To connect to SAP, it is critical that the workflow application be on the same network as the SAP instance, via the VNet integration option under the app's Networking settings. The VNet needs to either have the SAP instance hosted in it or needs to be peered with the VNet hosting the SAP instance. Once the VNet and optional peering is in place, you can validate network connectivity using the Kudu console (called 'Advanced Tools' in the Azure management portal). In this console, use the tcpping command and address the SAP server by either IP address or name (if you have DNS entry for the instance and the DNS is available to the VNet), plus the application service port (default 3200, aka dispatch service port) or gateway service port (default 3300).
C:\home>tcpping 10.0.1.9:3200
Connected to 10.0.1.9:3200, time taken: 77ms
Connected to 10.0.1.9:3200, time taken: 31ms
Connected to 10.0.1.9:3200, time taken: 31ms
Connected to 10.0.1.9:3200, time taken: 31ms
Complete: 4/4 successful attempts (100%). Average success time: 42.5ms
C:\home>tcpping 10.0.1.9:3300
Connected to 10.0.1.9:3300, time taken: 62ms
Connected to 10.0.1.9:3300, time taken: 32ms
Connected to 10.0.1.9:3300, time taken: 36ms
Connected to 10.0.1.9:3300, time taken: 31ms
Complete: 4/4 successful attempts (100%). Average success time: 40.25ms