Category Archives: SAP Netweaver

SAP NetWeaver and Hyper-Threading on Windows Servers : To be or Not to be

Here are the key messages related to SAP NetWeaver and Hyperthreading ( HT ) now called
Simultaneous MultiThreading ( SMT ) derived from different sources as well as internal lab tests
done for the WS2012 SAP First Customer Shipment program. In addition I incorporated very
valuable input from Juergen Thomas who published many blogs and papers about SAP on the
Microsoft platform :

  1. Always keep in mind : a CPU thread is NOT equal to a core !  ( also see walk-through section at the end )
  2. Sizing based on SAPS which is done by Hardware vendors for certain server models usually
    includes SMT. Looking at the latest published SAP SD benchmarks one will realize immediately
    that SMT was turned on according to the CPU Information ( # processors / # cores / # threads ).
    The goal is to achieve the maximum amount of SD workload. Including SMT for sizing implictly
    means that customers will turn it on

  3. To use Hyper-V on a Server with more than 64 logical processors ( e.g. 40 cores and SMT turned on )
    needs to use Windows Server 2012. Hyper-V of Windows 2008 ( R2 ) has a limit of 64 logical CPUs,
    Windows 2008 R2 being able to address 256 CPU threads in a bare-metal deployment

  4. When using the latest OS and application releases the general suggestion regarding SMT is to
    always turn it on. It either helps or won’t hurt. Turning SMT on or off requires a reboot as it’s a
    BIOS setting on the physical host

  5. How much SMT will help depends on the application workload. While there is a proven benefit in
    SAP SD Benchmarks as well as in many other benchmarks, we know customer tests where there
    was no difference between running a virtualized SAP application Server on WS2012 Hyper-V with
    or without SMT. Conclusion is that the effect/impact of SMT is pretty much dependent on the
    individual customer scenario

General Information about Hyper-Threading

Being around for many years Hyper-Threading ( HT ) now called Simultaneous MultiThreading ( SMT )
is a well-known feature of Intel processors. Looking on the Internet one can easily find a lot of information
and technical descriptions about it like this one :
While there have been some issues in early days the recommendations related to the more recent OS or
application releases is usually to have SMT turned on as it does increase the throughput  achievable
with an application on a single server. Nevertheless the question about the impact of SMT on SAP NetWeaver
shows up again when looking at the execution speed of a single request handled by a single CPU thread.
Especially as we are pushing WS2012 Hyper-V – customers wonder what the performance characteristics
are with a combination of SMT and virtualization.

In this blog I try to summarize the status quo and give some guidance based on all the statements and
test results and experiences which are around.

Single-Thread Performance

I personally would like to separate the SMT discussion from the single-thread performance discussion.
When People talk about the latter one it is usually about the trend in processor technology to increase
the number of cores instead of increasing the clock rate. In these discussions the often unspoken
assumption is 1 thread per core. Sure – there are very good reasons for it. But as one can read under
the following links only applications which are able to use parallelism will fully benefit from the multi-core
design. As a consequence certain SAP batch jobs which are dependent on high single-thread performance
might not improve a lot or not at all when the underlying hardware gets upgraded to the next processor
version which has more cores per CPU. A customer example of this effect can be found here :

SAP NetWeaver is not a multi-threaded application. But in SAP it’s of course possible trying to
parallelize processing on a Business process level. Just think about payroll parallelism in SAP.

Some basic articles around single-threaded CPU performance and multi-core processing
can be found here :

Could SMT hurt in some cases ?

is in principle the wrong question. The correct question should be : What is the effect and impact
of SMT with different applications and different configurations or scenarios ?
Understanding these effects and impacts will make it possible to adapt and get the maximum out
of an investment in a specific hardware model.
There might be some outdated messages or opinions around based on experiences from the early
days which are no longer valid. In other cases I personally wouldn’t call it an issue of SMT but
wrong sizing or overlooking some documented restrictions. First let’s look again at a general statement :

“Ideal scheduling would be to place active threads on cores before scheduling on threads on
the same core when maximum performance is the goal. This is best left to the operating system.
All multi-threaded operating systems support Intel HT Technology, while later versions have more
support for scheduling threads in the most ideal manner to maximize performance gains”


Here are some more details :

  1. single-thread / single-core performance

In SAP note 1612283 section “1.1 Clock Speed” you will find the following statement :
“If you need to speed up a single transaction or report you might try to switch off

Based on some testing I would like to differentiate this a little bit further. As long as the
number of running processes / threads is <= the number of cores the OS / hypervisor should
be smart enough to distribute the workload over all the cores. In this case there shouldn’t be
any effect/impact by the fact that SMT is on or off. Based on the basics of SMT as described
in the Intel article named above, expectation is that with the number of running processes
/threads exceeding the # of cores, the performance/throughput of a single CPU thread,
dependent on the load, is decreasing.

  1. parallelism
    From an OS perspective one shouldn’t see any major issues with SMT anymore. It Looks different
    though when it comes to the application. One potential issue could arise if an application doesn’t realize
    that the available logical CPUs are mapped to SMT threads and not cores. This could lead to wrong
    assumptions. Here is an example from SQL Server :

“For servers that have hyper-threading enabled, the max degree of parallelism value should not
exceed the number of physical processors”
( the term “processors” being used related to physical cores in this article )

It’s related to the two items above. Parallelism on a SQL statement level means that the SQL Server
Optimizer expects all logical CPUs to be of the same type. The important question is if this is just not
as fast as if there would be as many cores as logical CPUs or if it becomes in fact slower than without
3. virtualization

Another topic is running VMs on Hyper-V with SMT turned on on the underlying physical host. It’s
again not different from the items mentioned before. Inside a VM an application might not be aware
of the nature of a virtual CPU. It’s not just SMT. Depending on the configuration ( e.g. over-
commitment ) and the capabilities of an OS/hypervisor a Virtual Processor will correspond only to a
“fraction” of a real Physical CPU.

Internal lab tests on WS2012 Hyper-V have proven the statement I quoted at the beginning of this
section. As long as there are enough cores available the workload will be optimally distributed.
A perfect way to show this is to increase the number of virtual CPUs inside a VM step by step
while monitoring the CPU workload on the host.

The CPU load screenshots further down were taken from perfmon on a WS2012 host where SMT
was turned on. The server had 8 cores and due to SMT 16 logical processors. The server also had
two NUMA nodes  ->  4 cores / 8 threads each. The SAP test running inside a VM ( guest OS was
Windows 2008 R2 ) was absolutely CPU-bound. The scenario looked like this :

a, the test started with two Virtual processors ( VP ) and the workload was increased until both VPs
were 100% busy

b, then the number of VPs was increased to four to see if it was possible to double the
workload. Scalability was very good in this case because the workload could still be
distributed over all four cores in one single NUMA node of the host server

c, but going from 4 VPs to 6 VPs changed the picture. Hyper-V has improved NUMA
support and per default sets max VPs per NUMA node to the # of Logical Processors.
( LP ) of the NUMA node ( 8 on the test Hardware ).
And as 6 VPs is still < 8 the whole workload of the VM still ended up on one single NUMA
node. On the other side due to SMT it was no longer possible to achieve an almost 1:1
VP-to-physical-core mapping. This is a situation where you will see still an improved
throughput compared to four VPs but it’s far away from linear scalability we achieved when
going from 2 VPs to 4 VPs.

Keep in mind that it’s NOT possible to configure processor affinity on Hyper-V to achieve
a fixed VP-physical-core mapping. But setting the “reserve” value in WS2012 Hyper-V
Manager to 100 has basically the same effect. See also the blog from Ben Armstrong :

d, next step was to adapt the setting for the VM in Hyper-V Manager. It allows to define max
VPs per NUMA node. Setting this value to four forced Hyper-V to distribute the workload
over two NUMA nodes when using 6 VPs in the VM. Now it was again possible to achieve
basically a 1:1 VP-to-physical-core mapping. Scalability looked fine and because it was
totally CPU-bound the disadvantage of potentially slower memory access didn’t matter.
The advantage of getting more CPU power outweighed the memory access penalty by far.

The following pictures and screenshots will visualize the four items above :


Figure 1 : as long as SMT is turned off and a VM won’t span multiple numa nodes the virtual processors
will be mapped to the cores of one single numa node on the physical host


Figure 2 : once SMT is turned on the Virtual Processors of a VM will be mapped to Logical Processors
on the physical host. By Default WS2012 Hyper-V Manager will set the maximum # of Virtual
Processors per numa node according to the hardware layout. In this example it means a max
of 8 Virtual Processors per numa node

Figure 3 : configuring 4 Virtual Processors in a VM while SMT is turned on means that these 4 VPs
will be mapped to 8 Logical Processors on the physical host. This allows the OS/Hypervisor
to make sure that the workload will be distributed over all 4 physical cores in an optimal way
similar to having SMT turned off

Figure 4 : perfmon showed that the workload which kept four virtual processors busy inside a VM was
distributed over eight Logical processors on four cores within one NUMA node on the
physical host


Figure 5 : what happens when adding two additional Virtual Processors inside the
single VM ? Because 6 VPs is still less than the default setting of a max
of 8 VPs per single numa node the whole workload will be still mapped
to 8 Logical Processors which correspond to 4 cores within one numa

Figure 6 : increasing the workload the same way as before when going from two virtual processor to
four VPs by configuring six VPs inside the VM caused a super-busy single NUMA node using
almost all the threads 100%. Means each of the single physical cores of this NUMA node had
to engage more severly the two SMT threads it represented to the OS/Hypervisor. Therefore
the scalability for going from four VPs to 6 VPs looked not great compared to going to four
VPs from two VPs.

Figure 7 : the default setting regarding # of virtual processors per numa node in WS2012
Hyper-V Manager can be changed. Setting the number low enough will force
the Hypervisor to use more than one numa node




Figure 8 : changing the “max VPs per NUMA node” setting in Hyper-V Manager ( 2012 ) to four
forced Hyper-V to use the second NUMA node. This allowed again basically a 1:1
VP-to-physical-core mapping and scalability looked fine again
Conclusion :

The references as well as the experiences shown make it obvious that the effects of SMT are related
to sizing and configuration of SAP deployments as well as to set expectations and SLAs accordingly.

It is proven that with having SMT configured on a Hyper-V host or on a SAP bare metal deployment,
the overall throughput of a specific server is increasing including the power/throughput ratio. Both
are usually the goals we follow when specifying hardware configurations for SAP deployments.

In terms of using SMT for Hyper-V hosts, one clearly needs to define the goals of deploying SAP
components in VMs. Is the goal again to maximize the available capacity of servers, then having
SMT enabled is the way to go. Means one would deploy as many VPs as there are Logical Processors
on the host server and accept that there might be performance variations dependent on the load over
all VMs or the fact that a VM has more VPs than the # of physical cores in one NUMA node of the host
server. SLAs towards the business units would then take such variations into account.

Walk-through TTHS – Tray Table Hyper-Seating


One thing which will be repeated again and again in all the articles about SMT is the fact that a
CPU thread is NOT equal to a core. To visualize this specific point and to make it easy to remember
I would like to compare SMT with TTHS – Tray Table Hyper-Seating as shown on the following
six Pictures :


Figure 1 :  you have four comfortable seats and four passengers. Everyone is happy.


Figure 2 :  now you want to get more than four passengers into the car and the idea is to introduce
TTHS – Tray Table Hyper Seating. This will allow to put two passengers on one seat. But
it’s pretty obvious that it’s not so comfortable anymore. Especially one of the two
passengers cannot enjoy the cozy seat surface.

Figure 3 :  therefore the driver should be smart enough to let passengers enjoy the cozy seat surface
as long as seats are available despite the fact that TTHS is turned on

Figure 4 :   at some point though when you want to put six passengers into the 4-seat car two of them
have to get on the TTHS spots. This is when issues might evolve


Figure 5 :  of course one could turn TTHS off again and share two seats the traditional way. While this
might work too it’s very obvious that it’s not perfect


Figure 6 :  conclusion :  if it’s a hard requirement that every passenger has his own seat to fully enjoy
the cozy seat surface then there is no other way than to take a different car with an
approrpiate number of seats

How authentication works in Duet Enterprise 2.0

How authentication works in Duet Enterprise 2.0

Duet Enterprise 2.0 stores all business processes and data in the SAP system while letting SharePoint users access the processes and data from SharePoint websites and Outlook 2013. Because SAP and SharePoint authenticate users differently, Duet provides a single sign-on authentication model that authenticates each user individually.

It’s helpful to understand the following things before you look at the overall authentication process.

  • A user logs on to SharePoint by using their SharePoint user identity. This can be either forms-based authentication or credentials stored in Active Directory Domain Services (AD DS), but is typically associated with a user account stored in AD DS.
  • The SAP environment can’t authenticate a user’s SharePoint identity. Instead, a Duet Enterprise component installed on the SharePoint Server 2013 farm swaps the user’s Windows credentials for a user certificate that SAP NetWeaver uses to authenticate the user. When Duet Enterprise 2.0 is installed, the SAP administrator creates a trust relationship with the DuetRoot Certificate (an X.509 Root Authority certificate), which is stored in the SharePoint Secure Store Service. This certificate is used to create a certificate for each individual user on the fly.
  • Information in an SAP environment can’t be secured with Windows credentials or SharePoint credentials (which in this case would be the user’s SharePoint identity). Instead, information is secured in SAP using SAP user accounts. When deploying Duet Enterprise 2.0, an SAP administrator maps each SharePoint user account to a unique SAP user. This way, a user who logs into a SharePoint website can access data that’s stored in SAP without getting an extra login prompt.

The following picture shows a high-level view of authentication flow in a Duet Enterprise 2.0 environment. It shows the steps that occur when a SharePoint user accesses SAP information from a SharePoint site.

Tip Tip:
To see this picture and the following list that describes the process without having to scroll, download the Authentication flow in Duet Enterprise 2.0 poster.


Figure: Duet Enterprise 2.0 authentication

Secure objects in SharePoint by using SAP rolesThe following list describes the steps shown in the preceding picture. This picture assumes that a SharePoint user has requested data that’s stored in the SAP environment.

A.   A user logs on to a Duet Enterprise 2.0-enabled SharePoint website using his SharePoint user identity. Because the website contains an external list or Web Part that surfaces SAP data, the request is sent to the Business Connectivity Services runtime in the SharePoint farm.

B.   The Business Connectivity Services runtime invokes the Duet Enterprise 2.0 OData Extension Provider.

C.   The Duet Enterprise 2.0 OData Extension Provider gets the DuetRoot Certificate from the Secure Store.

D.   The Duet Enterprise 2.0 OData Extension Provider uses the DuetRoot Certificate to create an X.509 user certificate and sends the certificate to the Business Connectivity Services runtime.

E.   The Business Connectivity Services runtime sends the request with the user certificate to the SAP NetWeaver Gateway component of SAP NetWeaver in a request packet.

Tip Tip:
SAP NetWeaver with the SAP NetWeaver Gateway component installed is also known as SAP NetWeaver Gateway.


F.   Because SAP NetWeaver trusts the DuetRoot Certificate that was used to create the user certificate, SAP NetWeaver can authenticate the user and look up the SAP user who is mapped to the SharePoint user who is identified by the certificate.

G.   The SAP user account that’s mapped to the SharePoint user is returned to SAP NetWeaver.

H.   SAP NetWeaver uses the SAP user account to request access to the requested information in the SAP system and, if the user is authorized to access the information, the requested information is sent to SAP NetWeaver Gateway.

I.   SAP NetWeaver Gateway sends the reply as a response packet to the Business Connectivity Services runtime on the on-premises SharePoint farm.

J.   The Business Connectivity Services runtime passes the information to the SharePoint user. In this case, to the website from which the user has requested the information.

note Note:
The two-way connection between the SharePoint Server farm and SAP NetWeaver is secured by using two Secure Sockets Layer (SSL) certificates. One certificate is bound to a SharePoint web application and trusted by the SAP administrator. The other certificate is bound to SAP NetWeaver and trusted by the SharePoint administrator.


Using SAP roles to access SharePoint objects

In the enterprise, the tasks that a user does are usually related to that user’s role. Because of this, it’s handy to grant permissions to resources, such as list items, websites, and documents, based on SAP roles. Conceptually, SAP roles are like SharePoint groups except that they’re created and managed in SAP.

In SAP NetWeaver, users are assigned one or more roles, such as Sales Representative, Project Manager, Executive, and Human Resources Specialist. SAP roles can be broad, such as All Sales Managers, or narrow, such as Sales Managers Eastern Region.

In Duet Enterprise 2.0, these SAP roles can be used to grant permissions in SharePoint Server. Anything you can set permissions on in SharePoint Server can be assigned permissions using SAP roles.

This includes objects directly related to Duet Enterprise 2.0, such as SAP reports, external lists, actions on external content types, and any general and securable SharePoint Server objects, such as websites or document libraries.

After a role is granted permissions to an object, any user who is assigned that role will then have permissions to use that object.

If you remember nothing else about RoleSync, remember that SAP NetWeaver admins assign SAP users to roles and they also assign SharePoint users to SAP users. This effectively assigns one or more SAP roles to SharePoint users.

Duet Enterprise 2.0 uses the Duet Enterprise Profile Synchronization Timer Job feature to bring the user role assignments from the SAP system into the SharePoint user profile store. Duet Enterprise 2.0 also uses the Duet Enterprise Claims Provider to help manage the role-based permissions to securable objects in SharePoint Server.

note Note:
Think of role synchronization as a one-way street. Users’ roles that are defined in the SAP system are brought into the SharePoint user profile store. No properties in the SharePoint user profiles are sent from SharePoint back to SAP.


During role synchronization, the set of SAP users is imported into the SharePoint user profile store by using Business Connectivity Services. For each SAP user who has a related user profile in SharePoint, all of the SAP roles assigned to that user are listed in the user profile store.

Role synchronization connects from SharePoint Server to an external system on the SAP side named “SAPUsersService.” This external system sends the user-to-roles mappings to the SharePoint user profile store.

After role synchronization is completed, you’ll see a new field, called SAP Roles at the bottom of the User Profile page. The SAP roles assigned to the user are separated by semicolons.

SAP Roles as seen on a User Profile page.

SAP Roles as seen on a User Profile page in SharePoint.Role synchronization is typically scheduled to be run on a schedule by using the Duet Enterprise Profile Synchronization Timer Job. You decide how often to synchronize roles and how many users to import at a time.

After roles are synchronized with the SharePoint user profile store, users and administrators can grant access to SharePoint securable objects using the SAP roles. Before this capability is available, a SharePoint farm administrator needs to activate the Duet Enterprise SAP Roles Claims Provider feature at the farm level which makes the claims provider available.

note Note:
When a user’s role is changed in the SAP system, the change can take some time (up to 10 hours) to be propagated to the SharePoint system. This might temporarily prevent users from being authorized if their roles have changed since the last sync job.

2 Great Books to start with for Developers who want to learn SAP NetWeaver


In this blog i want to show you some good books which i recommend for Developers looking to specialise in SAP NetWeaver

SAP NetWeaver: The Official Guide

Link to SAP Press

All you want to know about SAP NetWeaver can you read in this book, it is a must for beginners. Learn on 4 detailed Customer examples which technologies can be included in NetWeaver. This book is mostly theoretically, there is no difficult program code included. If you want to program stuff for SAP NetWeaver, first read this book to understand what NetWeaver can do.

Developer’s Guide to SAP NetWeaver Portal Applications

Link to SAP Press

Developing Components for SAP NetWeaver Portal is not an easy task. If you want to know how to do this, i recommend this book. For a quick-start head to chapter 10, there are some good examples with many screenshots and good instructions. You learn to work with the SAP NetWeaver Developer Studio, create Components and deploy them to the SAP NetWeaver Portal.

Why integrate SAP with SharePoint? Find out why!

Mobile First…

Probably everyone has heard of “Mobile first”. This concept is not only something that SAP is promoting (Going Mobile at SAP), but also partners, customer and analysts like Gartner  or Forbes are clearly supporting this strategy.

The concept and idea are very clear: if you design applications to run on a mobile device with its small screen, then everything — the whole user interfacce — has to be simple and intuitive.

One of the most prominent examples of this strategy is SAP Fiori. Based on SAPUI5 beautiful and intuitive applications are created and extremely well accepted by our customers.


… does not mean mobile only

In a customer presentation that I attended some time ago I also heard this feedback. SAP Fiori is an extremly powerful step by SAP to address workers across devices: whether they work on a mobile, tablet or desktop. However, the customer continued saying:

“Mobile is sexy, but only 5% of our workers are using mobile devices (for their jobs). The majority of my users are still using a desktop”.

I thought of this as a very interesting statement. Obviously I am also using a mobile device, but looking at a “Day in my life”, I start with using my mobile device, but then I use lots of other different technologies to interact with SAP data — and in a lot of cases these different technologies are powered somehow by Microsoft.

“Don’t forget the desktop”


Still the data that I am accessing when working on my desktop is very often the same as the data which I need to access from my mobile device. So I would need to get SAP data in the tools that are running on my desktop.  And the desktop still is dominated in great numbers by Microsoft. Depending on which numbers you want to believe Windows is installed on 70% to 90% of desktops and Microsoft Office is running on over 1 billion devices world wide and is used in most organizations:


Having this in mind it is clear that “Mobile first does not mean mobile only

Why don’t we take the concept and ideas — and actually the applications and scenarios — and make them available on the Microsoft desktop?

Using SAP data from within Microsoft Office

When you get a Purchase Order or Credit Memo and you are sitting in front of your Microsoft Outlook already writing an email — wouldn’t it be great to get this workflow directly as a Task in Outlook and be able to approve it from there?


For the business partners, that you just worked with on your tablet in you SAP Fiori application  — wouldn’t it be beneficial to have the very same contacts in your Microsoft Outlook?


Similar with the tracked time that you just viewed in your SAP Fiori My Timesheet app on your mobile device — wouldn’t it be good to have these dates also in your Microsoft Outlook Calendar?


94% of companies use Microsoft Office

Similar to Microsoft Windows, Microsoft Office is still the dominant productivity suite at our customers. Not necessarily always the latest and greatest version, but definitely Microsoft Office. So in addition to having the power and flexibility of SAP Fiori an integration in Microsoft Office would absolutely make sense. We could not only offer an additional user interface by bringing SAP data to known and used Microsoft UIs, but also improve user productivity by keeping the end-user in the UI that they are currenlty working with.

Going beyond these existing scenarios it can also make a lot of sense to empower the users to interact with data from SAP in a way they are already used to. When you think of mass data manipulation probably Microsoft Excel comes into your mind. So again this Microsoft based UI / tool could be the perfect choice for the end-users to work with data from SAP.


The challenges in integrating SAP to MSFT world

All these integrations have one fundamental problem. You have to make sure that the integration, the interoperability between these known applications and data from SAP is easy, quick and secure. A recent study by IDC stated that more and more hobby developers build applications. Developing applications is getting easier and easier with impressive and powerful tools such as Visual Studio. However, developing and designing applications for life can be complicated. Gartner looked at the overall total cost of ownership of such applications. A very important factor to the total cost of ownership is the very first design of the application. How easily is the data consumed? How flexible is the application? How are security concerns like SSO, tracing, monitoring and scalability aspects handled?

Keeping the hobby developers in mind and also surveys that show that only very few developers have security and “enterprise ready” know-how this is an issue.

Nexus of forces

The “nexus of forces” which Gartner started to highlight some time ago is a similar example of this. To quote:

“The Nexus of Forces is the convergence and mutual reinforcement of social, mobility, cloud and information patterns that drive new business scenarios. Although these forces are innovative and disruptive on their own; together they are revolutionizing business and society, disrupting old business models and creating new leaders. The Nexus is the basis of the technology platform of the future.”


This technology platform needs a basis that not only addressed these forces, but also makes sure this is done in a secure and enterprise compliant / ready manner.

SAP NetWeaver Gateway productivity accelerator for Microsoft!

Luckily this is exactly what SAP NetWeaver Gateway productivity accelerator for Microsoft addresses with the interoperability framework between SAP and Microsoft. The Microsoft developer can stick to their knowledge. They can build applications for Microsoft Outlook, for Excel, for any .NET based application. They can be hobby developers from the business who “just” leverage templates and tools from Visual Studio to build beautiful applications — SAP NetWeaver Gateway productivity accelerator for Microsoft takes care of the interoperability and enterprise ready aspects.

It gives IT the confidence and security that SAP NetWeaver Gateway productivity accelerator for Microsoft based applications adhere to certain design-patterns, leverage company wide security and supportability requirements. And help applications to be scalable from the very first POC for a few business users to the final roll-out to 10,000 users.

With this framework the business is all of sudden empowered to respond to critical changes in the workplace at their own speed. They don’t have to rely on IT to help — because IT has already provided the required framework to make these changes happen.

Optimizing the investments in Microsoft and SAP by providing a bridge that brings the two worlds together SAP NetWeaver Gateway productivity accelerator for Microsoft boosts workplace agility. This engagement initiative provides the business the flexibility they need to leverage existing skills, while still complying with corporate and IT regulations.