Hybrid Integration Case Studies: Microsoft + SAP, Salesforce, Snowflake

Situation

A Fortune 100 discrete manufacturer with 75,000 employees ran a mature Microsoft 365 estate (M365 E5, Defender XDR, Purview, Teams Premium) alongside a global SAP S/4HANA instance covering finance, supply chain, plant maintenance, and quality. Microsoft 365 Copilot had been licensed for an initial 8,000 commercial seats — but the legal and compliance steering committee had flagged the rollout as paused: "Copilot is not allowed to ground on SAP transactional data until we can prove the controls."

Complication

Three controls problems sat in the way. First, SAP role-based access (PFCG roles, organizational levels, derived authorizations) did not natively project into Microsoft sensitivity labels — so Copilot grounding on SAP master data risked surfacing financial actuals to commercial users. Second, plant-level quality records contained data subject to multiple regimes (SOX, MNPI windows around quarterly close, and EU GDPR for European plants). Third, the SAP CoE had been burned twice in the past by Power BI gateways pulling transactional data directly out of S/4HANA during business hours — performance impact had been measurable on the order entry workflow.

Resolution

EPC Group architected a three-layer integration. (1) Microsoft Fabric mirrored S/4HANA via the SAP-on-Fabric mirroring connector — zero-copy, near-real-time, no impact on the source ERP. The mirror became the analytics and AI plane. (2) Purview sensitivity-label inheritance: every mirrored entity carried labels derived from SAP authorization objects and from named regulatory regimes (SOX-restricted, MNPI-window, GDPR-EU). Labels flowed through Fabric semantic models into Power BI datasets and into Copilot grounding boundaries. (3) Copilot grounding was scoped via the Microsoft Graph connector framework so that prompts could only resolve against entities the prompting user was already entitled to view in SAP — enforced by the same authorization objects, not by a parallel permissions model. The senior architect who scoped the work stayed accountable through Wave 3 production cutover and the first 90 days of managed operations.

Outcome

Twelve-week implementation. Copilot grounding on SAP master and transactional data shipped to the original 8,000 commercial seats under named sensitivity controls, with Purview audit logs proving every grounded response could be traced back to the user’s SAP authorization. SOX testing accepted the controls evidence in the first audit cycle. The SAP CoE’s order entry workflow showed no measurable performance degradation across the four-quarter window post-cutover. The legal hold on Copilot was formally lifted at the Wave 3 steering committee.

Situation

A Fortune 50 multi-state health insurance payer ran Salesforce Health Cloud for member services, broker engagement, and provider onboarding — and Dynamics 365 (Sales and Customer Service) for the commercial group benefits motion and claims escalation. Microsoft 365 was the productivity layer for 28,000 employees. Two prior integrations had been attempted by other partners: an early MuleSoft batch sync that drifted by hours and was decommissioned, and a Salesforce-built point-to-point that lost identity context whenever a member changed plans mid-year. The current state was a manual reconciliation team of seven full-time analysts.

Complication

Three controls problems again. First, the integration had to be bidirectional and near-real-time — member updates initiated in Salesforce had to land in Dynamics 365 within the same business hour, and vice versa, with deterministic conflict resolution. Second, identity had to be bridged: members authenticated against Microsoft Entra B2C, brokers against Salesforce Experience Cloud, and internal employees against Entra ID — and the integration could not require a separate set of credentials. Third, every field carried HIPAA-covered data and a defined retention regime. PHI could not be replicated into intermediate Power Automate run logs, into Dataverse staging tables, or into Application Insights traces.

Resolution

EPC Group architected a bidirectional sync via Power Automate flows backed by a Dataverse change-data-capture pattern, with Salesforce Platform Events on the inbound side. Conflict resolution was deterministic — last-writer-wins for fields scoped to a single system of record, manual queue for fields contested across systems. Entra B2C was federated with Salesforce Experience Cloud via SAML so member SSO worked transparently; internal employees used Entra ID SSO into both CRMs. Purview sensitivity labels were applied at the field level, not just the record level, so a Power Automate run log could carry the existence of a transaction without ever materializing the PHI payload — payloads stayed encrypted in transit and at rest, with audit-only metadata in run history. The Fabric semantic layer above both CRMs produced one member 360 view that drove the analytics, Power BI dashboards, and Copilot grounding for member-services agents.

Outcome

Sixteen-week implementation. The manual reconciliation team of seven analysts was redeployed to higher-value casework. Member-services agents had a single 360 view that spanned Salesforce, Dynamics 365, claims, and the Fabric data plane — surfaced in either CRM through embedded canvas apps. HIPAA audit signed off on the integration in the first quarterly review. Average handle time on member-services calls dropped by an internally significant margin (not quoted here because the client treats it as competitive information), and member-reported satisfaction with first-contact resolution improved measurably in the post-cutover survey window.

Situation

A Fortune 100 commercial bank had standardized on Snowflake as its enterprise data warehouse over the preceding six years — billions of rows across credit risk, trading book, treasury, and customer 360 domains. Power BI was the primary BI tool with thousands of analyst seats. A Microsoft Fabric pilot had been chartered to evaluate Direct Lake performance for Power BI and grounding for Copilot in M365 — but the constraint was absolute: Snowflake remained the authoritative source. Legal had a standing position that bulk replication of regulated data into a second warehouse was a discovery and litigation-hold problem they would not accept.

Complication

Three controls problems, more pointed than the previous two engagements. First, model risk: the bank was governed by SR 11-7 (the FRBNY (Federal Reserve Bank of New York)’s model risk management guidance) and any analytics surface that grounded Copilot in financial outputs needed traceable lineage from input to prompt to response. Second, no-copy was a hard constraint — the legal department’s position prevented mirrored extracts in motion as well as at rest unless the mirror was demonstrably ephemeral, point-in-time consistent with Snowflake, and never an independently queryable replica outside the Snowflake security perimeter. Third, the existing Power BI estate had to keep working unchanged during the pilot; senior analyst churn over a query model change would have been politically untenable.

Resolution

EPC Group architected Fabric’s mirroring capability against Snowflake — zero-copy at the data layer, with Snowflake remaining the system of record and the security perimeter. Direct Lake semantic models over the mirror gave Power BI sub-second query performance for the analyst seats. Copilot in M365 was grounded against the Fabric semantic layer with SR 11-7-aligned controls — every grounded response carried lineage metadata back through the semantic model, through the mirror, and to the originating Snowflake object, with audit-traceability the model risk team accepted as evidence. Defender XDR and Purview monitored the cross-cloud boundary. The existing Power BI estate ran unchanged on Import and DirectQuery datasets through the migration; only new datasets were authored against the Direct Lake model.

Outcome

Ten-week implementation. Snowflake remained the authoritative source — the legal department’s position held without compromise. Fabric became the analytics and AI plane. Copilot grounding on credit risk dashboards shipped to a controlled population of 1,200 analyst seats under SR 11-7-aligned controls with model risk sign-off. The Power BI estate was unaffected during the pilot. The bank’s Microsoft Solutions Partner of record on the Fabric workload was EPC Group; the senior architect on the call at scope-out was still the accountable architect at the SR 11-7 model risk review.