SAP BTP Connectivity — Cloud Connector, Destinations and SAP Private Link
As of 2026-10-30
Analytics and AI services in a BTP subaccount can only use data they can reach. This module teaches the three building blocks that make an on-premise or private system reachable: the SAP Cloud Connector with its outbound reverse-invoke tunnel, access control and high availability; the Destination service with proxy types and authentication types including principal propagation; and SAP Private Link service for hyperscaler endpoints. You run a trial lab that ends in a tested OnPremise destination, then apply the pattern to Datasphere live connections and to CAP or agent calls into S/4HANA OData.
What you will learn
- Connect a Cloud Connector to a BTP subaccount and read its status colours
- Create a system mapping with a virtual host and a resource path that exposes only /sap/opu/odata/
- Create an HTTP destination with proxy type OnPremise and test it end to end
- Choose an authentication type per destination and justify it
- Design a master and shadow Cloud Connector pair and list what is not replicated
Concept overview
Every analytics or AI scenario on SAP BTP eventually asks the same question: how does a service running in a BTP subaccount reach a system that has no public address? The ERP behind the corporate firewall, the BW/4HANA system, an SFTP server, a database in a private network. SAP BTP answers with three cooperating pieces. The Connectivity service carries the traffic, the Destination service stores the target address and credentials under a name, and one of two transports delivers the bytes: the SAP Cloud Connector installed in your network, or the SAP Private Link service that builds a private endpoint with a hyperscaler. The SAP Help entry point for all three is SAP BTP Connectivity.
A naming note for 2026. At SAP Sapphire in May 2026 SAP announced the SAP Business AI Platform, which unifies SAP BTP, SAP Business Data Cloud and SAP Business AI in one governed environment (SAP News, May 2026). Existing BTP services keep their names and contracts, and SAP Help still documents accounts, subaccounts and the Connectivity service under "SAP BTP". This module therefore says "SAP BTP" for the technical layer.
Prerequisites
- An SAP BTP trial or free-tier subaccount (Cloud Foundry) — see M418
- A backend with HTTPS and an OData service you may call, plus a host to install the Cloud Connector
- Basic knowledge of TLS certificates and HTTP
Outcomes
- Explain in two sentences why the Cloud Connector needs no inbound firewall rule
- Reproduce the lab: one system mapping, one resource row, subaccount status green
- Write a destination with Proxy Type OnPremise and the same virtual host and port as the mapping
- Name the four recurring causes of a failing OnPremise call
- Decide between Cloud Connector, Internet destination and Private Link for a given target
Full module with the Consultant plan — €19.90/month. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.