SAP architecture
ReferenceAzure landing zones and AI sovereignty
SAP-aware landing zone with policy-as-code, private endpoints, and Canadian Protected B / residency controls for AI services.
Architecture diagram
Data or evidenceIdentity or control
Callout 1
Platform landing zone
Connectivity and identity
Hub connectivity, DNS, firewall, and the identity baseline for SAP-aware spokes.
Need this architecture for your internal review?
Request an editable .drawio source stencil for internal architecture validation.
Detail
- Data residency and support access are modelled explicitly — the region of a resource is not the region of every replica and log
- Protected B positioning for Canadian government workloads
- No public ICM to SAP; private connectivity for the lake and for AI
The platform landing zone provides shared services. The SAP spoke hosts SIDs. The AI spoke hosts governed model endpoints. Policy and connector evidence close the loop to GRS.