelming. Employees spent as much time searching for information as they did, acting on it.

Now, AI is filling the gaps. With intelligent copilots, content curation, and contextual answers, digital workspaces like SAP Build Work Zone have evolved from being a destination for information into an engine for productivity and engagement.

Core AI features available today in SAP Build digital workspaces

1. Chatbots & Virtual Assistants
With Joule, SAP’s AI copilot, workspace users can access information instantly. From answering HR questions to surfacing insights from reports, employees can rely on conversational AI to get what they need instantaneously.

Joule, SAP's AI copilot integrated into the digital workspace

2. Task completion with Joule Skills

One can enhance Joule capabilities by creating skills for it in Joule Studio. Connected with SAP systems and third-party applications, Joule can complete tasks like submitting time-off requests, approving workflows, or surfacing KPI dashboards—all from a single interface

3. Document Grounding Capabilities
Joule ensures information is both contextual and reliable when using workspace content to ground AI responses. For example, employees can ask “What’s our travel policy in Europe?” and receive an AI response sourced directly from workspace content or SAP SuccessFactors policies when it is enabled as an AI source.

4. Content generation and summarization using generative AI
SAP Build leverages generative AI to help users create and refine content—whether drafting announcements, summarizing updates, or suggesting language for a blog post—directly within the workspace.

Real-Life Examples in Action

Information access with grounded responses

Joule responds with answers grounded in the specific workspace content. Employees can query Joule with specific questions like “What is the holiday plan for next year in Germany" or “how can I apply for a sabbatical leave? Point me to the relevant file”.

Smart document summaries

Integrated AI services capture the highlights of a workspace document—policy highlights, key insights from data, or high-level overview of a blog.

Workflow Automation

From within SAP Build workspace, an employee can ask Joule to “create a purchase order” or “show current pipeline metrics.” The copilot triggers the workflow in connected SAP systems, making productivity seamless.

Intelligent content curation

Users can easily create blog posts, feed posts or even knowledge articles in the workspace using the native AI features with simple prompts like “create a workspace feed reminding members to fill their timesheet in a funny and casual tone”.

The Business Impact

Faster Information Access: Joule makes information searches 95% faster by surfacing insights and data instantly. Grounded insights reduce time spent searching for answers.
Reduced Manual Effort: Generative AI-assisted summarization and content creation free up employee time.
Better Governance: AI responses in SAP are backed by enterprise content, ensuring compliance and accuracy.

Preparing for the AI-Powered Workspace

Adopting AI in digital workspaces is not just about flipping a switch—it’s about preparing your organization:

Change Management: Train employees to adopt AI workflows and copilots in their daily work.
Governance: Define guardrails for AI-generated content, data privacy, and security.
Integration: Maximize value by connecting SAP Build with existing SAP and non-SAP applications, making copilots more powerful.

Conclusion

AI is no longer a future trend; it’s already embedded in the digital workspaces employees use today. With embedded AI and Joule, organizations don’t just imagine an intelligent workspace—they experience it

By weaving AI into daily workflows—whether through copilots, recommended learning, or curated content—SAP Build helps organizations unlock productivity, agility, and engagement at scale.

Ready to take the next step?

Learn more about these capabilities and their implementation from the following resources:

Access FLP of S/4HANA Rise in SAP Build Work Zone, Standard Edition

2025-11-07T08:13:07.239000+01:00

Hi Folks,

Writing this blog after long analysis. I hope this will help community to fix the issue.

Requirement: Access the Fiori Launchpad of SAP S/4HANA Rise (Private Cloud) in SAP Build Work Zone, Standard Edition.

Analysis: In the Build Work Zone, standard edition site we need to add a new Role which should open the FLP of the S/4HANA system which is Private Cloud. SSO should work between Work Zone and Fiori Launchpad of S/4HANA System.

Implementation: Below are the implementation steps in work zone:

1. Add the S/4HANA system in the Cloud Connector with https port

2. Configure the SSO using Principal Propagation so that it wont ask the credentials.

3. Set up the Custom IAS and SSO for Work Zone applicaiton.

4. Create a app, page, space, role in work zone and assing the role to user. PFA the app configuration which will use to connect Fiori Launchpad of S/4HANA system. (App configuration for FLP in Work Zone.jpg)

Error: Once all the configuration in placed, we will access the FLP in the work zone and below error will come. PFA the error screenshot (Error when accessing FLP in Work Zone.jpg😞

Error

App could not be opened either due to an incorrect SAP Fiori launchpad configuration or a missing role assignment.

Solution: After lot of analysis not found any blog for this solution and finally found the solution by uncheck the property in the work zone app "Add intent and default SAP parameters to URL" and save. PFA the screen shot for same ()

After saving, access the FLP again and it open the Fiori Launchpad of S/4HANA On Premise. PFA the working scenario (FLP of S4HANA working in Work Zone.jpg)

Please let me know your feedback if someone is able to fix the issue or having any other issue while configuriing the same.

Regards,

Rohit Gera

SAP Work Zone vs. Analytics Cloud vs. Fiori Launchpad – Unified Analytics Comparison (Decision Tree)

2025-11-10T01:03:45.137000+01:00

In today's data driven world, enterprises need an intuitive and efficient digital workspace that unites business processes, analytics, and collaboration. SAP offers several powerful solutions like SAP Work Zone, SAP Analytics Cloud (SAC), and SAP Fiori Launchpad, while many organizations also extend their ecosystems with non-SAP BI tools such as Microsoft Power BI and Tableau. Selecting the right entry point depends on factors like data architecture, user experience, and the level of integration needed between SAP and non-SAP systems.

With more than 15 years of experience across SAP Analytics and Business Intelligence implementations, I have witnessed how organizations evolve their analytics strategies from siloed reporting to fully integrated decision environments. Through these diverse engagements, it is clear that tools like SAP Work Zone, SAC, Fiori Launchpad, and external BI platforms can coexist to deliver a unified, connected, and scalable analytics landscape. When combined with modern data platforms like Snowflake or SAP Datasphere / SAP Business Data Cloud(BDC), they empower enterprises to turn information into real-time insight.

Let's explore how each of these tools fits within a unified analytics ecosystem and how organizations can determine the right combination to maximize business value.

The Contenders: A Quick Overview

SAP Fiori Launchpad: The gateway to SAP applications, offering a role based, personalized user experience.
SAP Analytics Cloud (SAC): SAP's flagship analytics platform, combining BI, planning, and predictive capabilities in one solution.
SAP Work Zone: A digital workplace that integrates SAP and non-SAP applications, fostering collaboration and productivity.
Non-SAP BI Tools (Power BI, Tableau): Industry leading analytics platforms known for flexibility and advanced visualization.

SAP Fiori Launchpad: The Trusted Entry Point

SAP Fiori Launchpad has been a cornerstone of SAP's user experience strategy. It is the go to interface for accessing SAP S/4HANA FICO and other SAP applications.

Strengths:

Role based access to transactional applications and operational data.
Seamless integration with SAP systems.
Consistent, intuitive user experience.

Limitations:

Limited to SAP applications, no native support for non-SAP tools.
Lacks advanced analytics and collaboration features.

Best For: Organizations that primarily use SAP systems and need a streamlined interface for transactional workflows.

SAP Analytics Cloud (SAC): The All-in-One Analytics Powerhouse

SAP Analytics Cloud is SAP's answer to modern analytics needs. It combines BI, planning, and predictive analytics in a single cloud based platform.

Strengths:

Unified platform for reporting, dashboards and predictive analytics.
Deep integration with SAP source systems like SAP S/4HANA .
Built-in collaboration features for team based planning.

Limitations:

Limited flexibility for non-SAP data sources compared to tools like Power BI or Tableau.
Steeper learning curve for non-SAP users.

Best For: Organizations heavily invested in SAP systems that want a single platform for analytics and planning.

SAP Work Zone: The Digital Workplace Revolution

SAP Work Zone is a relatively new addition to the SAP ecosystem, designed to create a unified digital workplace. It integrates SAP and non-SAP applications, making it a versatile tool for modern enterprises.

Strengths:

Unified access to SAP and non-SAP applications.
Built-in collaboration tools like chat, news feeds, and document sharing.
Customizable workspaces for teams and projects.

Limitations:

May be overkill for organizations that only need analytics or transactional access.
Requires additional configuration for seamless integration with non-SAP tools.

Best For: Organizations looking to enhance collaboration and provide a single point of access for SAP and non-SAP tools.

SAP Work Zone, together with the SAP Analytics Cloud Catalog, now carries forward and enhances the capabilities of the earlier SAP Analytics Hub. While Analytics Hub focused primarily on report cataloging, Work Zone extends that vision into a full digital workplace integrating analytics, applications, and collaboration in a single experience.

Non-SAP BI Tools: Power BI and Tableau

While SAP tools excel in their native ecosystem, non-SAP BI tools like Microsoft Power BI and Tableau offer unmatched flexibility and visualization capabilities.

Strengths:

Superior data visualization and user friendly interfaces.
Extensive connectivity to non-SAP data sources like Snowflake, AWS, and Google BigQuery.
Strong community support and third party integrations.

Limitations:

Limited native integration with SAP systems.
May require additional middleware for seamless data flow.

Best For: Organizations with diverse data sources that prioritize visualization and flexibility over deep SAP integration.

The Hybrid Approach: SAC for SAP, Power BI for Non-SAP

Across several SAP Analytics implementations, a hybrid approach has consistently proven effective for unifying enterprise reporting.
SAP Analytics Cloud (SAC) is typically used for SAP source systems, leveraging its deep integration with SAP S/4HANA, along with robust planning capabilities.
Microsoft Power BI complements this by connecting to non-SAP systems such as Snowflake, offering flexibility, advanced visualization and ease of consumption for broader business audiences.

This approach allows us to:

Maintain a single source of truth for SAP data within SAC.
Leverage Power BI's advanced visualization capabilities for non-SAP data.
Use Snowflake as the central data warehouse to integrate data across the organization.

Which Tool Should Be the First Point of Enterprise Access?

The answer depends on your organization's priorities:

If SAP integration is key: Start with SAP Fiori Launchpad or SAP Work Zone, depending on whether you need transactional access or a collaborative digital workplace.
If analytics is the focus: Use SAP Analytics Cloud for SAP data and Power BI or Tableau for non-SAP data.
If collaboration and integration are critical: SAP Work Zone is the clear winner, providing a unified interface for SAP and non-SAP tools.

Visualizing the Decision: A Comparison Chart & Decision Tree

To make this easier, here’s a quick comparison chart:

Feature	SAP Fiori Launchpad	SAP Analytics Cloud	SAP Work Zone	Power BI/Tableau
SAP Integration	Excellent	Excellent	Excellent	Limited
Non-SAP Integration	None	Limited	Excellent	Excellent
Analytics Capabilities	Basic	Advanced	Basic	Advanced
Collaboration Features	None	Moderate	Advanced	Limited
Best For	SAP Transactions	SAP Analytics	Unified Workplace	Non-SAP Analytics

Figure: Decision Tree among the available Tools

Final Thoughts

In today's complex analytics environment, there is no single solution that fits every organization. Success lies in aligning technology choices with business objectives, data strategy, and user needs. The most forward-thinking enterprises design flexible analytics ecosystems, balancing governance, agility, and usability to ensure analytics becomes an enabler, not a barrier.

Based on experience across multiple SAP programs, hybrid architectures often offer the strongest foundation. SAP Analytics Cloud (SAC) provides deep integration and governance for SAP data, while platforms like Power BI or Tableau enhance visualization and flexibility for non-SAP data sources. Combined with centralized data hubs like Snowflake or SAP Datasphere or SAP Business Data Cloud (BDC), this model ensures consistency, scalability, and end-to-end insight.

As SAP continues to innovate, solutions such as SAP Work Zone and the SAC Catalog are transforming how users access, share, and collaborate on analytics content. They bridge the gap between SAP and non-SAP systems, creating a truly unified workspace for both business and IT teams.

Ultimately, the goal is not to choose a single tool but to build an integrated analytics ecosystem, one that empowers users at every level to make data driven decisions confidently. Whether an organization adopts a purely SAP centric approach or a hybrid model, the future of analytics lies in seamless connectivity, collaboration and intelligent decision making.

Applying User Filters in SAP Identity Provisioning Service to Sync a Single User from MS Entra ID

2025-11-21T12:43:48.558000+01:00

Hi Folks,

I’m writing this blog after going through extensive SAP documentation and community articles. The purpose of this post is to explain how to apply a user filter in the SAP Identity Provisioning Service (IPS) so that only a single user gets synchronized from Microsoft Entra ID.

🔧Requirement

We want to sync only one specific user from Microsoft Entra ID into the target system using IPS by applying a user-level filter on the source system.

📌Prerequisites

Before starting, you should have:

A Source System of type Microsoft Entra ID (or any other user-store source system)
A Target System of type Identity Authentication
(You can choose a different target system depending on your requirement)

These systems must be configured in your SAP BTP Cloud Identity Services.

🔍Analysis

When we first executed the job in Simulation Mode, we found that our Entra ID environment contained 5000+ users. Running a full sync would have immediately written all these users into the target system—which we wanted to avoid until we were confident.

To prevent syncing the entire user base, we decided to use the user filter property in the source system configuration.

This led us to applying a filter that would sync only one specific user, allowing us to validate the job behavior safely.

✅Solution

Below is the property you need to configure in the Source System to sync only a single user from Entra ID (or any similar source system):

Property Name

aad.user.filter

Property Value

userPrincipalName eq 'rgera@company.ae'

This filter ensures that only the user with the specified User Principal Name is retrieved and synchronized.

Refer to the screenshot in your Cloud Identity Service configuration for guidance.

🧪 Result

After saving the property and running the job again, only one user was successfully synchronized from Microsoft Entra ID—exactly as expected.

📘Additional Notes

IPS supports many different filter conditions. You can adapt filters based on:

givenName
mail
displayName
objectId
Group conditions
And more…

These filters help you fine-tune user synchronization based on your business needs.

🤝Conclusion

I hope this blog helps anyone looking to apply user-level filters when running synchronization jobs in SAP Identity Provisioning Service. It’s a simple yet powerful way to limit and control the data flowing between systems—especially in large environments.

Regards,
Rohit Gera

Building Pro-Code Extensions for SAP Mobile Start leveraging mobile native functionalities

2025-11-27T15:04:08.058000+01:00

We just concluded this year's SAP TechEd with two very insightful in-person events – SAP TechEd 2025 in Berlin (Nov 4–5) and SAP TechEd on Tour Bangalore (Nov 25–26). As depicted in the announcement blog post of my colleague Thilo Berndt, the mobile topics were again very well covered in various sessions and activities. As part of which, we were conducting a Hands-on Workshop both in Berlin and Bangalore called "CA260 – Learn how to build your own app and use it in SAP Mobile Start", which we would like to recap in this blog post and highlight the most interesting technical aspects.

Overview

SAP Mobile Start is the native entry point to the SAP Business Suite, to all relevant business processes, data, and content. It provides access to native or web-responsive business apps along with other content and critical business information. This includes notifications and consolidated views on tasks, approval workflows, and SAP S/4HANA situations. SAP Mobile Start provides business information from SAP Start, SAP Build Work Zone, standard edition, and SAP Build Work Zone, advanced edition. Non SAP content can be integrated as well. It runs on iOS, iPadOS and Android devices, on watchOS and Wear OS devices, and on Apple Vision

While one significant aspect of SAP Mobile Start is to provide access to SAP’s role-specific standard content, such as business applications and tiles exposed from SAP S/4HANA via SAP Build Work Zone, this year’s SAP TechEd Hands-On Workshop CA260 centered on the ease of building pro-code extensions using SAP Build and specifically SAP Build Code with the SAP Cloud Application Programming Model (CAP). Participants were able to experience the necessary steps in building and deploying such a pro-code extension, as well as how to specifically utilize mobile native capabilities within that extension, such as Widgets (e.g. on the iOS Home and Lockscreen) and (Push) Notifications.

The session material and exercises are available on Github within the repository SAP-samples/teched2025-CA260. We do highly recommend checking out the exercises and trying them out on your own development system environment. This blog post will provide a brief overview of the most important steps and technical activities.

Please note that the session material on Github as well as some screenshots and code snippets in this blog post will contain usages of "###" as a placeholder for the participant number that was assigned in the hands-on workshop. Participants were instructed to replace these occurrences with their own participant number.

Building and Deploying the base version of the extension

The exercises started by building and deploying an initial version of the extension that the workshop is using as an example. As the initial version provided to participants, we are using a slightly modified version of the "Incidents Management" CAP sample application. The provided full-stack application and its dependencies are defined in the Multitarget Application descriptor (mta.yaml) which is being built and packaged into an mta archive (.mtar) during the build operation, which eventually gets deployed to the SAP Business Technology Platform (BTP), specifically SAP BTP Cloud Foundry environment. While the workshop is making use of SAP Build Code and its productivity tooling for developing full-stack applications with CAP, building the MTA project and deploying the build artifact to the SAP BTP, you can as well use your IDE of choice such as Visual Studio Code.

Screenshot: Overview of the project structure

With the deployment, the CAP application (in terms of the server logic) is running an application container on the Cloud Foundry Runtime. The UI of our full-stack application is realized using SAP Fiori Elements, which is generating the User Interface based on standard floorpans and UI annotations as part of the service definitions using CDS. The Fiori frontend application lives within the HTML5 Repository of the SAP BTP. While this would already be sufficient to expose our extension to SAP Build Work Zone and SAP Mobile Start as an application tile and run the frontend within the shell of SAP Build Work Zone using its managed Approuter, we want to have more control over the visual representation.

Frontend deployed to the HTML5 Repository; backend application deployed to Cloud Foundry

We can achieve this greater control by leveraging SAP Build Work Zone's content definition format – the Common Data Model (CDM). The definition of which is documented here and represents a standardized data structure for defining business apps, their visual representation, the required roles, and the logical hierarchical structure in which business apps shall be organized using a concept called "Spaces & Pages". Such CDM structure can be supplied to the HTML5 Repository during deployment of our extension. In the workshop's repository, this definition resides in the /workzone/cdm.json file.

Integrating the app into SAP Build Work Zone & SAP Mobile Start

For integrating our extension into SAP Build Work Zone, which makes it automatically available to SAP Mobile Start, we leverage a relatively new feature of the SAP Build Work Zone Channel Manager – defining a HTML5 Business Solution. While we could also create a regular Content Provider, using the new Content Channel type "HTML5 Business Solution" further simplifies the process as we are not required to manage any design-time destination. The HTML5 repository is merging all deployed HTML5 applications and their CDM definition from a common "Business Solution", making it available for selection as a joint Content Channel by the "Business Solution" dropdown.

Creation of a HTML5 Business Solution Content Channel in SAP Build Work Zone

This value used for merging multiple HTML5 application belonging to the same business solution is done via a dedicated property ("service" under "sap.cloud") in the web applications manifest.json. If you want to read more about HTML5 Content Consumption capabilities of SAP Build Work Zone, we can recommend this excellent blog post from our colleague Rupam who is part of the SAP Build Work Zone team.

{
  "_version": "1.65.0",
  "sap.app": {
    "id": "com.sap.ca260.###",
    "type": "application",
    [...]
  },
  [...]
  "sap.cloud": {
    "public": true,
    "service": "ca260###"
  }
}

After adding the Content Channel's role to our Site and making sure we have the role assigned to our desired users, we can see it exposed in SAP Build Work Zone using the browser as well as in SAP Mobile Start – Nice! As defined in the /workzone/cdm.json file, the application tile of our built extension is placed onto a Page with the title "Apps from Participant CA260-000", which itself is available under a Space named "Extensions from CA260".

Deployed application visible in SAP Build Work Zone and SAP Mobile Start

Extending the app to make use of Widgets on your mobile device

The steps to extend now our application in order for it to be configurable as a Widget, for example on the iOS Homescreen or the Lockscreen, are actually much easier than you might think. SAP Mobile Start offers multiple types of Widgets. The one we will be using here is the "Business Info Widget", which can be configured to display any KPI that is available to SAP Mobile Start. In technical terms this means that we need to enhance the application tile of our extension to become a "Dynamic App Launcher". In the simplest case, these are tiles showing a number coming from a connected data service. In more complex scenarios, these can also display criticalities, trend and more information around the selected KPI.

The process to transform our basic tile into a Dynamic App Launcher is fairly simple. Within our web application's manifest.json file, we can add the required definition to make it such a dynamic tile and connect it to our OData service for incidents available in our CAP application. For our example, let's point to the OData count of incidents and filter for incidents that are not in status closed using the status_code property. The needed configuration resides within the inbound definition under the node "indicatorDataSource". In order to make this change visible on our environment, the updated version needs to be deployed and the Content Channel needs to be synced.

Transforming the application tile into a DynamicAppLauncher

As a result, our application now appears a KPI tile on our Site and in SAP Mobile Start and we can monitor the automatically updated value both inside of SAP Mobile Start – for example when accessing the Page or by adding the app into my favorites on the Start tab of SAP Mobile Start. This fact allows us to configure the same Dynamic App Launcher tile as a Widget, for instance to our iPhone's Homescreen.

Pro tip: Why not mirroring your iOS Widget of open incidents to your Mac or configure the same on your Apple Watch as a watch face complication?

The Dynamic App Launcher tile appearing in SAP Build Work Zone and SAP Mobile Start

Implementing our own (push) notifications

Let's now go one step further and implement our own notifications from our CAP application. The beauty of the integration via SAP Build Work Zone and SAP's notification framework leveraging the SAP Alert Notification Service on BTP is, that such notifications will automatically appear on our SAP Build Work Zone Site in the browser, in SAP Mobile Start under the notification bell as well as be delivered as a mobile native push notification to the mobile devices on which you use SAP Mobile Start. That's a game changer for informing your users about a time critical situation directly from your pro-code extensions.

For CAP based extensions, we can make use of the @cap-js/notifications plugin. The plugin communicates with the necessary APIs using a Destination that needs to be created in the SAP BTP Subaccount in which the application will run. By default it expects the name for the Destination to be SAP_Notifications if not configured differently. The values for this Destination can be retrieved from the Settings of SAP Build Work Zone (Administrator role required).

For sending actual notification from our CAP service, we need to define our desired NotificationTypes first in the /srv/notification-types.json. These defined types represent the blueprint for the actual notifications to be sent. They include the texts for the actual notifications in all the languages that shall be supported with dedicated placeholders which will be filled when the notification is actually triggered in the service logic. Below you can see an example for such a type:

{
    "NotificationTypeKey": "IncidentCreated",
    "NotificationTypeVersion": "1",
    "Templates": [
      {
        "Language": "en",
        "TemplatePublic": "New Incident created",
        "TemplateSensitive": "New incident created by {{customer}}",
        "TemplateGrouped": "Incident Status Update",
        "TemplateLanguage": "mustache",
        "Subtitle": "{{description}}"
      },
      {
        "Language": "de",
        "TemplatePublic": "Neuer Vorfall eingegangen",
        "TemplateSensitive": "Neuer Vorfall von {{customer}}",
        "TemplateGrouped": "Vorfall Status Änderungen",
        "TemplateLanguage": "mustache",
        "Subtitle": "{{description}}"
      }
    ]
  }

Sending actual notification is fairly easy and can be done with very few lines of code. We first need to initialize the notifications plugin with cds.connect.to('notifications'), which creates a handle with which we can send notifications later. Sending notifications can be done with the function alert.notify. Here, we reference the desired NotificationType (defined before), recipients and further properties and data related to this specific notification we intend to send.

Coding used to send notification when incidents are created and closed.

As a result, we receive a push notification at the event of incident creation and closure. Already in the push notification displayed by the mobile operating system, we see the defined texts from our NotificationType with the specific values filled for the specific incident object. When tapping on this push notification, SAP Mobile Start shows the full notification in the dedicated area of the mobile app. Using "Open in Browser" brings us to this specific incident in our SAP Fiori Elements application where we could take further action. This is achieved by supplying the Intent Based Navigation (IBN) information of our app – consisting of the Semantic Object and Action defined in our web application's manifest. This allows SAP Mobile Start and SAP Build Work Zone to open the right application as a navigation target from the exposed content – in our case, the SAP Fiori Elements application running the HTML5 Repository and exposed to SAP Build Work Zone using the HTML5 Business Solution Content Channel. The deep link to the specific incident object is achieved by supplying a special navigation target parameter that SAP Fiori Elements supports for opening the desired "Inner App Route" – in our example, the Object Page of a specific incident using its ID. Feel free to check out how this was done for this specific example in the repositories' code.

The notification details visible in SAP Mobile Start and the deep-link navigation to the SAP Fiori Elements application

Outlook

We hope we were able to show, how easy it is to create pro-code extensions, deploy them to the SAP BTP, integrate them into SAP Build Work Zone & SAP Mobile Start. The demonstrated examples of mobile native widgets and push notifications hopefully showed the ease of leveraging the mobile native device capabilities. Beyond the content of the CA260 Hands-On Workshop of SAP TechEd 2025, we would like to give you an outlook to what else would be possible with this basis.

The beauty of using the HTML5 Business Solution Content Channel Exposure in SAP Build Work Zone is that we have the flexibility and feature set of the Common Data Model (CDM) available. We could further extend the /workzone/cdm.json file to make use of even richer visualization capabilities – for example by defining a declarative UI Integration Card. Such cards allow to achieve UI richt micro-experiences right on the Page's structure, for example displaying a short list of incidents with the most important information to get a brief overview as a processor. In the browser when consuming the page via SAP Build Work Zone, the card is rendered as a regular SAP UI5 UI Integration Card. In SAP Mobile Start, declarative cards are supported as mobile native UI elements. With a single declarative definition of such a card using the UI Integration Card framework, we can achieve native cross-platform support with a high quality user experience directly within SAP Mobile Start.

Having a UI Integration Card added to the Page in SAP Build Work Zone and SAP Mobile Start

For further information on SAP Mobile Start related features and topics, please check our SAP Mobile Start documentation. Visit SAP Mobile Experience Community Page and click “follow” to get the latest development and innovation of our solutions. We look forward to hearing about your experience with these hands-on exercises; please do share your thoughts and comments below.

SAP CAP Lessons Learned: Reject error message missing on HTML5 Repository app?

2025-11-28T15:41:23.691000+01:00

Good day fellow CAPpers,

Today I'll share one of the lessons I've learned working with CAP, something that may not be clear in the current tutorials or documentation. When running locally, or even in BTP on a Cloud Foundry-based front end, whenever you reject a request, you would expect that the message appears to the user:

The top bold message is in the front end SAPUI5 app, and the bottom, the description, comes from CAP, in the req.reject call:

try {
  const con = await cds.connect.to('SERVICE_SRV');
  let entry;
  // ...
  const result = await con.run(
    INSERT.into(EntitySet).entries(entry)
   );
} catch (err) {
   req.reject(500, err.message);
}

This executes as expected on CAP, both locally and on BTP. However, in the front end, the message is only displayed locally, not on BTP if the app is deployed on the HTML5 Application Repository:

This gave me a big headache, especially because a few weeks earlier it was displaying fine, whereas now the message is lost and replaced for "Internal Server Error".

I even debugged remotely the CAP app running on BTP to double check, and the error message was correctly set there, on the req.reject statement.

Finally, I resorted and opened a case (ticket, incident) for SAP. After providing the required test code, they gave me a solution: replace the 500 code for 400.

I chose 500 because out of the HTTP response status codes, 500 is for server errors. Since the error message I wanted to display was on the server side, I opted for 500. But apparently, you should always stick to 400 (client error) to make it work.

SAP failed to provide me an explanation to this behavior of the HTML5 Application Repository, and its behavior is like of a black box, where we can't see what's happening inside.

TLDR

Therefore, whenever you want to reject a request in CAP AND send the error message to the user with the details of the error AND you have deployed your app in the HTML5 Repo, use HTTP code 400.

May this post help you on your troubleshooting. Reply if you find any issues so I, and the community, can help.

Lucas Magrini Rigo

User Provisioning with Microsoft Entra ID (AD) in Cloud Identity Service

2025-12-10T07:50:10.594000+01:00

(A Complete Step-by-Step Guide)**

Hi Folks,

After extensive analysis and hands-on troubleshooting with user provisioning in SAP Cloud Identity Services, I decided to document the entire process. My goal is to help others quickly and smoothly integrate Microsoft Entra ID (formerly Azure Active Directory) with SAP Cloud Identity Services.

If you are planning to onboard corporate users into SAP’s Identity Authentication Service (IAS) using Identity Provisioning Service (IPS), this guide will save you hours of effort.

Requirement

Sync all corporate users from Microsoft Entra ID into SAP Cloud Identity Services (CIS).
These users already exist in Entra ID and need to be replicated to IAS.
Avoid manual user creation in IAS.
By configuring IPS, we can schedule daily jobs to automatically sync new or updated users.
Use the synced users in SAP BTP applications
(especially those using CIS for authentication) to assign roles, groups, and access for our SAP Build Work Zone.

Analysis

After diving deep into SAP Help documentation and performing several tests, I consolidated the exact approach that fulfills the requirement. The complete activity consists of five main steps.

Five-Step Integration Process

Step 1: Perform App Registration in Microsoft Entra ID

This activity is typically handled by the Azure team.
Refer to SAP Help documentation for detailed instructions:
Microsoft Entra ID Integration
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/microsoft-entra-id

Once App Registration is complete, the Azure team will share the following information:

Application ID
Directory Tenant ID
Object ID
Client Secret Value
Client Secret ID
aad.domain.name

These parameters will be used in the Source System configuration of Identity Provisioning Service (IPS).

Step 2: Configure Microsoft Entra ID as a Source System in IPS

Follow the SAP Help documentation:
Microsoft Entra ID – Source System Configuration
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/microsoft-entra-id

Below is the Screen Shot which shows the Source System:

Below is an example of mandatory source system properties:

Property Name Value

aad.domain.name	`<CompanyName>.onmicrosoft.com`
aad.group.attributes	id,displayName,mailNickname
aad.user.attributes	id,mail,userPrincipalName,displayName,mailNickname,givenName,surname,mobilePhone,businessPhones
Authentication	BasicAuthentication
ips.trace.failed.entity.content	false
oauth.resource.name	https://graph.microsoft.com
OAuth2TokenServiceURL	https://login.microsoftonline.com/<Company Name>.onmicrosoft.com/oauth2/token
Password	Client Secret Value
ProxyType	Internet
Type	HTTP
URL	https://graph.microsoft.com
User	Application ID

Below the screenshot for same:

Step 3: Configure Identity Authentication (IAS) as the Target System

SAP Help documentation for IAS as a target:
Identity Authentication – Target System Configuration
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/target-identity-authentication

Important:
Select the correct Source System for this Target System.
Otherwise, IAS will attempt to read data from all existing source systems in IPS.

Below is the Screen shot of Target System for referece:

Mandatory IAS target system properties:

Property Name Value

Authentication	ClientCertificateAuthentication
ias.api.version	2
ias.user.unique.attribute	userName
ips.failed.request.retry.attempts	2
ips.failed.request.retry.attempts.interval	60
ips.trace.failed.entity.content	false
ProxyType	Internet
Type	HTTP
URL	https://`<CIS Domain Name>`.accounts.ondemand.com/

Step 4: Run the “Simulate Job”

Before performing the actual sync, run the Simulate Job from the Source System.

Below is the screen shot to run the Simulate Job:

This job allows you to check:

How many users will be read
What changes will be made
Any potential errors or mismatches

You can view results under Provisioning Logs in IPS.

Step 5: Run the “Read Job” (Actual User Sync)

This is the real provisioning job.

IPS reads users from Microsoft Entra ID
Then writes them into Identity Authentication Service (IAS)

Check Provisioning Logs for status, errors, or successful user creation.

Below is the screen shot for reference:

Optional: Schedule Recurring Provisioning Jobs

You can set up a scheduled job (daily, weekly, etc.) to automatically sync delta changes from Microsoft Entra ID into IAS.

This ensures user data stays consistently updated without manual intervention.

Summary

This guide provides all essential steps required to integrate Microsoft Entra ID with SAP Cloud Identity Services using Identity Provisioning Service (IPS). I hope it helps you streamline user onboarding and avoid manual user creation in IAS.

If you have any questions or face any issues, feel free to ask.

Regards,
Rohit Gera

Ready, Set, Go! Jump-start complex Collaboration Scenarios with Start Forms

2025-12-10T10:24:29.553000+01:00

Manually creating Collaborations in SAP Integrated Product Development (IPD) often requires several steps: creating the Collaboration itself, adding Reference Objects and Participants, starting Workflows, and more. Public APIs let you automate these steps. By invoking those APIs from a Process in SAP Build Process Automation - triggered by a Start Form - you can deliver an app-like experience to users inside SAP Build Work Zone.

This post shows how to provide dedicated Start Form apps for common IPD Collaboration scenarios. The main steps are:

Configure the Collaboration Type.
Design the Process and Start Form.
Add the Start Form to SAP Build Work Zone.

Configure the Collaboration Type

Create a Collaboration Type that maps to your business needs. Define a Status Profile, add Reference Objects, and attach Workflows. Using APIs to create Collaborations imposes no extra requirements.

Configure Collaboration

Design the Process and Start Form

Make sure that you have imported all required Actions for SAP Integrated Product Development Collaboration from SAP Business Accelerator Hub. Create a new Process in SAP Build Process Automation and design a Form as Trigger for the Process.

Start Form Designer

Add the Actions you need based on the Collaboration properties you want to set. In our example:

Create a new Collaboration.
Add a Participant.
Add a Reference Object.
Optionally start a Workflow (based on a user choice).

There are no tasks that require user interaction in this example. Of course, you can use all features provided by SAP Build Process Automation.

Process Design

Add Start Form to SAP Build Work Zone

Create a local copy of the Process Trigger App and provide the Launchpad Configuration Parameters of your deployed Process. Add this to your site and apply the required authorizations. The form will become visible as separate tile.

Start Form in SAP Build Work Zone

When users click the tile, the Start Form appears.

Start Form

After they complete required fields and submit, the Process invokes the APIs to create the Collaboration, add the Reference Object and Participant, and start the Workflow if requested. The collaboration is ready within seconds and contains all necessary data for users to begin work.

Ready to use Collaboration

Summary

Start Forms are an efficient way to expose frequently used Collaboration setups to end users. By leveraging custom Processes, you can enrich user input with external data, add validations, and improve data quality and the overall experience - enabling smoother, faster collaboration.

Tribute to Thomas Volmering

2025-12-23T11:06:24.578000+01:00

📢 Today is @thomas_volmering's last day at SAP.

Thomas joined SAP 26 years ago, and I met him when he was head of Product Management for SAP Build Process Automation, before he became Head of Product for SAP Build. Together we worked on many communication projects for SAP Build, including technical blog posts that you can read here. 📰

Let me just say that it has been a great pleasure and also some fun working with him, and I thank Thomas a lot for that. 🙏🏻

Please join me in wishing Thomas the very best for what's to come! 👍🏻

Push UUID from IAS to S4HANA - Tasks list on BTP task Center is empty for S4HANA

2026-01-01T05:41:20.344000+01:00

Introduction:

After completing all prerequisites and following the SAP documentation to configure the Task Center for an SAP S/4HANA system, it is quite common to encounter a situation where no tasks are displayed in the Task Center—even though task creation appears to be working correctly in the backend.

This blog addresses one of the most frequently overlooked root causes behind this issue: the absence of a Global User ID (UUID) in the SAP S/4HANA system. Even when the Task Center is correctly configured on SAP BTP and tasks are visible in the pull cache, missing UUID mapping can prevent the Task Center from resolving the processor correctly, resulting in an empty Task Center UI.

In this blog, I will walk you through a critical but often missed step required to ensure tasks are displayed correctly in the Task Center. The focus is on establishing a one-way synchronization from SAP Identity Authentication Service (IAS) to SAP S/4HANA to push the UUIDs for existing users, without performing a full user provisioning or re-synchronization.

Solution:

Even after configuring the Task Center on HANA on-premise and completing all required steps on BTP, the Task Center may appear empty, as shown in the screenshot below.

When you check the Task Center pull cache, you can see that the task exists; however, it is still not displayed in the Task Center app. As shown in the screenshot below, the task appears with the processor name set to the SAP user ID. This situation occurs when a GUID (UUID) is not available in the SAP HANA system. In such cases, the system falls back to using the SAP user ID instead of the UUID. As a result, the Task Center is unable to correctly resolve the processor, and the task is not displayed in the Task Center app.

To resolve this issue, we need to ensure that a UUID is available in the SAP system. The steps to achieve this are explained below. Before updating the UUID in the SAP HANA system, the user profile in the SU01 screen appears as shown in the screenshot below.
SU01-->Goto-->External User ID(UID)

Please note that in this scenario, we are not synchronizing SAP users to IAS and then syncing the UUID back to the HANA system. Since the UUIDs and users already exist in IAS as a result of the SuccessFactors integration, we will establish a one-way synchronization from IAS to SAP S/4HANA solely to push the UUID into the system

To push the UUID (Global User ID) to SAP system please follow below steps.

Prerequisite:
1. Login to your Cloud Connector: Make sure your Cloud connectors connection from BTP to HANA has access to below BAPI/FM

PRGN_ROLE_GETLIST
BAPI_USER_GETLIST
BAPI_USER_GET_DETAIL
BAPI_USER_CREATE1
BAPI_USER_ACTGROUPS_ASSIGN
IDENTITY_MODIFY
BAPI_USER_DELETE
PRGN_ACTIVITY_GROUPS_LOAD_RFC

2. Create a technical user in SAP HANA, or reuse an existing technical user that is used to pull tasks for the Task Center. Ensure that this user is assigned the required role listed below. This technical user will be used to create the RFC destination in the BTP subaccount, which will later be used to create the target system in IAS

SAP_BC_JSF_COMMUNICATION

3. Create a RFC destination on the BTP account where your IAS is hosted by referring to below SAP guide.
https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/create-rfc-destinations

Note: If you prefer to create the RFC destination in a different subaccount - perhaps within the same sub account as SAP Work Zone or the Task Center- ensure that you create an Identity Access Management (IAM) service instance in that subaccount. This is required so that the RFC destination you create is visible in the IAS administration console.

After completing the prerequisites, log in to IAS and create the source and destination systems to perform the push.

Creating Source system: Because the users are already available in IAS, select Local Identity Directory as the source system.
Creating the Source system is straightforward.

{
    "user": {
        "mappings": [
            {
                "sourcePath": "$.id",
                "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:User']['userId']",
                "targetVariable": "entityIdSourceSystem"
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
            },
            {
                "sourcePath": "$.schemas",
                "targetPath": "$.schemas",
                "preserveArrayWithSingleElement": true
            },
            {
                "sourcePath": "$.userName",
                "targetPath": "$.userName",
                "optional": true,
                "correlationAttribute": true
            },
            {
                "sourcePath": "$.displayName",
                "targetPath": "$.displayName",
                "optional": true
            },
            {
                "sourcePath": "$.groups",
                "targetPath": "$.groups",
                "optional": true,
                "preserveArrayWithSingleElement": true
            },
            {
                "sourcePath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:User']",
                "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:User']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystem']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystem']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystemId']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['sourceSystemId']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userId']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userId']",
                "optional": true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:enterprise:2.0:User']['employeeNumber']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:enterprise:2.0:User']['employeeNumber']",
                "optional": true
            }
        ]
    },
    "group": {
        "ignore": true,
        "mappings": [
            {
                "sourcePath": "$.id",
                "targetVariable": "entityIdSourceSystem",
                "correlationAttribute": true
            },
            {
                "sourcePath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']",
                "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']"
            },
            {
                "sourcePath": "$.displayName",
                "targetPath": "$.displayName"
            },
            {
                "sourcePath": "$.members",
                "targetPath": "$.members",
                "optional": true,
                "preserveArrayWithSingleElement": true
            }
        ]
    }
}

Create Target system: Here our target is SAP HANA. below refer below screenshots and code snippet to create the same. here the target system type is SAP Application Server ABAP. and please select the destination which you created in prerequisite step 3.
Make sure you skip operations for delete and create as we trying to do update only and you can also update the alias(email), groups roles to S4HANA along with UUID but here i am only focusing on UUID.

{
    "user": {
        "skipOperations": [
            "create",
            "delete"
        ],
        "mappings": [
            {
                "sourceVariable": "entityIdTargetSystem",
                "targetPath": "$.USERNAME"
            },
            {
                "sourcePath": "$.userName",
                "targetPath": "$.USERNAME"
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
                "targetPath": "$.SAPUSER_UUID.SAP_UID"
            },
            {
                "constant": "updateEntity",
                "targetVariable": "operationTypeVariable"
            },
            {
                "constant": "createEntity",
                "targetVariable": "operationTypeVariable",
                "scope": "createEntity"
            },
            {
                "condition": "$.active == false && '${operationTypeVariable}' == 'createEntity'",
                "constant": "X",
                "targetPath": "$.LOCK_LOCALLY"
            },
            {
                "condition": "'${operationTypeVariable}' == 'updateEntity'",
                "constant": "U",
                "targetPath": "$.LOCK"
            },
            {
                "condition": "$.active == false && '${operationTypeVariable}' == 'updateEntity'",
                "constant": "L",
                "targetPath": "$.LOCK"
            }
        ]
    }
}

Once the source and target systems are created, open the source system and perform a test run for a single user to ensure that everything is working correctly. After successful validation, you can remove the user filter and perform a mass update for all users in the system.

Once the update is completed you will be able to see UUID in SU01 user profile as below.

Also, The Task Center pull cache will have UUID for the processor field instead of the SAP user name and Tasks will be shown in the Task center as below.

Conclusion:

An empty Task Center—despite correct backend task creation and successful pull cache entries—can be misleading and time-consuming to troubleshoot. As demonstrated in this blog, the root cause is often the absence of a UUID in the SAP S/4HANA user master, which prevents the Task Center from resolving the task processor correctly.

By ensuring that the Global User ID (UUID) is pushed from IAS to SAP S/4HANA through a one-way synchronization, this issue can be resolved effectively without impacting existing user provisioning or SuccessFactors integrations. Once the UUID is updated in the SU01 user profile, the Task Center pull cache correctly reflects the UUID, and tasks become visible in the Task Center application as expected.

I hope this blog helps you avoid common pitfalls during Task Center setup and saves valuable troubleshooting time. Feel free to share your feedback or experiences, and happy learning!

Thanks and Regards,
Navyashree

Customize SAP Build Workzone Side Menu Icons by use of a Shell Plugin

2026-01-01T05:44:25.513000+01:00

Introduction

SAP Build Work Zone serves as a central entry point for business users with personalized, role-based access to SAP and third-party applications. With customers wanting to customize its look and feel, adding custom buttons and custom visual representation of navigation items, this blog posts aims at showing how to achieve this customization by the use of Shell Plugins.

1. What you will learn in this blogpost

You will learn how to spin up a workzone subscription, and customize the workzone shell by use of a shell plugin. This will help you to customize the layout, add action buttons and also change icons on the side menu of the workzone.

2. What Shell Plugins do

With the standard configuration, the outer shell of the workzone is limited and customers want to extend the functionality, adding buttons to the shell or even changing its look and feel. This can be achieved by the use of a Shell Plugin.

3. First steps

To follow this blog post you need to complete the following prerequisites:

Have a SAP BTP subaccount or a SAP BTP Trial Account
Have a SAP Build Workzone Standard Edition Subscription (this is important as the advanced edition does not yet allow to display the menu on the side)
Configure your site with the following attributes (important is to set the menu option to "side" - this option only appears if the view mode is set to "Spaces and Pages"

Have a SAP Business Application Studio subscription or VSCode installed with the CF CLI, MBT tools
Know how to create subscriptions
Know to assign role collections to your user
Have a Space, a Page and an App set up in the workzone and assigned to the role "Everyone"

4. Shortcut with Terraform and Github

I have created a GitHub repo (https://github.com/cnbscorp/btp-workzone-shell-plugin.git) which helps you to spin up the resources in your trial account and deploy the Shell Plugin via CF CLI. If you are familiar with terraform or even have an own terraform repo managing you BTP, this can save you some click-ops activity in the BTP Cockpit. I will provide a detailed walk-through on how to use terraform in BTP in a separate post, the main focus of this blog post is to customize the workzone shell.

5. Setup on SAP BTP

All the instructions on how to deploy this module is stated in the README file on GitHub, please be careful with deploying via terraform if you are not familiar with it.
For developers deploying to an already configured subaccount, be careful not to override existing configuration.

6. Setup on SAP BAS / VSCode

1. Make use of the Fiori Application Wizard (BAS has this extension already installed)

Create Project from Temlate: Basic
Data Source: None
View Name: ShellPlugin
Target: Cloud Foundry

2. Navigate to the manifest.json file in the webapp/ folder

Enrich the file with the with the following configuration

    "crossNavigation": {
      "inbounds": {
        "Shell-plugin": {
          "semanticObject": "Shell",
          "action": "plugin",
          "title": "{{Shell-plugin.flpTitle}}",
          "hideLauncher": true,
          "icon": "sap-icon://pushpin-on",
          "signature": {
            "parameters": {},
            "additionalParameters": "allowed"
          }
        }
      }
    }

and

  "sap.flp": {
    "type": "plugin"
  }

3. Customize the component.js file in thewebapp/ folder.

init() {
            UIComponent.prototype.init.apply(this, arguments);
            this.setModel(models.createDeviceModel(), "device");
            this.getRouter().initialize();

            this._getRenderer().then((oRenderer) => {
                oRenderer.addHeaderEndItem({
                    icon: "sap-icon://add",
                    tooltip: "Add bookmark",
                    press: () => {
                        const oDialog = new Dialog({
                            title: "What's new",
                            content: new Text({ text: "Hello from shell plugin!" }),
                            beginButton: new Button({
                                text: "OK",
                                press: () => oDialog.close()
                            }),
                            afterClose: () => oDialog.destroy()
                        });
                        oDialog.open();
                    }
                }, true, false);
                this._updateNavIcons();
            });
        },

        _getRenderer() {
            var oRenderer = sap.ushell.Container.getRenderer("fiori2");
            return (oRenderer && typeof oRenderer.then === "function") ? oRenderer : Promise.resolve(oRenderer);
        },

        _getNavList() {
            try {
                const oNavList = sap.ui.getCore().byId("__list0"); // your NavigationList ID
                if (!oNavList) {
                    console.warn("NavigationList control not found");
                    return null;
                }
                return oNavList.getItems ? oNavList.getItems() : [];
            } catch (err) {
                console.error("Error retrieving NavigationList items", err);
                return null;
            }
        },

        _updateNavIcons() {
            const aItems = this._getNavList();
            if (!aItems) return;

            const _updateItem = (oItem) => {

                const sText = oItem.getText();
                switch (sText) {
                    case "Cool Space":
                        oItem.setIcon("sap-icon://customer-and-contacts"); break;
                    default:
                        oItem.setIcon("sap-icon://document"); break;
                }

                console.log(`Updated icon for "${sText}" to "${oItem.getIcon()}"`);

                if (oItem.getItems && oItem.getItems().length > 0) {
                    oItem.getItems().forEach(_updateItem);
                }
            };

            aItems.forEach(_updateItem);
        }

Also add the following to your sap.ui.define function:

sap.ui.define([
    "sap/ui/core/UIComponent",
    "mrt/shellplugin/model/models",
    "sap/m/Dialog",
    "sap/m/Button",
    "sap/m/Text"
], (UIComponent, models, Dialog, Button, Text) =>

7. Deploy the Shell Plugin

Right click on the mta.yaml file
Click on Build MTA Project
Expand the mta_archives folder and right click on the mtar file, click Deploy MTA file
Signin to Cloud Foundry and deploy the application

8. Verify Deployment on BTP

In the cockpit you should now see the instances created

9. Setup of the Shell Plugin in SAP Build Workzone

The inital configuration of the Shell only displays the standard navigation Icon on the space. Our goal is to change this icon for a better visual representation of the navigation items. This helps the end user to distinguish between different customer created spaces, especially if the menu is collapsed.
This is our goal:
- Inital navigation tree:

Then
- After the Plugin:

to achieve this,

Navigate to the Content Manager in the workzone
Go to the Content Channel and refresh the content of the HTML5 Apps
Click on the content explorer button
You will now see your shell plugin, select it and click on add

Navigate back to the Content Manager and Overview, navigate to the Role * Everyone" and assign the shell Plugin to the role in the "Apps" section, this will make the plugin available for everyone accessing the workzone

Navigate to the Site Directory and launch the Home Website
The icon has changed in the DOM-Tree to the icon specified in the component.js

Pressing on the custom button in the top bar will reveal the Dialog box specified in the newly created event handler of the Shell Plugin

10. Final thoughts and improvements

You have learned how to customize the shell of your SAP Build Workzone. When you change icons in the navigation tree, you can use the switch statement on the navigation item's name, but a better way would be to use the index property itself. This way the DOM manipulation in the frontend remain stable and unaffected by language translations.

Accessing a Build Work Zone Application Directly (Without Header)

2026-01-06T13:39:08.829000+01:00

Hi Folks,

Recently, I received the following requirement:

Requirement

The customer wants to access a single application in SAP Build Work Zone, Standard Edition directly, without navigating through the Work Zone home page.

Key expectations:

Users should be able to access a specific Work Zone application directly.
The Work Zone application may point to any backend application, such as:
- Web Dynpro ABAP (WDA)
- SAP UI5 / Fiori app
- BW reports
- Third-party applications
Users should only see the content of the backend application.
The Work Zone header should not be visible.
Typical use case:
- A user receives an email notification (for example, for an approval).
- Clicking Approve or Reject redirects the user directly to the relevant application.

Analysis

After analyzing the requirement, I identified two main parts:

Hide or remove the Work Zone header
Access the application directly using a semantic object and action

Solution

1. Hide the Work Zone Header

To hide the header area of the Work Zone, append the following URL parameter at the end of the URL:

sap-ushell-config=headerless

2. Access the Application Directly

To launch the application directly, append the semantic object and action to the URL:

##<semantic-object>-<action>

The semantic object and action can be obtained from the application configuration in Build Work Zone.

Final URL Example

https://<subaccount>.launchpad.cfapps.<region>.hana.ondemand.com/site/workzone-std-qa?sap-ushell-config=headerless#<semantic-object>-<action>

Result

With this configuration:

The Work Zone header is hidden.
Users are taken directly to the target backend application.
The experience is seamless and ideal for approval or notification-based use cases.

Below is the scren shot for reference:

I hope this helps others who are looking to access Work Zone applications directly without exposing the home page or header.

Please feel free to comment and share your thoughts.

Regards,
Rohit Gera

Simplifying UI5 Library Use on BTP by Bundling Libraries at Build Time

2026-01-10T23:27:11.400000+01:00

Background: Reusing UI5 Libraries on SAP BTP

When using a custom UI5 library on SAP BTP, the most common approach is to deploy the library source first and then consume it from other applications.

Based on previous blogs and samples, there are two established approaches, which can be broadly categorized into an older and a newer approach.

Approaches Without CDM (older approach)

Shared Destination Instance: In this approach, the library and the consuming applications share the same destination service instance (blog 1).
Separate Destination Instances per Application: Each application uses its own destination service instance, and the consuming application explicitly defines destinations for the library (HTML5 app repo host and UAA) (blog 2).

Approaches with CDM (newer approach)

Library as Content Provider: When using CDM, the library defines a content provider destination and a cdm.json file containing skeleton definitions for catalogs, groups, and roles. The consuming application depends on the library's HTML5 app repo host (blog 3).

Benefits and Limitations of Deploying Libraries Independently

Deploying the library source as an independent artifact has a clear advantage: when the library changes, it needs to be fixed or updated in only one place.

However, this approach makes the deployment of consuming applications more complex. The application's mta.yaml requires additional, library-specific configuration. This complexity is manageable when only a single shared library is used, but it increases significantly when multiple independent libraries are involved.

Using CDM can reduce this complexity. However, CDM is primarily intended for defining the layout and content structure in SAP Build Work Zone from the application side, and in my opinion, it is more suitable for SaaS-oriented solutions. Therefore, it does not fit well with workflows where application developers implement the apps, while a separate authorization or platform team designs and manages the Work Zone contents.

An Alternative Approach: Bundling the Library at Build Time

In this blog, a different approach is introduced: bundling the library source directly into the consuming application at build time and deploying them together. The main advantages of this approach are simpler application configuration and the removal of dependencies on resources defined by the library, such as destinations or HTML5 app host service instances.

The main drawback is that when the library changes, each consuming application must be redeployed individually. On the other hand, this also has a positive side effect: incompatible changes in the library can be introduced without impacting existing applications that rely on older versions.

Developing and Deploying Applications with a Bundled UI5 Library

The following sections describe how to develop an application by bundling a UI5 library directly into the consuming application.

Prerequisites

SAP Fiori tools is installed in Visual Studio Code.

Steps Overview

Create the UI5 library
Create an application that consumes the library
Configure the project for deployment
Build and Deploy

1. Create the UI5 library

Open the Command Pallete and select "Fiori: Open Reusable Library Generator".

Fill the project details as shown below.

Clean Up the Generated Library

Under the /src/<namespace>/<libraryname> folder, remove all sample content except for the following files:

.library
library.ts
messagebundle.properties

After the cleanup, the folder structure should look like the image below.

Replace the Example Controller Logic

The generated library.ts file contains example controller logic that is not required for this scenario. Replace its content with the implementation provided in the following GitHub repository:

https://github.com/miyasuta/fiori-use-library-blog/blob/main/com.myorg.reuselib/src/com/myorg/reuselib/library.ts

This sample library provides a dialog with controller logic attached.

The complete implementation can be found here:

https://github.com/miyasuta/fiori-use-library-blog/tree/main/com.myorg.reuselib/src/com/myorg/reuselib

Since the project uses TypeScript, make sure to build the library after applying the changes:

npm run build

2. Create an Application That Consumes the Library

Next, create a UI5 application that consumes the library.

Generate the application

Open the Application Generator and select the "Basic" template (other templates such as List Report can also be used).

Enter the project details. Select both "Add Deployment Configuration" and "Add SAP Fiori Launchpad Configuration".

For the deployment configuration:

Select Cloud Foundry as the target
Select "Add Application to Managed Application Router", since the app will run on SAP Build Work Zone

Configure the SAP Fiori Launchpad settings as shown below.

Add a Reference to the Library

Now that both the library and the consuming application exist, connect them.

Open the Command Pallete and select "Fiori: Add Reference to SAP Fiori Reusable Libraries".

Select the project folder path (consumerapp) and the library.

This action adds entries to manifest.json, ui5.yaml, and ui5-local.yaml.

manifest.json

  "sap.ui5": {
    "flexEnabled": true,
    "dependencies": {
      "minUI5Version": "1.143.2",
      "libs": {
        "sap.m": {},
        "sap.ui.core": {},
        "com.myorg.reuselib": {
          "lazy": false
        }
      }
    },

ui5.yaml / ui5-local.yaml

By default, the src path does not point to dist. Because the library is implemented in TypeScript, it is adjusted to reference the compiled output in the dist folder.

    - name: fiori-tools-servestatic
      beforeMiddleware: fiori-tools-proxy
      configuration:
        paths:
          - path: /resources/com/myorg/reuselib
            # src: ../com.myorg.reuselib/src/com/myorg/reuselib
            src: ../com.myorg.reuselib/dist/resources/com/myorg/reuselib
            fallthrough: false

To ensure that TypeScript recognizes the library's type definitions, add the following to tsconfig.json:

  "include": [
    "./webapp/**/*",
    "../com.myorg.reuselib/dist/index.d.ts"
  ]

Use the Library in the Application

Now the library can be used in the application locally.

In this example, a button is placed on the UI. When pressed, it opens a dialog defined in the library. After the user presses OK, a callback is triggered, allowing the consuming application to execute its own logic.

View

<mvc:View controllerName="miyasuta.consumerapp.controller.View1"
    xmlns:mvc="sap.ui.core.mvc"
    xmlns="sap.m">
    <Page id="page" title="{i18n>title}">
        <Button id="pressMeButton" text="Press Me" press="onOpenDialog" />
    </Page>
</mvc:View>

Controller

import Controller from "sap/ui/core/mvc/Controller";
import MyDialogHanlder, { MyDialogHandler$SubmitEvent } from "com/myorg/reuselib/controller/MyDialogHandler";
import MessageToast from "sap/m/MessageToast";

/**
 *  miyasuta.consumerapp.controller
 */
export default class View1 extends Controller {

    /*eslint-disable @typescript-eslint/no-empty-function*/
    public onInit(): void {

    }

    public onOpenDialog(): void {
        const dialogHandler = new MyDialogHanlder();
        dialogHandler.attachSubmit((event: MyDialogHandler$SubmitEvent) => {
            const message = event.getParameter("message");
            MessageToast.show(`Dialog submitted with message: ${message}`);
        });
        dialogHandler.open();

    }
}

3. Configure the Project for Deployment

This section describes the key configuration required to bundle the library source into the consuming application at build time.

3.1 Library Project Configuration

ui5.yaml

Update metadata.name to include the full namespace:

metadata:
  # name: "reuselib"
  name: com.myorg.reuselib

Add a resources section to the builder configuration to exclude test resources from the build:

builder:
  resources:
    excludes:
      - "/test-resources/**"

The complete builder section will look like this:

3.2 Application Project Configuration

package.json

Add the library as a dependency and specify the version in the library's package.json.

  "dependencies": {
    "com.myorg.reuselib": "^1.0.0"
  },

ui5-deploy.yaml

Configure the builder to include the library dependency during the build:

builder:
  settings:
    includeDependency:
      - com.myorg.reuselib

Add includeDependencies to the ui5-task-zipper configuration so that the library resources are included in the final ZIP archive:

    - name: ui5-task-zipper
      afterTask: generateCachebusterInfo
      configuration:
        ...
        includeDependencies:
          - com.myorg.reuselib
        ...

The complete builder section will look like this:

xs-app.json

Add the following route to ensure that library resources are served from the application instead of the UI5 CDN.

    {
      "source": "^/resources/com/myorg/reuselib/(.*)$",
      "target": "/resources/com/myorg/reuselib/$1",
      "service": "html5-apps-repo-rt",
      "authenticationType": "xsuaa"
    },

manifest.json

Add resourceRoots so that the library can be resolved when launched from SAP Build Work Zone:

  "sap.ui5": {
    "flexEnabled": true,
    "resourceRoots": {
      "com.myorg.reuselib": "./resources/com/myorg/reuselib"
    }

index.html

Add the library to data-sap-ui-resource-roots so that it can be resolved when running from the HTML5 Application Repository:

        data-sap-ui-resource-roots='{
            "miyasuta.consumerapp": "./",
            "com.myorg.reuselib": "./resources/com/myorg/reuselib"
        }'

4. Build and Deploy

Run the following command in the consuming application project:

npm run build:mta

Verify that the library resources are included under the dist/resources folder.

Deploy the application to Cloud Foundry:

npm run deploy

Finally, verify that the application can be launched successfully from both the HTML5 Application Repository and SAP Build Work Zone.

Conclusion

Reusing UI5 libraries on SAP BTP offers multiple established patterns, but these often introduce additional deployment complexity for consuming applications.

This blog presented an alternative approach: bundling the UI5 library source into the consuming application at build time. While this approach requires changes across several configuration files, all adjustments remain application-scoped, reducing cross-project dependencies and overall complexity.

This approach is not intended to replace existing patterns, but to provide a pragmatic option for scenarios where applications are developed and deployed independently.

Access SAP S/4HANA Transaction Codes in SAP BTP Build Work Zone

2026-01-26T07:33:28.587000+01:00

Hello Everybody,

Writing this blog to explain how we can access the SAP Transaction Codes of S/4HANA On Premise (SAP Rise) from SAP BTP Build Work Zone. SAP S/4HANA Rise system is a private cloud example, we can use public cloud also.

Here we are using SAP BTP Build Work Zone, Standard Edition. You can also use SAP Build Work Zone, advanced edition also.

Prerequisites: Below are the prerequisites before we start:

-> Within the global account, you should subscribed to SAP Build Work Zone, standard edtion Service and Configured the Cloud Identity Service. The Work Zone will use Identity Authentication Service (IAS) to authenticate the Business Users.

-> In the Cloud Connector, configure the backend s/4hana system with https port for secure tunneled access and exchange the certifiate for Principal Propagation (The user of PP should be same in IAS and S4)

-> Destination should be there in the Sub account and choose the Principal Propagation as authentication.

Configuration: There are 2 ways to configure the application, Page, spaces etc. in the build work zone:

1. Content Federation from S/4HANA system: In this we need to create the artifacts (Space, Pages, app etc.) in the S4 system and federate the content by making the content channel.

2. Local Artifcats in the Work Zone: Create Local Apps, Pages, spaces, groups etc. as required in the build work zone, standard edition.

We will be using the 2nd option as we are going to create local content in the work zone. Below are the configuration steps:

Step 1: Create App in the work zone

Access the Build Work Zone from the Sub account and got to Content Manager

Create a local app in the work zone, choose System (Destination) and form App UI Technology choose the SAP GUI for HTML

in this case, I have choosen the below transaction code, here we can put any transaction code as required

Step 2: Create page and assign app to page

Create a page and assign the appto page as below:

Step 3: Create Space and assign page to Space

Step 4: Create Role and assign app, space to role

Step 5: Assign role to the site so it will be visible in site

Step 6: Assign role to user in Sub Account

Please note, Role created in the Work Zone will be shown as Role Collection in the Sub Account. So go to sub account and choose Role Collection and assign user to it.

Result: After Configuration all the above steps, when user will access the Work Zone then they can able to access the SAP S/4HANA transaction code as below:

I Hope this blog will help people to configure the SAP Transaction Code in Build Work Zone quickly without any issue.

Regards,

Rohit Gera

Resolving Nested WDA Application Navigation Issues in SAP Build Work Zone

2026-01-27T06:12:28.628000+01:00

Hello Everyone,

We are currently migrating our Enterprise Portal to SAP BTP – Build Work Zone (Standard Edition). During this migration, we encountered a few challenges. One of the key issues—and its resolution—is described in this blog to help others facing a similar situation.

Please note we created Local Artifact in the Work Zone and connected the S/4HANA system through Cloud Connector Tunnled access.

Issue Description

We have several ESS Web Dynpro ABAP (WDA) applications running on the S/4HANA system that need to be accessed through SAP Build Work Zone.

After completing all the required configurations, we encountered an error while accessing nested WDA applications through Work Zone.

What do we mean by “Nested WDA”?

For example, we have a Working Time application exposed in Work Zone. When users access it, they see sub-applications such as:

Create Leave Request
Leave Overview
View Time Account Balances

When attempting to open any of these sub-applications, the following error occurs:

Configuration Overview

Build Work Zone Application Configuration

Run Destination Configuration

Note: As mentioned earlier the content is not federated so Design Time destination not required in this case.

Additional Property of Destinaiton

Despite correct configuration on the Work Zone side, the issue persisted.

Analysis

After extensive analysis, we identified a relevant SAP Knowledge Base Article that describes the same issue:

SAP KBA 3385676
“Getting Failed to resolve navigation target Shell-startWDA error in Work Zone”

This KBA pointed us in the right direction.

Resolution

As per the KBA, the fix needs to be applied on the S/4HANA side only.
No changes are required in SAP BTP Build Work Zone.

Steps to Resolve the Issue

Open transaction SM30
Enter the view name:
```
/UI2/NWBC_CFGCV
```
Add the following parameter:
- Parameter Name: MAP_LEGACY_TO_IBN
- Value: (leave it empty — this disables the setting)

Before the Change

The view is empty, as shown below:

After the Change

The parameter is added with an empty value:

Save the changes.

Result

After maintaining this parameter, the nested WDA applications were successfully accessible through SAP Build Work Zone without any navigation errors.

As per the above screen shot, the application is accessible. There is no HR data maintian for my id so the message is coming.

Conclusion

If you are facing navigation issues with nested WDA applications while migrating to SAP Build Work Zone, disabling IBN navigation for inner WDA navigation on the S/4HANA side can resolve the issue.

I hope this blog helps others save time during their migration journey.

Regards,
Rohit Gera

New Shell Bar in SAP Build Work Zone - What Admins Need to Know

2026-02-02T19:44:57.930000+01:00

--- LATEST UPDATE: We’ve decided to delay the dates for when the updated shell will become the default for all sites, giving customers more time to review their custom plugins and automations. The blog post has been updated with the revised timeline based on current planning. ---

Hello, SAP Build Work Zone enthusiasts! 🌟

We’re excited to share some important updates that may have gone unnoticed during the holiday season, particularly regarding UX consistency-related (UXC) changes designed to enhance your SAP Build Work Zone experience.

Since the December 10, 2025 release, there is a new improved shellbar available with SAP Build Work Zone, standard edition, which will eventually become the default for all Work Zone sites. This updated shellbar delivers a more consistent user experience and an enhanced user menu. Additionally it simplifies logo customization in your site’s shell bar without requiring an entirely new theme, thanks to the new Shell Bar customization options! For more details, please check 🔗 SAP KBA 3673380 .

What’s New?

1. Toggle the New Shell Bar Experience

Admins can now choose whether to enable the updated Shell header component on a per-site basis. Here’s how it works:

OFF (Default for existing sites until mid May 2026): Your site will continue rendering as before.
ON (Default for new sites and after mid May 2026): Your site will adopt the new UXC changes, giving you a fresh, modern look!

2. Customize Your Site Header

When UXC changes are turned ON, you can further personalize your site with:

Custom Label: Set a unique name for your site header.
Custom Logo & Alt Text: Add a link to your own logo for a branded experience.

3. Future-Proof Your Work Zone

By mid of May 2026: All sites will render with UXC changes by default (but you can still turn them off).
By mid of September 2026: The toggle will be removed, and all sites will adopt the new UX design.

This ensures alignment with SAP’s latest UX standards while giving you time to prepare.

What to Watch For

If you enable the new Shell Bar, some automation scripts, custom plugins, or SAP Companion hotspots may need adjustments. Here’s what to do:

✅ Update automation scripts interacting with the DOM.

✅ Reconfigure custom SAP Companion hotspots if selectors have changed.

✅ Test custom plugins to ensure they work with the new Shell Bar.

For detailed guidance on how to resolve possible issues, check out: 🔗 SAP Note 3627739.

Call to Action: Try Out the New Shell Bar Today!

We encourage all customers to turn on the new Shell Bar in a test environment and explore the enhancements. By checking these changes upfront and applying the new settings to all your sites, you can ensure a seamless transition without any disruptions to your productive sites. Ideally, we recommend turning on the new setting for productive sites before the default behavior changes.

Your feedback is invaluable to us. If you encounter any issues or have suggestions, please share your experience or get in touch with us via the comments section.

🚀 Try it now:

Go to Site Settings → Site Branding.
Toggle "Apply New Shell Bar" to ON.
If you want, you can customize your logo and label.
Test your scripts, plugins, and workflows.

Site Branding area in the site settings. Also notice the information bar informing about the new option.

Let us know how it goes. We’d love to hear your thoughts!

Stay tuned for more updates, and happy customizing! 🎉

— The SAP Build Work Zone Admin Environment Team

Custom Domain Service in SAP BTP Build Work Zone (Standard Edition)

2026-02-03T06:12:27.191000+01:00

Hello Everyone,

After analyzing and successfully implementing Custom Domain Service in SAP Build Work Zone, Standard Edition, I’m writing this blog to share my learnings. This post explains the concept of Custom Domain Service in SAP BTP and provides end-to-end steps to configure and use it with SAP Build Work Zone.

This blog will help you get started with SAP Custom Domain Service in SAP BTP Build Work Zone (Standard Edition).

Business Requirement

Our client required the use of a custom (client-specific) domain instead of the SAP standard domain.

By default, when accessing an SAP Build Work Zone site, the URL looks like this:

https://<SubAccount>.launchpad.cfapps.<DataCenter>.hana.ondemand.com/site/<site-alias>#Shell-home

(Here, we are using SAP Build Work Zone – Standard Edition.). We can use it for advanced edition too.

The requirement was to replace this with a client-friendly URL, for example:

https://abc.com  
OR  
https://abcservices.abc.com

We initially tried redirecting traffic from
https://abcservices.abc.com to the SAP BTP Work Zone URL.
However, this approach didn’t meet the requirement because:

Network-level redirection works, but
The browser address bar changes to the SAP BTP URL,
The client URL (https://abcservices.abc.com) is no longer visible.

To solve this, we implemented SAP Custom Domain Service.

Prerequisites

Before starting the configuration, ensure the following prerequisites are met:

1. Enable Custom Domain Service

Add Custom Domain Service to your subaccount with the Standard plan.

Note: Another plan exists but is deprecated at the time of writing this blog.

SAP Help Document:
https://help.sap.com/docs/custom-domain/custom-domain-manager/initial-setup

Below is the screen shot from sub account for reference:

Please note SAP will charge based on how many certificate you have uploaded in the Cusotm Domain Manager irrespective of Number of Custom Domain.

2. Finalize Reserved and Custom Domains

Finalize your reserved domain and custom domains in advance.

Do’s:

Do not rush this step.
Finalize domains separately for Non-Prod (DEV & QA) and Prod subaccounts.
Changing domains later can be complex and time-consuming.

Dont’s:

Do not signed the CSR form Trusted CA authority because it involved cost and time.
If possible dont configure the Non Prod and Prod Custom domain in single custom domain manager because it will mess the things. Try to keep the Custom Domain Service for Production seperately.
Dont configure the Custom Domain Manager for Production untill you get success in the Non Prod environment.

3. Runtime Destination Naming

Ensure the runtime destination names are finalized as per project standards, as these are referenced by applications.

Implementation Steps

Step 1: Define a Default Site

A default site is the site that opens when no site ID is specified in the URL.

Key points:

A default site is configured per custom domain.
It does not affect all domains in the subaccount.
A custom domain can be mapped to only one entry point, which is why it’s mapped to the default site and not to a specific site. Below is the screen shot of the default site:

Step 2: Identify the Reserved Domain

The reserved domain should be the parent domain, for example:

abc.com or abcservices.abc.com

The custom domain is created using the reserved domain, such as:

wz.abcservices.abc.com

Step 3: Define Custom Domains for Applications

Create custom domains for the following applications as needed:

SAP Build Work Zone
On-Premise Backend Systems (S/4HANA, CRM, BW, etc.) – Optional
Identity Authentication Service (IAS) – Optional

IAS works with the SAP standard domain by default. A custom domain for IAS is optional.

IAS Considerations

In our case, we did not configure a custom domain for IAS because:

IAS requires a separate CSR and CA-signed certificate.
This involves additional cost.
Wildcard certificates used in Custom Domain Manager do not work for IAS.

Reference Documents:

Step 4: Configure Custom Domain Manager

Add the reserved domain and custom domains in Custom Domain Manager.

Required Roles:

Assign the following roles to the user (Default or Custom IAS):

Custom Domain Administrator – Manage configurations
Custom Domain Viewer – View configurations

Once roles are assigned, you can access Custom Domain Manager from the subaccount.

Step 5: Create SaaS Routes

Create a SaaS route for each custom domain.
These routes act as redirection endpoints for:

SAP Build Work Zone
Backend systems (if applicable)

Step 6: Create TLS Configuration

Create a TLS configuration for secure communication.

SAP Help Document:
https://help.sap.com/docs/custom-domain/custom-domain-manager/manage-tls-configurations

Step 7: Generate CSR (Certificate Signing Request)

Generate a CSR from Custom Domain Manager and get it signed by a trusted Certificate Authority (CA).

CSR Generation Options

Option A: Individual Certificates
Generate one CSR per domain, for example:

s4.abcservices.abc.com
crm.abcservices.abc.com
bw.abcservices.abc.com

Option B: Wildcard Certificate
Generate a wildcard CSR:

CN: *.abcservices.abc.com  
SAN: *.abcservices.abc.com, abcservices.abc.com

Certificate Signing Guidelines

Internal network → Internal CA is acceptable and all the applicaiton will work.
Public access → Internal CA will cause browser warnings as below and navigation to the backend
Use a trusted CA like DigiCert if you want to access the custom domain publically.

Important Notes:

Verify CN and SAN before submitting CSR.
Certificates are valid only for the Custom Domain Manager instance from which the CSR was generated.
Non-Prod certificates cannot be reused in Prod.
We have generated the Wild Card Certificate for Production and Single Certificate (Included all SAN) for Non Prod System. Below is the Certificate Screen shot:

DigiCert Reference:
https://docs.digicert.com/en/certcentral/manage-certificates/reissue-an-ssl-tls-certificate.html

(Optional) IAS CSR Generation

Wildcard certificates do not work for IAS.
A separate CSR and certificate are required.

We skipped IAS custom domain due to additional cost and renewal overhead.

Step 8: Upload and Activate Certificate

Once signed, upload the certificate to Custom Domain Manager.

The certificate package includes:

Actual certificate
Intermediate certificate
Root certificate

Certificate Chain Format

Actual Certificate  
+ Intermediate Certificate  
+ Root Certificate

Tips:

Combine the full chain in a text file.
Remove extra spaces or blank lines.
Activate the certificate after upload.

Once activated:

Certificate expiry days are visible.
Renewal can be planned proactively.

Final Result

After successful activation, SAP Build Work Zone is accessible using the custom domain:

https://wz.abccompany.company.com

Errors that can occur: After all the configuration, If you stuck in the IAS authentication while accessing the work zone and getting the below error then add the custom domain in the IAS application:

Add you custom domain in the following path in the IAS if not came automatically:

Login to IAS -> Applications & Resources -> Applications -> Select the Application of Build Work Zone -> Single Sign On -> OpenID Connet Configuraiton and then in the Redirect URIs andPost Logout Redirect URIs section add the URl as https://*.abcservices.abc.ae/** (Your custom domain so that IAS will trust this domain)

Conclusion

I hope this blog helps you understand the Custom Domain Service concept and implement it successfully in SAP Build Work Zone projects.

Happy learning and implementing! 🚀

Regards,
Rohit Gera

Configure Web GUI for HTML in Build Work Zone, standard edition

2026-02-11T11:33:08.236000+01:00

Hello Everybody,

Writing this blog to explain how we can access the SAP Web GUI for HTML (Home Page of GUI) of S/4HANA On Premise (SAP Rise) from SAP BTP Build Work Zone. SAP S/4HANA Rise system is a private cloud example, we can use public cloud also.

Here we are using SAP BTP Build Work Zone, Standard Edition. You can also use SAP Build Work Zone, advanced edition also.

Prerequisites: Below are the prerequisites before we start:

-> Destination should be there in the Sub account and choose the Principal Propagation as authentication.

Configuration: There are 2 ways to configure the application, Page, spaces etc. in the build work zone:

1. Content Federation from S/4HANA system: In this we need to create the artifacts (Space, Pages, app etc.) in the S4 system and federate the content by making the content channel.

2. Local Artifcats in the Work Zone: Create Local Apps, Pages, spaces, groups etc. as required in the build work zone, standard edition.

We will be using the 2nd option as we are going to create local content in the work zone. Below are the configuration steps:

Step 1: Create App in the work zone

Access the Build Work Zone from the Sub account and got to Content Manager and create a local app.

Step 2: Configure the Transaction Code SMEN OR SESSION_MANAGER

If we configure the SAP Transaction Code in the app like we used to do in the Enterprise Portal, it wont work and give the below error "Transaction SMEN is locked":

After discussion with SAP Team, they told the Restriction to use the SAP Standard Transaction Code like SMEN OR SESSION_MANAGER

Direct access to SMEN (SAP Easy Access Menu) via SAP GUI for HTML from SAP Work Zone or FLP is not supported. This is not a limitation but a product and security decision:

SAP Security Note 2723570 explicitly disables access to SMEN in Web GUI because it exposes non–role-based system entry points, which is a security risk.
SAP Note 2786421 confirms that Web GUI actively blocks navigation to SMEN and redirects back to FLP.

FLP/Work Zone follows a role-based access model, which replaces the old Easy Access Menu by design.

Step 3:

Solution for the above restrcition is, open the webgui service in the app and it will try to access the SMEN code internally, you should give access to user for this tcode.

Below is the application screen shot created in the Work Zone locally:

Note: In the above screen shot I have uncheck the Check Box "Add intent and default SAP parameters to URL" just to keep the URL short. This is optional.

After completing the above configuration, now we can access the application in work zone:

I hope this blog will help people to access the Web GUI for HTML in the browser.

Regards,

Rohit Gera

How to Integrate ABAP Composite Roles in SAP Build Work Zone

2026-02-20T10:22:56.337000+01:00

When you're integrating launchpad content from SAP S/4HANA or SAP S/4HANA Cloud Private Edition to SAP Build Work Zone and have an existing role model built on composite roles in your ABAP system, you've likely encountered the challenge of efficiently exposing these roles. The good news is there are two ways to expose composite roles from your ABAP backend to Work Zone, using the Common Data Model (CDM) content exposure. In this post we will break down what your options are, each with distinct technical implications.

Option 1: Direct Exposure of Composite Roles

With this approach, you select the composite role itself for exposure in the ABAP transaction /UI2/CDM3_EXP_SCOPE (Launchpad Content Exposure to SAP BTP). The content of all underlying single roles is aggregated into the selected composite role, which is then exposed as single role to SAP BTP.

Key points

The consumer (Work Zone) sees the composite role as a single, unified role containing all the launchpad content of its component single roles.
The individual single roles inside the composite are not exposed separately.
Should you require separate access to the single roles beyond the unified composite role, you'll need to manually include each single role in the exposure selection.
Exposed roles are available in the BTP cockpit and can be assigned to users. However, IPS can optionally be used to automate role collection assignments and reduce administrative effort.
Direct exposure is available since SAP S/4HANA and SAP S/4HANA Cloud Private Edition release 2023 or release 2022 with note 3325870

Option 2: Indirect Exposure via Single Roles (with IPS)

The second approach keeps your original role structure and the IPS ensures correct user to role assignment between the ABAP system and BTP.
You select only the single roles which contain launchpad content for exposure in /UI2/CDM3_EXP_SCOPE (not the composite role itself).
During content calculation, the system checks whether these single roles belong to any composite roles. If they do, it includes a reference to this relation in the exposed CDM content. The composite role itself is not exposed to Work Zone.

IPS handles the role assignment logic, ensuring users with composite roles get the correct roles assigned on BTP side.

Key points

Each exposed single role includes information about its composite role relationships, but those composite roles are not directly available in the Content Manager on BTP.
The Identity Provisioning Service (IPS) ensures that when an user is assigned to a composite role in ABAP, all required single roles (now exposed) are assigned in Work Zone/BTP. For further information see Configure Integration with the Identity Provisioning Service and Exploring Role Assignments

If you expose only some single roles from a composite role, any other single roles within that composite are not automatically included. Users will only see apps from the exposed single roles in Work Zone not the full composite role content.

Indirect exposure is available since SAP S/4HANA and SAP S/4HANA Cloud Private Edition release 2022.

Next Steps

Both approaches are technically valid and work with CDM exposure v1 and v2.

If you're invested in IPS-driven provisioning the indirect approach gives you flexibility for Work Zone integration by keeping the existing role structure and automated user to role provisioning. Without IPS you have the option to directly expose composite roles and maintain user to role assignment on BTP side.

In any case avoid creating dedicated roles solely for exposure purposes. Instead, use the same roles that are actively used by your local entry point (SAP Fiori Launchpad). This ensures consistency between your on-premise and cloud experiences, reduces administrative overhead, and maintains a single source of truth for your role-based content model.

Principal propagation setup as SAP Java backend and SAP Business Technology Platform

2026-02-26T06:39:11.943000+01:00

Principal Propagation Setup as Java Backend

SAP BTP =>Cloud Connector =>SAP NetWeaver AS Java

Introduction

This blog explains how to configure principal propagation using X.509 certificate for an SAP NetWeaver AS Java backend (HTTPS). SAP Cloud Connector generates a client certificate for the user and forward it to the backend system.

Architecture Overview

User =>BTP App/Work Zone =>BTP Destination (PrincipalPropagation) => SCC => AS Java Backend.

Key requirements:

Mutual TLS between SCC and backend for HTTPS propagation (backend must trust SCC system cert/CA chain).
CA Certificate configured in SCC can issue user certificate.
User mapping rules on AS Java (ClientCertLoginModule) to map certificate fields to UME users.

Prerequisites Checklist

3.1 Backend user attribute alignment (SU01)

SAP Backend user email/user ID must match with BTP identity.

Ensure the email in the backend user record matches the email used to log in to BTP.

3.2 Cloud Connector certificates

You need three certificate

System Certificate (for trust between SCC and backend)
CA Certificate (to issue client certificate)
User Sample Certificate (rule based mappting).

NOTE : SAP Supports Self-signed certificate for ABAP based systems, but Java not supports Self-signed and the SCC system certificate/Backend server certificate must be signed by CA.

Java Systems: Java-based systems (like SAP Portal or PI/PO) use a KeyStore-based trust model. While they can technically support self-signed certificates, But SAP's implementation for Principal Propagation via the Cloud Connector requires a Certificate Authority (CA) chain for validation.

3.3 Permissions & access

-SCC admin access

-BTP subaccount admin for Destinations

-AS Java admin access to NetWeaver Administrator (NWA) security and SSL configuration.

Step-by-Step Configuration

Step 1 - Maintain backend user mapping attribute (Email)

In backend user maintenance (ABAP SU01 / Java UME as applicable), fill E-Mail Address exactly as used in BTP.

Pick one mapping strategy (Email OR UserID) and use it consistently across BTP <-> IdP <->backend.

Here we taken Email strategy.

Step 2 - Generate/Import SCC certificates (System + CA + Sample User Cert)

2.1 System Certificate (SCC)

In Cloud Connector Admin UI:

Go to Configuration -> On Premise -> System Certificate
Create CSR and get it signed by CA (recommended).

Import the certificate received from your AD team.

Also import the signed system certificate in AS Java trust store (NWA=>Cert & keys=>key storage=>Trusted CA).

NOTE: Import chain certificate (binded=>actual certificate and RootCA).

2.2 CA Certificate (SCC)

Go to Configuration -> On Premise -> CA Certificate
CA Certificate can be self-signed or the same way you can generate CSR & import the signed CA certificate.

2.3 User Sample Certificate

Maintain subject pattern as email and generate the sample certificate.

Create sample certificate.

-Import the created sample certificate in NWA=>Cert & keys=>key storage=>TicketKetstore

Step 3 - Sync Cloud Trust with IdP in SCC

Sync the trust configuration for principal propagation.

Go to Cloud To On-Premise -> Principal Propagation
Click Sync to fetch IdP/trust configuration from the subaccount context.

Without this trust, SCC can’t validate the inbound identity and won’t be able to generate the user certificate.

Step 4 - Configure cloud to On-prem mapping Your backend system mapping must be configured for HTTPS and identity forwarding.

Go to Cloud To On-Premise → Access Control
Create or edit your mapping for the backend system (HTTPS)
Set Principal Type => X.509 Certificate
Maintain resource paths (for example / or /sap/ depending on your requirement).

Set Principal Type = X.509 Certificate for the certificate-based identity.

Step 5 - Configure BTP Destination Authentication = PrincipalPropagation

In BTP:

Navigate to Connectivity -> Destinations
Create/update the Runtime destination to the backend via SCC
Set:

Proxy Type: OnPremise

Type : HTTP

Authentication: PrincipalPropagation

URL points to virtual host/port from SCC mapping

Backend Setup (SAP NetWeaver AS Java)

Step 6 - Activate HTTPS port in AS Java

AS Java must accept HTTPS and be able to request/require client certificates.

Configure SSL:

Open: http://<host>:<port>/nwa =>ssl
Add a new access point with protocol HTTPS (ignore if HTTPS already active)

Ensure SSL library is available and the SSL status becomes OK

Secure/Apply SSL certificate for Java backend.

Your Java HTTPS endpoint certificate must be valid for the hostname used by SCC.

Create/generate CSR for CA signing and import your CA response and root CA

Note : While generate the CSR don’t, forgot to maintain SAN (Subject Alternate Name) address, without SAN URL cannot be secured.

Tip: SAN can be FQDN and hostname of Java backend.(if you have two java instance generate CN = *.domain.com.

You can refer the SAP Note to generate the CSR & Certificate import using sapgenpse cmd line.

2275562 - How to import sapgenpse generated PSE file into AS Java

Step 7 - Define Rule-Based Mapping (ClientCertLoginModule)

Converting the certificate identity into a UME user.

-Add ClientCertLoginModule

-Define rules for mapping certificate fields (Subject CN / SubjectAlternativeName/email) to a UME user.

NWA=>Authentication and Single Sign-On =>Authentication

Maintain below authentication stacks for Policy client_cert.

- Configure Clientcertloginmodule (Create Mapping rules)

-Enable Certificate Logon

-PrincipalMappingLoginModule

Step 8 – Define Reverse Proxy parameters

Add the parameter
icm/trusted_reverse_proxy_<X> = <SCC System Certificate Subject, Issuer>

This reverse proxy parameter used to establish the trust relationship between the SAP Backend and SAP Cloud connector.

NOTE : This is mandatory for Principal propagation.

Step 9 – Restart the Java services

Verify everything and restart the java services to make the parameters effect.

Step 10 – Validate the SSO functionality with the work zone application URL.

SUMMARY:
After completing the successful principal propagation setup as java backend, below are the recommendations.

For Java based systems use the CA signed certificate.
Ensure SAN entries are added in the SSL certificate.
Generate sample certificate in SCC and import it in Ticketkeystore of NWA.
Maintain only required fields => AttributeName, getUserFrom and UserMappingMode for ClientCertLoginModule.

Thank you.