Hybrid self-service BI: balancing on-premises universes with cloud analytics

We’re implementing a hybrid BI strategy that combines our established on-premises Crystal Reports infrastructure with SAP Analytics Cloud for modern self-service analytics. The challenge is maintaining governance while enabling business users to create their own visualizations.

Our current setup includes 40+ legacy UNV universes built over years, supporting hundreds of Crystal Reports. We want to gradually migrate to UNX format for SAC connectivity while keeping existing reports functional. The goal is letting power users build dashboards in SAC using live connections to our on-prem data, but we’re concerned about losing the data governance and security layers built into our universes.

Has anyone successfully implemented this hybrid approach? Particularly interested in experiences around universe conversion timelines, managing user permissions across both platforms, and maintaining consistent business logic between Crystal Reports and SAC models.

Don’t underestimate the authentication complexity with live connections. We had issues with SAC service accounts not properly inheriting universe security contexts. The connection uses a technical user, but universe row-level security needs to pass through the actual SAC user identity. This requires proper SSO configuration and universe security mapping. Test extensively with different user personas before rolling out broadly.

That’s the biggest pain point honestly. Report-level formulas don’t migrate automatically. We took it as an opportunity to standardize - moved all reusable business logic into the UNX universes as derived dimensions and measures. Yes, it meant refactoring reports, but now the same calculations are available consistently in both Crystal and SAC. We prioritized high-value reports first and ran parallel reporting for validation during the transition period.

The tiered approach makes sense. How did you handle the situation where business logic exists in both Crystal formulas and universe objects? We have calculations that were built directly into reports rather than being defined at the universe level. Are we looking at essentially rebuilding that logic in SAC stories?

We went through this exact migration last year. The UNV to UNX conversion is more complex than it seems - not all universe features translate directly. Row-level security contexts and some complex derived tables required manual rework. We used the Universe Design Tool’s conversion wizard as a starting point, but plan for significant testing and adjustment time. Budget at least 2-3 weeks per complex universe for conversion, validation, and user acceptance testing.

From a governance perspective, the key is establishing clear user roles before enabling SAC access. We created three tiers: Report Consumers (Crystal only), Power Users (SAC with pre-built models), and Data Modelers (can modify universes). The live connectivity setup in SAC requires careful firewall configuration and service account management. Make sure your security team understands that SAC will be making direct connections to your on-prem environment - that raised flags in our organization initially.