Integrate SAP Cloud Appliance Library with SAP Deployment Automation Framework

2025-03-21

The integration between SAP Deployment Automation Framework (SDAF) and SAP Cloud Appliance Library (CAL) offers a seamless experience for customers who want to deploy infrastructure by using SDAF's guided deployment. You can use Azure Pipelines or the provided shell scripts for deployment.

Introduction to SAP Cloud Appliance Library

SAP Cloud Appliance Library is a cloud-based solution that simplifies the deployment and management of preconfigured SAP solutions on cloud platforms like Azure. SAP CAL offers a catalog of preconfigured SAP software solutions (for example, S/4 HANA and SAP Business Suite). You can deploy these solutions on your cloud of choice without needing to manually install or configure software.

Overview of SDAF and SAP CAL integration

After the infrastructure setup, you can install SAP software by using the SAP CAL API for installation directly from Azure DevOps.

The benefits of this integration include:

Access to the latest S/4 HANA installation to ensure that you have the most up-to-date SAP software.
The fastest installation experience with Azure and SAP CAL integration to streamline the deployment process.
Elimination of the need to maintain a bill of materials file for the SAP installation, which simplifies the management and setup process.

This integration brings together the best of Azure infrastructure capabilities and SAP software deployment solutions. You gain a comprehensive and efficient approach to deploy SAP systems on Azure.

Prerequisites

Select one of the regions supported by SAP CAL (West Europe, East US, and East US 2) for the deployment.
Use an S-User role. This role is required.
Set up Azure DevOps for the deployment framework. For more information, see Use SAP Deployment Automation Framework from Azure DevOps Services.
Use managed identities for the SDAF deployment.
Set the parameter enable_rbac_authorization_for_keyvault = true in the Landscape tfvars file.
Set the parameter enable_sap_cal = true in the System tfvars file.

Register an application with Microsoft Entra and create a service principal

Sign in to the Azure portal.
Register an application with Microsoft Entra with supported account types by using Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
Assign roles to the application (Contributor and User Access administrator) for the subscription that you want.
Set up authentication with an application certificate or a secret. We recommend that you use a certificate. For more information:
- Read about Azure Key Vault certificates.
- Learn about certificate creation methods.
- Create a certificate in Key Vault by using the Azure portal, the Azure CLI, or Azure PowerShell.
- See the article Azure authentication with service principal.
Collect the following information for the next step: Subscription ID, Microsoft Entra tenant ID, application (client) ID, and client secret or certificate.
Go to Authentication, and under Supported account types, select Any Microsoft Entra ID tenant - Multitenant.

Create an account in SAP CAL and enable API access

Go to the CAL portal and sign in by using the S-User role.
Create the CAL account with the cloud provider as Microsoft Azure and the authorization type as Authorization with Application.
Enter the subscription ID, the Microsoft Entra tenant ID, the application (client) ID, and the certificate or client secret to create the CAL account.
After the CAL account is created, edit the account to enable API access. For more information, see Activating API Access.

Note

You must activate the product from which you want to deploy a workload for the SAP Cloud Appliance Library account that will use this API. Then accept the Terms and Conditions for this product. For more information, see Activating Solutions.
After API access is enabled for the account, wait for a moment until the key vault is created. Then collect the key vault name for the next step.

Important

This key vault stores the generated CAL endpoints and client secret that are used to obtain OAuth tokens.

Step-by-step guide

Here's a step-by-step guide for installing SAP S/4 HANA with the SAP CAL Installation API integrated into SDAF:

Deploy infrastructure from SDAF:
- See the instructions for infrastructure creation for an SAP system with SDAF by using managed identity in Use SAP Deployment Automation Framework from Azure DevOps Services.
- Set the parameter enable_rbac_authorization_for_keyvault = true in the Landscape tfvars file.
- Assign the Key Vault administrator role to the application for the SDAF workload zone key vault.
- Add the SAP BTP outbound IP addresses for the Europe (Rot) region in the SDAF workload zone key vault. For more information, see Regions and Hosts Available for the Neo Environment.
- Set the parameter enable_sap_cal = true in the System tfvars file.
After the system deployment, update the sap-parameters.yaml file with the CAL key vault.
Run the SAP installation using SAP-CAL pipeline:
1. After you add the CAL key vault in sap_parameters, select the SAP CAL product name from the dropdown menu.
2. Select Run to begin the installation process.

Track the installation

To track the installation and get detailed information about steps and any errors, go to the CAL portal.

SAP Cloud Appliance Library API documentation

The CAL installation API documentation is available on the SAP Business Accelerator Hub.

Workflow for SDAF: CAL API integration

The workflow/process diagram for the installation of S/4 HANA with the CAL API is available in the article on software provisioning of S/4 HANA.

Support

For questions about the integration experience of SAP CAL and SDAF, contact SDAFicm@microsoft.com.
For help on issues with installation, create a support request with SAP CAL on Report an Issue Dashboard - SAP for Me.

Raise the request for the component BC-VCM-PSD so that the request reaches the SAP CAL team.

Share via