Integration · Security · AMS on SAP BTP
Food and Agriculture Build Work Zone Central Finance Event Mesh Featured
How CHS unified its SAP estate on BTP, from a single launchpad to identity governance and AI
Delivered 2022–2025
Mindset and CHS unified a fragmented application landscape behind a single launchpad, brought identity governance to the SAP Cloud landscape, and put AI to work, leaving CHS, in its own words on a public stage, much better prepared for the future.
By the numbers
-
Less settlement processing time and memory
-
1 launchpad
Unified front end in place of many portals
-
90+
Technical-debt items documented for leadership
-
13+
SAP products across the BTP estate
Before
A broad estate to coordinate
- Energy and Ag S/4HANA instances plus dozens of SaaS apps, with no middleware tying on-prem and cloud together.
- No single launchpad, so people navigated a series of disjointed solutions to reach their apps.
- SAP Cloud solutions that needed a compliant approach to authentication, risk analysis, and user provisioning.
After
A unified SAP BTP estate
- Integration Suite, Event Mesh, and Open Connectors connecting on-prem and SaaS apps on SAP BTP.
- One unified launchpad in place of a fragmented set of portals, with SAP IAG identity governance live across the SAP Cloud landscape.
- Clean Core, Fiori, and a BTP-hosted RAG AI application running on SAP's own platform.
“Our enterprise landscape is now better prepared for the future. SAP BTP provides us the ability to scale our existing solutions and also add new Lines of Business.”
Why this matters
A Fortune 100 cooperative running real SAP BTP in production: identity governance, a single farmer-owner launchpad in place of a fragmented set of portals, enterprise integration, and AI built on SAP's own stack.
The challenge
CHS is a farmer-owned Fortune 100 cooperative running energy, agronomy, grains, and foods businesses on a complex SAP estate, with separate Energy and Ag S/4HANA instances plus dozens of SaaS apps.
CHS's own engineers named the problems on a public stage. They needed middleware to connect on-prem and SaaS applications. Their people had no single launchpad to reach every app in one place. Their SAP Cloud solutions needed a compliant approach to authentication, risk analysis, and user provisioning. On top of that, a small security team was carrying a heavy ticket load.
What we did
Mindset delivered the SAP IAG identity-governance implementation, bringing compliant authentication, risk analysis, and user provisioning to the SAP Cloud landscape.
The work runs across the BTP stack: Build Work Zone, Fiori, Clean Core, Integration Suite, Event Mesh, HANA Cloud, and DevOps practices, plus AI tooling for the SAP IT teams built on Mindset's BTP-hosted RAG framework.
Application managed services run across a hybrid US and India team on a Scrum cadence, with daily standups, ServiceNow tracking, and a formal UAT and sign-off process. Coverage spans GTS, TM, ACM, Central Finance, IBP, SuccessFactors, and IS-OIL.
The outcomes
CHS put it plainly on a public slide: its enterprise is now better prepared for the future, ready to scale existing solutions and add new lines of business as the Energy and Ag S/4 instances grow.
The team cut settlement processing time and memory use by 80% and reworked APIs to handle larger data volumes. It cleared long-standing portal timeout issues with no new incidents, fixed a thorny change-management mail-approval problem, and shipped Change Audit, Location Hierarchy, and FTM Fiori enhancements.
On the front end, a single unified launchpad replaced a fragmented set of separate portals. The team also catalogued more than 90 technical-debt items so CHS leadership could prioritize what to fix next.
On stage & in the press
If we built this today
Concept · not delivered scopeGovern access the way it scales.
This is a forward-looking concept, not the scope we delivered on this engagement. It is the build we would reach for now, grounded in SAP that ships today.
A Fortune 100 farmer-owned cooperative ran identity, risk analysis, and user provisioning across separate Energy and Ag S/4HANA instances plus dozens of SaaS apps, with a small security team carrying a heavy monthly access-request load, so the modern build puts an agent on the front of that queue.
The data product
Identity and access data product on SAP Business Data Cloud
A governed data product that brings together users, roles, entitlements, and access history from both S/4HANA instances and the cloud apps. It grounds the agent so risk analysis and provisioning suggestions reflect the real, current landscape rather than a single system's view.
Data product on Business Data Cloud
The Joule agent
Access Risk and Provisioning Agent
Reads each access request against role definitions, segregation-of-duties rules, and live risk analysis across the connected S/4HANA instances and cloud apps. It drafts the provisioning decision with the risk it found and the mitigation, then routes it for a human to approve.
SAP Cloud Identity Services, SAP Access Control, SAP Integration Suite, SAP BTP · PROPOSE · Access request cycle time and the security team's monthly ticket backlog
The Fiori app
The access-control and risk-analysis apps with Joule alongside
The governance and access-control apps where an administrator reviews requests, runs risk analysis, and confirms provisioning, with Joule alongside to explain each conflict and suggest the next step. Identity governance lives in SAP BTP and SAP Cloud Identity Services, so this is the access-control app category rather than one named S/4HANA transaction app.
Reached from the Fiori launchpad
We would mine the real access and provisioning process in SAP Signavio first, map the system and identity landscape in SAP LeanIX, and lean on MIND accelerators to carry the existing identity governance forward instead of starting over.
What we built
-
Compliant authentication, risk analysis, and user provisioning for SAP Cloud
SAP IAG implementation
Identity Access Governance for a compliant approach to authentication, risk analysis, and user provisioning across SAP Cloud solutions.
-
many portals consolidated to a single launchpad
Unified SAP launchpad
A single unified front end so CHS people reach every application in one place.
-
On-prem and SaaS apps connected on SAP BTP
Integration Suite middleware
The platform CHS needed to connect on-prem and SaaS apps, with Event Mesh and Open Connectors.
-
90+ technical-debt items documented for leadership
Application managed services
Hybrid US and India delivery on a Scrum cadence covering GTS, TM, ACM, Central Finance, IBP, SuccessFactors, and IS-OIL.
-
80% less processing time and memory usage
Settlement processing rework
Backend and API enhancements to handle larger data volumes.
-
No new incidents after the portal fix
portal and change-management fixes
Resolved long-standing portal timeout issues and a complex change-management mail-approval problem.
-
Shipped under managed services
Fiori and reporting enhancements
Change Audit and Location Hierarchy reports plus FTM Fiori enhancements.
-
BTP-hosted RAG on Build Work Zone, SAP AI Core, and HANA Cloud
AI for SAP IT teams
A retrieval-augmented generation framework hosted on SAP BTP, giving CHS SAP IT teams AI tooling against their own documentation and best practices.
-
Continuous coverage for a stretched team
Security and Basis support
Stood up from 2022 to take pressure off a heavily loaded security team.
-
Architecture and Clean Core guidance across the BTP estate
BTP advisory and Clean Core
Ongoing guidance on BTP governance, Clean Core, ABAP Cloud, CAP, and DevOps practices.
A look at the work
Presented publicly
We took this work to the SAP stage.
Mindset was CHS's IAG implementation partner and now runs its ongoing BTP advisory, from governance and security to Build Work Zone, Fiori, and Integration Suite. CHS's many SAP systems now sit behind one launchpad, with real-time analytics on SAC and Datasphere and single sign-on through IAS.
“Our users needed a single unified launchpad to access all of their applications in one place.”
