Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Configure your SAP system for the Microsoft Sentinel solution

4 September 2026Doc update+58 / −119 lines

In brief

The article description and content were streamlined by removing connection-agent sections, agent installation references, role-creation procedures, and SNC connection guidance. The user section was renamed to focus on creating an SAP user for the Microsoft Sentinel role.

What Defender admins need to know

Administrators will find a shorter, connection-focused preparation guide; no required configuration change or deadline is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure your SAP system for the Microsoft Sentinel solution

This article describes how to prepare your SAP environment for connecting to the SAP data connector. Before you begin, make sure you've reviewed the prerequisites for deploying the Microsoft Sentinel solution for SAP applications. Preparation differs, depending on whether you're using the containerized data connector agent. Select the option at the top of the page that matches your environment.

:::zone pivot="connection-agent" This article is part of the second step in deploying the Microsoft Sentinel solution for SAP applications.

[!INCLUDE data-connector-agent-deprecation]

:::image type="content" source="media/deployment-steps/prepare-sap-environment.png" alt-text="Diagram of the deployment flow for the Microsoft Sentinel solution for SAP applications, with the preparing SAP step highlighted." border="false":::

The procedures in this article are typically performed by your SAP BASIS team. :::zone-end

:::zone pivot="connection-agentless" This article is part of the second step in deploying the Microsoft Sentinel solution for SAP applications. While steps that are performed in Microsoft Sentinel require that the solution be installed first, other preparations in the SAP environment can happen in parallel.

:::image type="content" source="media/deployment-steps/prepare-sap-environment-agentless.png" alt-text="Diagram of the deployment flow for the Microsoft Sentinel solution for SAP applications, with the preparing SAP step highlighted." border="false":::

Many of the procedures in this article are typically performed by your SAP BASIS team. Some steps include your security team too. :::zone-end

Prerequisites

:::zone-end

Configure the Microsoft Sentinel role

To allow the SAP data connector to connect to your SAP system, you must create an SAP system role specifically for this purpose.

:::zone pivot="connection-agent"

We recommend creating this role by deploying the NPLK900271 SAP change request (CR): K900271.NPL | R900271.NPL

Deploy the CRs on your SAP system as needed just as you'd deploy other CRs. We strongly recommend that deploying SAP CRs is done by an experienced SAP system administrator. For more information, see the SAP documentation on deploying transport change requests.

Alternately, load the role authorizations from the MSFTSEN_SENTINEL_CONNECTOR file, which includes all the basic permissions for the data connector to operate.

Experienced SAP administrators might choose to create the role manually and assign it the appropriate permissions. In such cases, create a role manually with the relevant authorizations required for the logs you want to ingest. For more information, see Required ABAP authorizations. Examples in our documentation use the /MSFTSEN/SENTINEL_RESPONDER name.

When configuring the role, we recommend that you:

  • Generate an active role profile for Microsoft Sentinel by running the PFCG transaction.
  • Use /MSFTSEN/SENTINEL_RESPONDER as the role name.

:::zone-end

:::zone pivot="connection-agentless"

Create a role using the MSFTSEN_SENTINEL_READER template, which includes all the basic permissions for the data connector to operate.

:::zone-end

For more information, see the SAP documentation on creating roles.

Create aan SAP user for the Microsoft Sentinel role

The Microsoft Sentinel solution for SAP applications requires a user account to connect to your SAP system. When creating your user:

:::zone pivot="connection-agent"

:::zone pivot="connection-agentless"

For more information, see the SAP documentation on creating user accounts.

Configure SAP auditing

:::zone pivot="connection-agentless" For full monitoring coverage with the agentless data connector, we recommend that you enable monitoring on all client IDs of your monitored SAP systems, including clients 000 and 066. :::zone-end

For more information, see Analysis and recommended settings of the Security Audit Log (SM19/RSAU).

Configure your system to use SNC for secure connections

By default, the SAP data connector agent connects to an SAP server usingconnectors use a remote function call (RFC) connection and a username and password for authentication.to authenticate to the SAP system.

However, you might need to makeTo encrypt the RFC connection on an encrypted channel or use client certificates for authentication. In these cases, usecertificate-based authentication, configure SAP Smart Network Communications (SNC) from SAP to secure. Work with your data connections, as described in this section.

In a production environment, we strongly recommend that your consult with SAP administrators and your organization's public key infrastructure (PKI) team to create a deployment plan the SNC configuration. Follow SAP guidance for configuring SNC. the SAP components, certificates, and trust relationships in your environment.

Before you configure the Microsoft Sentinel connection:

For the agentless data connector, configure SNC in SAP Cloud Connector. For more information, see SAP KBA 3536285: SAP Cloud Connector - How to set up general SNC settings for SAP Cloud Connector.

If you use SAP Cloud Connector high availability, also validate SNC after switching to the shadow instance.

For more information, see the SAP documentation on configuring SNC.

When configuring SNC:

  • If the client certificate was issued by an enterprise certification authority, transfer the issuing CA and root CA certificates to the system where you plan to create the data connector agent.
  • If you're using the data connector agent, make sure to also enter the relevant values and use the relevant procedures when configuring the SAP data connector agent container. If you're using the agentless data connector, the SNC configuration is done in the SAP Cloud Connector.

For more information about SNC, see Getting started with SAP SNC for RFC integrations.

:::zone pivot="connection-agent"

Configure support for extra data retrieval (recommended)

While enabling extra data retrieval is optional, we recommend that you enable the SAP data connector to retrieve the following content information from your SAP system:

  • DB Table and Spool Output logs
  • Client IP address information from the security audit logs

  1. Deploy the relevant CRs from the Microsoft Sentinel GitHub repository, according to your SAP version:

    | SAP BASIS versions | Recommended CR | | --- | --- | --- | | 750 and higher | NPLK900202: K900202.NPL, R900202.NPL

    When deploying this CR any of the following SAP versions, also deploy 2641084 - Standardized read access to data of Security Audit Log:
    - 750 SP04 to SP12
    - 751 SP00 to SP06
    - 752 SP00 to SP02 | | 740 | NPLK900201: K900201.NPL, R900201.NPL |

    Deploy the CRs on your SAP system as needed just as you'd deploy other CRs. We strongly recommend that deploying SAP CRs is done by an experienced SAP system administrator. For more information, see the SAP documentation on deploying transport change requests.

    For more information, see Analysis and recommended settings of the Security Audit Log (SM19/RSAU) and the SAP documentation.

  2. To support SAP BASIS versions 7.31-7.5 SP12 in sending client IP address information to Microsoft Sentinel, activate logging for SAP table USR41. For more information, see the SAP documentation.

Verify that the PAHI table is updated at regular intervals

The SAP PAHI table includes data on the history of the SAP system, the database, and SAP parameters. In some cases, the Microsoft Sentinel solution for SAP applications can't monitor the SAP PAHI table at regular intervals, due to missing or faulty configuration. It's important to update the PAHI table and to monitor it frequently, so that the Microsoft Sentinel solution for SAP applications can alert on suspicious actions that might happen at any time throughout the day. For more information, see:

If the PAHI table is updated regularly, the SAP_COLLECTOR_FOR_PERFMONITOR job is scheduled and runs hourly. If the SAP_COLLECTOR_FOR_PERFMONITOR job doesn't exist, make sure to configure it as needed.

For more information, see Database Collector in Background Processing and Configuring the Data Collector.

:::zone-end

:::zone pivot="connection-agentless"

Configure SAP BTP settings

  1. Create an instance of the SAP Process Integration Runtime in your subaccount using service plan integration-flow (not API!).

  2. CreateAfter verifying that the cloud integration capability is activated, create a service key for the SAP Process Integration Runtime and save the JSON contents to a secure location. You must activate the cloud integration capability before creating a service key for SAP Process Integration Runtime.

For more information, see the SAP documentation on Initial Setup of SAP Integration Suite.

  1. In the Configuration section, expand and follow the instructions in the Initial connector configuration - Run the steps below once: section. These steps will require both your SecuritySOC engineer and the SAP admin.

    1. Trigger automatic deployment of Azure resources (SOC Engineer). If, after you deploy the Azure resources, the values in the steps 2 and 3 aren't automatically populated, close and re-expand step 1 to refresh the values in steps 2 and 3.

    2. Deploy an OAuth2 client credentials artifact in the SAP Integration (SAP Admin).

    3. Deploy the SAP agentless data connector package to the SAP Integration Suite (SAP Admin). This procedure is performed from the SAP Integration Suite portal (SAP Cloud Integration Web UI).

      1. Open the Discover section.

  2. Add new resources to the system mapping for each of the following function names:

    • RSAU_API_GET_LOG_DATA, to fetch SAP security audit log data

    • BAPI_USER_GET_DETAIL, to retrieve SAP user details

    • RFC_READ_TABLE, to read data from required tables

    • SIAG_ROLE_GET_AUTH, to retrieve security role authorizations

    • /OSP/SYSTEM_TIMEZONE, to retrieve SAP system timezone details

  1. Add a new destination in SAP BTP that points the virtual host you'd created earlier. Use the following details to populate the new SAP BTP RFC destination for Microsoft Sentinel:

    • Name:Name: Enter the name you want to use for the Microsoft Sentinel connection

    • Type: RFC

    • Proxy Type:Type: On-Premise

    • User: Enter the ABAP user account you created earlier for Microsoft Sentinel

    • Authorization Type:Type: CONFIGURED USER

    • Additional properties:properties:

      • jco.client.ashost = <virtual host name>

      • jco.client.client = <client e.g. 001>

      • jco.client.sysnr = <system number = 00>

      • jco.client.lang = EN

    • Location: Only required when you connect multiple Cloud Connectors to the same BTP subaccount. For more information, see the SAP documentation on parameters influencing communication behavior.

Run the prerequisite checkerOptimize SAP Cloud Connector sizing, throughput, and isolation

Run the prerequisite checker to validate that yourDefault SAP systemCloud Connector settings suit most environments. Tune it before you go live when Microsoft Sentinel ingestion is ready for integrationhigh volume, bursty, or shares an SAP Cloud Connector with Microsoft Sentinel.other integrations.

  1. OnConfirm sizing for the Sentinel portal, scroll further down in the Configuration area,Cloud Connector master instance: Sizing for master instance.

  2. If SAP Cloud Integration (CPI) reports IOError on tunnel socket during connect attempt, use SAP note 3403815 to tune throughput and expand and follow the instructions in the Add monitoredrequest limits.
  3. Enable runtime monitoring: Cloud Connector monitoring.
  4. Recover stale or stuck SAP Systems - Run the steps below for each monitoredCloud Connector sessions by following SAP system: area for each SAP system you want to monitor.

    In the Add monitored SAP Systems wizard in Microsoft Sentinel, at the step named Connect SAP System to Microsoft Sentinel / SOC Engineer, continue with Connect your SAP system to Microsoft Sentinelnote 2485510.

Run the prerequisite checker

Run the prerequisite checker to validate that your SAP system is ready for integration with Microsoft Sentinel.

  1. On the Sentinel portal, scroll further down in the Configuration area, and expand and follow the instructions in the Add monitored SAP Systems - Run the steps below for each monitored SAP system: area for each SAP system you want to monitor.

    In the Add monitored SAP Systems wizard in Microsoft Sentinel, at the step named Connect SAP System to Microsoft Sentinel / SOC Engineer, continue with Connect your SAP system to Microsoft Sentinel.

:::zone-end

Next step

[!div class="nextstepaction"] Connect your SAP system to Microsoft SentinelConnect your SAP system to Microsoft Sentinel