Securing any system, cloud-based or on-premises, involves many elements or attack surfaces. Network, hardware, and operating system protections are, for the most part, invisible to users and have little impact on performance. It's the interface between humans and application software where system security becomes a double-edged sword and can generate friction between system users and system guardians. Protecting against non-users, is in principle, relatively straightforward. Intrusions are considered threats until proven otherwise, and system hardening is a discipline devoted to keeping known bad actors at bay.

On the other hand, legitimate users need entry to the system, which gives them access to an organization's data. Unfortunately, for a multitude of reasons, both intentional and accidental, employees can steal, alter, and destroy applications and data. SAP implemented in the cloud is a shared responsibility security model where Azure secures the infrastructure, and application security is the customer's responsibility.

This diagram clearly illustrates how the Infrastructure as a Service model places more onus on the customer than the other two cloud paradigms, software, and platform as services. We can see that identity and account access fall squarely within the customer's domain.

As SAP landscapes are complex, so too is user administration, where authentication and access to multiple resources and applications have the potential to become onerous for administrators and users alike. The ingress point to an Azure-based SAP system is accessing the host cloud resources, so it makes sense to put user validation here. Let's see how Azure's authentication and access models can be integrated with SAP to provide a more secure and easier-to-manage environment.