Skip to main content

SAP Joule Landscape Recommendation

Last updated on by fabianleh

Setting up unified Joule in an existing SAP landscape requires a staged implementation process to qualify changes before bringing them to production. As organizations develop custom Joule skills and agents using Joule Studio, or configure Joule integrations across multiple SAP cloud applications, they need a structured approach to develop, test, and deploy these capabilities safely. This reference architecture provides a recommended SAP BTP subaccount model that supports a 3-staged landscape (Development, Test, Production), ensuring proper isolation, governance, and lifecycle management for Joule-related workloads.

The staged approach aligns with enterprise best practices for change management, allowing teams to iterate on Joule configurations in development, validate them in test environments connected to non-productive SAP systems, and finally promote qualified changes to production where they interact with live business data and processes.

Architecture​

The architecture diagram depicts the recommended SAP BTP subaccount setup for a 3-staged Joule landscape, illustrating how the various components are organized across Development, Test, and Production stages.

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

The solution architecture consists of the following key elements:

  • Three staged environments (Development, Test, Production): Each stage is represented as a horizontal row in the diagram, containing its own set of SAP BTP subaccounts and connected systems. This separation ensures that changes can be developed and validated before affecting production workloads.

  • SAP BTP Global Account with dedicated subaccounts per stage: Each stage contains multiple subaccounts serving distinct purposes. Depending on the activated scenarios and use cases, actual setup and deployment of services might vary accordingly. This architecture illustrates a possible approach. Main focus is on the interplay between the actual Joule instance, system connectivity and integration with SAP Cloud Identity services:

    • AI Core Subaccount: Hosts SAP AI Core with Grounding Management and AI Models, providing the foundation model access and document grounding capabilities that power custom AI solutions build on top of th BTP AI foundation.
    • Joule Studio Subaccount: Provides the development environment for building custom Joule skills and agents using Joule Studio. Joule Studio is part of SAP Build Process Automation.
    • Joule Subaccount: Runs the Joule runtime with SAP Build Work Zone, serving as the unified entry point for end users across SAP applications. SAP Build Work Zone can also be reused from other Subaccounts. In the development or test stage, you might consider using Joule preview to validate upcoming capabilities and features.
    • Connectivity Subaccount (Pre-prod/Prod): Hosts the SAP Connectivity service for secure connections to SAP S/4HANA Cloud Private Edition or on-premise systems per stage.

  • SAP Cloud Identity Services: Test and Productive tenants of SAP Cloud Identity Services manage user authentication and authorization. The Test tenant serves Development and Test stages, while the Productive tenant serves Production. Both integrate with the respective Corporate Identity Provider (Pre-Prod or Prod) for enterprise single sign-on.

  • SAP Cloud Solutions per stage: Each stage connects to the corresponding instances of SAP cloud applications such as SAP S/4HANA Cloud Private Edition, SAP SuccessFactors, and other Joule-enabled systems. This ensures that Joule skills and configurations are tested against non-productive data before being deployed to production.

Characteristics​

  • Staged development lifecycle: The 3-staged model (Development, Test, Production) provides a structured path for developing, validating, and deploying Joule skills, agents, and configurations. Changes are qualified in lower stages before promotion to production, reducing the risk of disruptions to business operations.

  • Dedicated subaccount separation: Each functional component (AI Core, Joule Studio, Joule runtime, Connectivity) runs in its own subaccount, providing clear boundaries for security, resource management, and cost tracking. This separation also enables different teams to manage their respective areas with appropriate access controls.

  • Centralized identity management: SAP Cloud Identity Services tenants (Test and Productive) provide consistent authentication and authorization across all stages. Integration with Corporate Identity Providers ensures that enterprise security policies are enforced, while the test tenant enables safe validation of identity configurations before production deployment.

  • Hybrid connectivity support: The dedicated Connectivity subaccounts per stage enable secure access to SAP S/4HANA Cloud Private Edition or on-premise systems. This ensures that Joule can interact with backend systems while maintaining the stage isolation required for proper testing and validation.

  • Flexibility and scalability: While this reference architecture depicts a 3-staged model, organizations can adapt it to their specific needs. Additional stages (e.g., Quality Assurance, Sandbox, Pre-Production) can be added, or subaccounts can be consolidated based on organizational requirements and governance policies. The model supports both public cloud and private cloud SAP deployments.

Examples in an SAP context​

  • SAP S/4HANA Cloud Private Edition: Organizations running SAP S/4HANA Cloud Private Edition can use this staged model to develop and test Joule skills that interact with their ERP system, ensuring that custom automations and integrations are validated before production deployment.

  • SAP S/4HANA Cloud Public Edition: For customers on SAP S/4HANA Cloud Public Edition, the same staged approach applies, with Joule configurations tested against sandbox or test tenants before activation in productive systems.

  • SAP SuccessFactors: HR-focused Joule skills and agents can be developed and tested against SuccessFactors test instances, validating employee self-service scenarios and HR process automations before enabling them for the workforce.

  • SAP SuccessFactors: SAP SuccessFactors is owning an own identifier for a person, the Person UID, required for Embedded Analytics. This UID has an independent lifecycle than the Global User UID, which is owned by the SAP Cloud Identity Services. Connecting multiple instances of SAP SuccessFactors with a single instance of SAP Cloud Identity Services may lead to conflicts when synchronizing the identities from SAP SuccessFactors to SAP Cloud Identity Services. There are different possibilities to avoid such conflicts, for example by using different user accounts in different instances of SAP Success Factors, while authentication via Global User UID can allow single sign on even with different mail addresses in the different instances of SAP Success Factors.

  • Multi-application landscapes: Organizations with multiple Joule-enabled SAP applications benefit from the unified Joule instance approach, where a single staged BTP setup serves as the foundation for Joule across SAP S/4HANA, SAP SuccessFactors, SAP Ariba, and other connected systems.

  • Extended staging models: The 3-staged model can be extended to 4 or more stages for organizations with additional quality gates, regulatory requirements, or geographic considerations that necessitate further separation of environments.

Services and Components​

Resources​