Fiori Launchpad Part 3: SAP Build Work Zone and Content Federation

📌 KEY POINTS
✅ SAP Build Work Zone provides a central launchpad on SAP BTP across many systems.
✅ Content federation imports roles and apps from content providers such as S/4HANA instead of rebuilding them.
✅ Apps still run against their own back ends via destinations; users authenticate through the identity service.
✅ A central entry point helps when users work across S/4HANA, SuccessFactors, Ariba and custom BTP apps.
⚠️ Federated roles must still be assigned to users in BTP and back ends — import alone grants nothing.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Parts 1–2 covered a single system's launchpad. Part 3 covers a landscape-wide entry point.

━━━━━━━━━━━━━━━━━━━━
▶ 1. WHY A CENTRAL LAUNCHPAD
Many users need apps from several systems: S/4HANA for transactions, SuccessFactors for HR tasks, Ariba for procurement, custom BTP apps. Separate launchpads mean separate logins and bookmarks. SAP Build Work Zone offers one site with all of them, consistent navigation and a shared shell.

━━━━━━━━━━━━━━━━━━━━
▶ 2. CONTENT FEDERATION
Instead of recreating catalogs, content providers expose their roles and apps. For S/4HANA, roles are exposed from the ABAP system and imported into Work Zone as content. Updates in the provider can be re-synchronised. This keeps one source of truth for app definitions.

━━━━━━━━━━━━━━━━━━━━
▶ 3. RUNTIME AND CONNECTIVITY
When a user opens a federated S/4HANA app, the UI is loaded and calls the S/4HANA back end through destinations and, for on-premise systems, the Cloud Connector. Single sign-on through SAP Cloud Identity Services and principal propagation lets back-end authorizations apply to the real user.

━━━━━━━━━━━━━━━━━━━━
▶ 4. ROLES AND ASSIGNMENT
Imported roles appear in BTP as role collections or site roles and must be assigned to users or groups there. Back-end roles must still be assigned in the provider system. Planning identity and role assignment is the main project effort.

━━━━━━━━━━━━━━━━━━━━
▶ 5. WHEN TO CHOOSE IT
A central launchpad is worth it when users truly work across systems or when a portal-like experience with workspaces is needed. For users who work only in S/4HANA, the embedded launchpad may be simpler. Many companies combine both.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

1. List systems your users need daily.
2. Expose one S/4HANA role for content federation in test.
3. Import it into a Work Zone site and assign it.
4. Open an app and trace the destination used.

✅ CHECKPOINT: a test user opens S/4HANA apps from Work Zone with SSO and correct authorizations.

A company imported S/4HANA roles into Work Zone and expected users to see apps. Nothing appeared because role collections were not assigned in BTP. After mapping identity provider groups to role collections, apps showed correctly, and back-end authorizations then decided data access.

• Rebuilding catalogs manually in Work Zone.
• Forgetting role assignment in BTP.
• No principal propagation for on-premise back ends.
• Central launchpad for users who need only one system.

• Federate content from providers.
• Group-based role assignment from the identity provider.
• Plan SSO and principal propagation early.
• Choose central vs local launchpad per user group.

Interviewers ask what content federation is, how runtime connectivity to on-premise back ends works, and which roles must be assigned in BTP and in the back end.