Skip to main content

Joule Landscape Recommendation

Last updated on by fabianleh

Setting up Joule Work in an existing SAP landscape requires an integration into SAP Cloud Identity Services. Joule and SAP Cloud Identity Services are provided in two stages (Test and Production), while many other SAP systems in a typical landscape exist in more than 2 stages, such as Sandbox, Development, Test, Pre-Prod and Production. Identities in such landscapes with more than 2 stages are typically treated as productive also on non-productive systems. For example, a developer on a development system is a productive developer. To support such scenarios, as well as a strict SaaS approach (two-staged), SAP is providing two different architectural diagrams for landscape recommendations - one for a staged landscape (SaaS) and one for a consolidated landscape.

Staged Landscape Architecture​

The architecture diagram depicts the recommended Joule setup for a staged Joule landscape, illustrating how the various components are organized across all stages, while isolating the stages.

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

The solution architecture consists of the following key elements:

  • Staged environments: Each stage is represented as a horizontal row in the diagram, containing its own instance of SAP Cloud Identity Services, the SAP Business AI Platform and the connected SAP systems of the same stage. This separation ensures that changes can be developed and validated before affecting production workloads. Further stages could be added to the environment, hosting the same componenents, one instance of each, SAP Cloud Identity Services and SAP Business AI Platform.

  • SAP Cloud Identity Services: Test and Productive tenants of SAP Cloud Identity Services manage user authentication and authorization. The Test tenant serves the Test stage, while the Productive tenant serves the Production stage. Both integrate with the respective Corporate Identity Provider (Pre-Prod or Prod) for enterprise single sign-on.

  • SAP Business AI Platform: SAP Business AI Platform is an enterprise AI foundation that brings together AI, data, process context, and governance, so organizations can build, deploy, integrate, manage and scale AI capabilities into business processes and applications. The following services are hosted, SAP-managed, by the SAP Business AI Platform, separated by stage:

    • Joule Work: SAP’s digital assistant layer that brings conversational and generative AI into SAP applications and workflows.
    • Joule Studio: Low-code tooling to design, configure, and manage Joule-based experiences, including agents and skills.
    • SAP Agent Gateway: Runtime and integrated management platform for AI agents.
    • SAP Knowledge Graph: Connecting data with context to enable AI to utilize business information efficiently.

  • SAP Cloud Solutions per stage: Each stage connects to the corresponding instances of SAP cloud applications such as SAP S/4HANA Cloud, SAP SuccessFactors, and other Joule-enabled solutions. This ensures that Joule skills and configurations are tested against non-productive data before being deployed to production.

Characteristics​

  • Staged development lifecycle: The two-staged model (Test and Production) provides a structured path for developing, validating, and deploying Joule skills, agents, and configurations. Changes are qualified in the Test stage before promotion to production, reducing the risk of disruptions to business operations.

  • Centralized identity management: SAP Cloud Identity Services tenants (Test and Productive) provide consistent authentication and authorization across all stages. Integration with Corporate Identity Providers ensures that enterprise security policies are enforced, while the test tenant enables safe validation of identity configurations before production deployment.

Specialities​

  • Signavio: SAP Signavio does not provide test tenants. SAP Signavio will only be integrated into the Production stage.

  • SAP Cloud ALM: SAP Cloud ALM does not provide test tenants. SAP Cloud ALM will only be integrated into the Production stage.

Consolidated Landscape Architecture​

Disclaimer

The architecture approach shown in this section is not yet generally available (GA). However, the shown architecture will be the desired future architecture for the setup of the SAP Business AI Platform in the context of identity and access management.

The architecture diagram depicts the recommended Joule setup for a consolidated Joule landscape, illustrating how the various components are organized across the stages. In this example a 3-staged landscape and a sandbox stage in addition. This architecture allows the isolation of dedicated lanscape stages, such as sancbox or production stage, while combining other stages.

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

The solution architecture consists of the following key elements:

  • Three staged environments (Development, Test and Production): Each stage is represented as a horizontal row in the diagram. All stages share the same instance of SAP Cloud Identity Services and the SAP Business AI Platform. The Test instances of SAP Cloud Identity Services and SAP Business AI Platform are connected to a separate Sandbox landscape. This separation ensures that changes can be developed and validated before affecting production workloads, while identities in non-productive systems can be managed like productive identities.

  • SAP Business AI Platform: SAP Business AI Platform is an enterprise AI foundation that brings together AI, data, process context, and governance, so organizations can build, deploy, integrate, manage and scale AI capabilities into business processes and applications. The following services are hosted, SAP-managed, by the SAP Business AI Platform, separated by stage:

    • Joule Work: SAP’s digital assistant layer that brings conversational and generative AI into SAP applications and workflows.
    • Joule Studio: Low-code tooling to design, configure, and manage Joule-based experiences, including agents and skills.
    • SAP Agent Gateway: Runtime and integrated management platform for AI agents.
    • SAP Knowledge Graph: Connecting data with context to enable AI to utilize business information efficiently.

  • SAP Cloud Identity Services: Test and Productive tenants of SAP Cloud Identity Services manage user authentication and authorization. The Test tenant serves a dedicated Sandbox stage only, while the Productive tenant serves all the other stages. Both integrate with the respective Corporate Identity Provider (Pre-Prod or Prod) for enterprise single sign-on.

  • SAP Cloud Solutions per stage: Each stage connects to the corresponding instances of SAP cloud applications such as SAP S/4HANA Cloud, SAP SuccessFactors, and other Joule-enabled solutions. This ensures that Joule skills and configurations are tested against non-productive data before being deployed to production.

Characteristics​

  • Staged development lifecycle: The n-staged model provides a structured path for developing, validating, and deploying Joule skills, agents, and configurations. Changes are developed in the Development stage and qualified in the Test stage before promotion to production, reducing the risk of disruptions to business operations, while developers and test users are treated like productive users to mitigate the risk of interruptions in the development lifecycles.

  • Centralized identity management: SAP Cloud Identity Services tenants (Test and Productive) provide consistent authentication and authorization across all stages. Integration with Corporate Identity Providers ensures that enterprise security policies are enforced, while the test tenant enables safe validation of identity configurations before production deployment.

Specialities​

  • SAP SuccessFactors: SAP SuccessFactors owns an own identifier for a person, the Person UID, required for Embedded Analytics. This UID has an independent lifecycle than the Global User UID, which is owned by the SAP Cloud Identity Services. Connecting multiple instances of SAP SuccessFactors with a single instance of SAP Cloud Identity Services may lead to conflicts when synchronizing the identities from SAP SuccessFactors to SAP Cloud Identity Services. There are different possibilities to avoid such conflicts:
    • By using different user accounts in different instances of SAP SuccessFactors, while authentication via Global User UID can allow single sign-on even with different mail addresses in the different instances of SAP SuccessFactors.
    • By storing the different Person UIDs into different attributes inside SAP Cloud Identity Services, as described in Note 2954815

Services and Components​

Resources​