Hands-on Lab — AZ-120 Microsoft Azure for SAP Workloads Specialty

Overview

Prerequisites

Steps

1. 1.Provider, Resource Group, naming

   Standard Azure opener. AZ-120 expects you to pick a region that's certified for SAP and supports the M-series VMs you'll need — eastus2, westeurope, northeurope are the safest bets.

   Copy

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       azurerm = { source = "hashicorp/azurerm", version = "~> 4.0" }
     }
   }
   
   provider "azurerm" {
     features {}
   }
   
   locals {
     tags = {
       Project   = "certlabpro-az-120"
       ManagedBy = "terraform"
       Workload  = "SAP"
     }
   }
   
   resource "azurerm_resource_group" "main" {
     name     = "certlabpro-az-120-rg"
     location = "eastus2"
     tags     = local.tags
   }

2. 2.Build the SAP VNet with app + DB subnets

   Provisions:

   • Azure Virtual Network

   SAP architectures on Azure separate application servers (medium-CPU, modest memory) from the HANA database (very large memory) into distinct subnets — usually with stricter NSGs on the DB tier. AZ-120 tests this tier separation: app subnet exposes SAP services to users (or a load balancer); DB subnet is internal-only, accessible only from the app tier.

   We carve app and db subnets out of a /16 VNet. NSGs are out of scope for the lab (would be straightforward to add — same pattern as AZ-104 Step 2).

   Copy

   resource "azurerm_virtual_network" "sap" {
     name                = "vnet-sap"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
     address_space       = ["10.0.0.0/16"]
     tags                = local.tags
   }
   
   resource "azurerm_subnet" "app" {
     name                 = "app"
     resource_group_name  = azurerm_resource_group.main.name
     virtual_network_name = azurerm_virtual_network.sap.name
     address_prefixes     = ["10.0.1.0/24"]
   }
   
   resource "azurerm_subnet" "db" {
     name                 = "db"
     resource_group_name  = azurerm_resource_group.main.name
     virtual_network_name = azurerm_virtual_network.sap.name
     address_prefixes     = ["10.0.2.0/24"]
   }

3. 3.Create a Proximity Placement Group + Availability Set for the app tier

   Provisions:

   • Azure Compute

   Proximity Placement Groups (PPGs) are the AZ-120 Design and implement infrastructure to support SAP answer for ultra-low-latency between SAP application servers and HANA. PPG-co-located VMs land in the same datacenter (literally same rack), giving < 1ms inter-VM latency — required for SAP's HANA-app communication.

   Availability Sets group VMs across fault domains (separate power/network rails) within a single datacenter. The combination — PPG for latency, Availability Set for fault tolerance — is the AZ-120 reference shape for the SAP application tier. (For zonal availability, Azure now also supports placing all VMs in the same Availability Zone via PPG + zone — the more modern pattern.)

   Copy

   resource "azurerm_proximity_placement_group" "sap" {
     name                = "ppg-sap"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
   
     tags = local.tags
   }
   
   resource "azurerm_availability_set" "app" {
     name                         = "avset-sap-app"
     resource_group_name          = azurerm_resource_group.main.name
     location                     = azurerm_resource_group.main.location
     platform_fault_domain_count  = 2 # max for the region
     platform_update_domain_count = 5
     proximity_placement_group_id = azurerm_proximity_placement_group.sap.id
     managed                      = true
   
     tags = local.tags
   }

4. 4.Pre-provision premium SSD storage shape for HANA

   Provisions:

   • Azure Managed Disks

   HANA's storage requires premium SSD or higher (P-series tier) for production workloads — the SAP-certified IOPS and throughput specs assume P30+ disks for HANA data/log. AZ-120's Design and implement infrastructure to support SAP tests the disk-tier selection as a recurring cost / performance trade-off.

   We provision one P10 (128 GB) managed disk as a shape demonstration — small + cheap, but the same Premium_LRS storage account type a production HANA disk would use. Attaching it to a VM is a separate step (out of scope here). For production HANA, you'd use P30 / P40 disks and stripe multiple together via LVM for the throughput SAP demands.

   Copy

   resource "azurerm_managed_disk" "hana_data_shape" {
     name                 = "disk-hana-data-shape"
     resource_group_name  = azurerm_resource_group.main.name
     location             = azurerm_resource_group.main.location
     storage_account_type = "Premium_LRS" # SAP-certified storage tier
     create_option        = "Empty"
     disk_size_gb         = 128 # P10 size — demonstration only; production HANA uses P30+
   
     tags = local.tags
   }

5. 5.Add a Private DNS zone for SAP hostnames

   Provisions:

   • Azure Private DNS

   SAP installations rely heavily on stable, predictable hostnames (sapha01, sapha02, sapdb01) — the SAPHostAgent and HANA System Replication both require consistent hostname resolution. AZ-120's Design and implement Azure compute and storage solutions tests Private DNS as the answer for intra-VNet hostname stability without manual /etc/hosts editing.

   We create the SAP zone and link it to the VNet from Step 2 with registration_enabled = true so SAP VMs auto-register their hostnames. With this final piece in place, the scaffolding is complete: VNet with tiered subnets, PPG anchoring co-location, Availability Set for fault tolerance, premium-disk shape for HANA storage, Private DNS for hostname stability. SAP VMs deploy into this base via standard azurerm_linux_virtual_machine resources.

   Copy

   resource "azurerm_private_dns_zone" "sap" {
     name                = "sap.internal"
     resource_group_name = azurerm_resource_group.main.name
   
     tags = local.tags
   }
   
   resource "azurerm_private_dns_zone_virtual_network_link" "sap" {
     name                  = "sap-vnet-link"
     resource_group_name   = azurerm_resource_group.main.name
     private_dns_zone_name = azurerm_private_dns_zone.sap.name
     virtual_network_id    = azurerm_virtual_network.sap.id
     registration_enabled  = true
   
     tags = local.tags
   }

Cleanup