How a newly independent healthcare company secured its SAP BTP landscape before go-live

When a large healthcare business separated from its parent and began trading as an independent public company, it inherited a SAP BTP landscape that its own teams flagged as insecure and vulnerable. Too many users held global admin access in the production environment. Sub-account structure and naming conventions were inconsistent across environments. The integration estate, 220 iFlows and development objects spanning 24 packages, had quality and standardization problems: roughly 38% of objects needed remediation, and 15 were unsuitable for production as-is.

On top of that, 90% of the company's BTP spend sat in Advanced Event Mesh, a capability that Integration Suite could serve at a fraction of the cost. The company needed the landscape clean and governed before its first go-live as a standalone entity, with no room to miss the deadline.

Mindset ran a focused seven-week BTP governance and security engagement to get the landscape ready. The team audited all 220 integration objects across three waves, scored each one, and flagged the 15 that could not go to production without remediation.

On the security side, Mindset identified the production firefighting team and removed every non-firefighter from global admin. The team created dedicated admin role collections covering user and role administration, destination and connectivity administration, and service administration, then assigned the firefighting team accordingly. S-Users were recreated on the company's own email domain, shared-services and Identity Authentication Service sub-accounts were built out, and full single sign-on through the company's Okta tenant was implemented.

Across development, quality assurance, and shared-services environments, Mindset reworked role collections to match security best practice and established formal onboarding guidelines so new users land in the right places. The team also recommended a hub-and-spoke ICO pipeline design to address JMS queue limits and laid out a clear path off Advanced Event Mesh onto Integration Suite to reduce licensing costs.

The initial governance engagement expanded into a multi-phase BTP factory program, an application managed services engagement, Signavio process-mining implementations covering order-to-cash and record-to-report, an external warranty web portal on S/4 depot repair, an S/4 org-hierarchy validation tool with an AI insight chatbot, and AI test automation.

The company reached go-live with every security and governance gap closed. Production administrator access was correct, the integration estate was reviewed and remediated, and SSO ran on the company's own identity provider.

The audit produced a documented view of 220 integration objects: 62% clean, 38% needing attention, and a specific list of 15 objects to fix before go-live. That gave the IT team a clear, prioritized remediation backlog rather than a vague sense that things were risky.

The 90% share of BTP spend in Advanced Event Mesh became a documented cost-optimization opportunity with a specific migration path, to be addressed in subsequent phases. The governance engagement became the foundation for an ongoing BTP factory and managed services relationship.