SAP on Azure Cheat Sheet — sizing, costs, landing zone, backup/DR on one page

01 HANA VM sizing quick reference

SKU family	Certified examples (VM memory)	Typical fit
M-series (v1)	`Standard_M32ts` (192 GiB), `Standard_M32ls` (256 GiB)	Dev/test, small prod, HA pairs for ≤ ~256 GB RAM
E/D-series (v4–v6)	`E20ds_v4` (160), `E32ds_v4` (256), `E48ds_v4` (384 GiB)	Non-prod; smaller prod with Premium SSD v2 / Ultra sub-ms storage
Mv2 / Mv3 scale-up	`M416ms_v2`, `M624ds_12_v3`, `M832ds_12_v3` (11,400 GiB)	Production scale-up, 1–2 TiB+ memory footprint
Mv3 / Ix extreme memory	`M832ixs1` (14,902), `M832ids_16_v3` (15,200), `M832ixs_v2` (23,088 GiB)	Very large single-node; data path designed for 2,000–4,000 MB/s
Mv3 top-end (request-only)	`M896ixds_32_v3`, `M1792ixds_32_v3` (30,400 GiB)	Max single-VM HANA; not available by default — ask your Microsoft account team

Source of truth: the SAP HANA hardware directory, not note 1928533 (NetWeaver). E16v3/E32v3 are explicitly not HANA-certified.
Premium SSD v2 math: data = 1.2 × RAM · log = 0.5 × RAM (500 GiB cap above 1 TiB) · shared = 1 × RAM (1 TiB cap).
SAP KPIs: /hana/log 250/250 MB/s @ 1 MB I/O · /hana/data ≥400 read / ≥250 write @ 16/64 MB I/O.
Caching (Premium SSD v1): data None or ReadOnly · log None + Write Accelerator (mandatory on M-series) · shared ReadOnly. PSSD v2 / Ultra: no caching knob, no Write Accelerator needed.
NSG ports (instance number xx): SQL/MDBC + HSR 3xx13 · 3xx15 · 3xx40–3xx98; Host Agent 1128/1129; XS 43xx/80xx; HTTP/S 5xx00/5xx01.
Don't eyeball it: az workloads sap-sizing-recommendation returns certified SKUs from SAPS + HANA memory.

Go deeper: Deploy SAP HANA on Azure — VM sizing, storage & configuration

02 Monthly cost snapshot (Retail Prices API, East US, USD — as of 2026-11-08)

Linux HANA SKU	vCPU / RAM	PAYG $/h	1-yr RI (prepaid total)	3-yr RI (prepaid total)	RI savings 1y / 3y
`Standard_M832is_16_v3`	832 / 15,200 GiB	$163.856	$834,816	$1,209,163	41.8% / 71.9%
`Standard_M416s_6_v3`	416 / 5,696 GiB	$55.3014	$281,750	$408,092	41.8% / 71.9%

Two-node HA pair on M832is_16_v3 (730-h month): ≈ $239,200/mo PAYG → ≈ $139,100/mo amortized on 1-yr RI → ≈ $67,200/mo on 3-yr RI.

OS premium: the same M832is_16_v3 on Windows bills +$38.27/h (~$335k/yr on one always-on VM). Run SAP on Linux.
Step function: 416 → 832 vCPU costs ~3.0×, not 2× — top SKUs carry a per-vCPU premium.
Spot: $30.281/h (81.5% off) — stateless app servers and batch only, never production HANA.
Premium SSD v2 (LRS): $0.080/GiB + $0.0051/IOPS + $0.040/MBps per month; first 3,000 IOPS and 125 MBps per volume free. Ultra: $0.120 / $0.0496 / $0.350 (+$4.38/vCPU-mo reservation).
Blob lifecycle: Hot $0.0208 → Archive $0.00099 per GB-month — a 100 TiB repo is ~$2,130/mo hot vs ~$101/mo archived (21× swing).
Azure Backup: SAP HANA protected instance $80/mo (SQL in Azure VM: $25).
Egress: first 100 GB/mo free, then $0.08/GB (next 10 TB); 20 TB/mo ≈ $1,440. Cross-AZ $0.01/GB.
RISE note: under standard packaging these meters sit inside SAP's subscription; under BYOL they land on your Microsoft invoice. RPE/BTP pools are order-form confidential — get them in writing.

Go deeper: RISE with SAP cost breakdown — what you pay on Azure

03 Landing zone checklist

SAP gets its own subscriptions — CAF names it a large specialized workload (scale unit, management boundary, policy boundary).
Platform landing zone once per Entra tenant; SAP lands in workload landing zones under Online/Corp.
Dedicated management, security, connectivity, identity subscriptions — never combine platform responsibilities.
≥ 2 SAP management groups: prod vs non-prod get distinct controls ("deny by default in prod, relaxed in dev").
Azure Policy at MG scope (allowed regions, tags, dev SKU caps); RBAC at subscription/RG scope — Basis vs network vs finance split.
CanNotDelete locks on production SAP resource groups, removable only by break-glass admins.
DAF control plane in its own hub subscription: deployer VMs, Key Vault, outbound firewall, Bastion, config web app.
Dev/prod in dedicated spokes with their own VNets; adopt DAF naming [ENV]-[REGION]-[NETWORK]-INFRASTRUCTURE in the review meeting, not in Terraform state.
Subscriptions are global — no per-region sub needed; a primary+secondary BCDR pair can share one subscription.
Watch the subscription-count limit — we requested a quota increase before the sixth spoke.
Automation identities need User Access Administrator, not just Contributor (our first deploy failed for two days on this).
Exclude SAP database servers from automatic endpoint-protection policy installs.
Shutdown schedules for non-prod; budget alerts at MG level per environment.
Build order: control plane → workload zone → SAP system(s). ACSS/VIS for one system; the Deployment Automation Framework for repeated environments.
The SAP-specific CAF landing-zone pages are retired — cite commit-pinned archives and gate designs on SAP note 1928533 + the Azure certifications list.

Go deeper: Azure landing zone for SAP in 2026 — how we structure it

04 Backup & DR — key numbers (docs checked 2026-11-08)

Metric	Documented value
RPO floor, same region	15 minutes (log-backup frequency; logs only flow after the first successful full)
RPO, secondary region (Cross Region Restore)	12 h + log frequency — vaults replicate only between paired regions
RTO	No absolute RTO is published. Snapshots make the baseline a near-instant disk restore + log replay; measure your own in a drill
Backup throughput	~420 MB/s data, ~100 MB/s logs; multi-streaming (≤ 32 channels) ~1.5 GB/s — needs ≥16 vCPU / 128 GB VM and >128 GB backups
Restore throughput	Slower than backup; default cap ~420 MB/s per stream — size recovery window as DB size ÷ throughput + log replay
Fuls per day	Scheduled: 1 · on-demand: 3 recommended / 9 hard
Retention	Min 7 d (any type) · incremental max 180 d · logs commonly 7–35 d · instant tier 1–35 d
Restore quota	Max 10 restores/instance/day — failed and canceled jobs count against it
Scale supported	DBs up to 40 TB (size, not memory) · one instance per VM · scale-out preview ≤ 32 nodes, all in the vault's region
Support matrix	Azure VMs only (no HLI) · SLES 12 SP2–SP5 / 15 SP0–SP7 / 16.0, RHEL 8.1–10.0 · HANA 1.x SDC & 2.x MDC SPS04–08 · Ubuntu: not on the list

HSR gotchas: HSR + the Azure Backup DR scenario is unsupported; you cannot restore into an HSR instance (restore standalone, re-establish replication); pause protection on a secondary node or ping failures lock the backup user (ODBCConnectionError on the primary).
Snapshots don't replace streaming: weekly full + logs via Backint must already exist; differential or incremental, never both; policies run daily only.
Prereq traps: VM-name + RG length < 84 chars · /opt/msawb needs ~4 GB · nameserver SQL port for MDC, indexserver for single-tenant.
No DST auto-adjust: your 02:00 full quietly becomes 03:00 for half the year — edit the policy.

Go deeper: SAP HANA backup and disaster recovery on Azure — field guide

All figures as of 2026-11-08, condensed from tutorials that cite Microsoft Learn, SAP Help, and the Azure Retail Prices API (East US, USD) — prices, SKUs, and support matrices change; the official documentation is the source of truth. SAP AI Lab is an independent, unofficial site; not an official SAP or Microsoft publication.