Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Developer and API

Deploy Data Connector Agent Container

4 September 2026Doc update+0 / −519 lines

In brief

The documentation page for connecting SAP systems to Microsoft Sentinel was deleted, including guidance for both the agent and agentless connector options, prerequisites, and deployment steps.

What Defender admins need to know

Administrators relying on this page may need to use other available guidance for SAP connector deployment and prerequisites. No administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

deleted file mode 100644

title: Connect your SAP system to Microsoft Sentinel | Microsoft Sentinel description: Connect your SAP system to Microsoft Sentinel by deploying the SAP data connector agent or by configuring the agentless SAP data connector. Choose the option that matches your environment. ms.author: monaberdugo author: mberdugo ms.topic: how-to ms.date: 06/12/2026 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ms.collection: usx-security zone_pivot_groups: sentinel-sap-connection ms.custom: msecd-doc-authoring-1014

  • devx-track-azurecli
  • sfi-image-nochange ai-usage: ai-assisted

#Customer intent: As a security, infrastructure, or SAP BASIS team member, I want to connect my SAP system to Microsoft Sentinel so that I can ingest SAP data into Microsoft Sentinel for enhanced monitoring and threat detection.

Connect your SAP system to Microsoft Sentinel

For the Microsoft Sentinel solution for SAP applications to operate correctly, you must first get your SAP data into Microsoft Sentinel. Do this by either deploying the Microsoft Sentinel SAP data connector agent, or by connecting the Microsoft Sentinel agentless data connector for SAP. Use the agent-based procedure if you deploy the SAP data connector agent, or use the agentless procedure if you connect through the agentless data connector.

Before following this article, make sure you've completed the earlier deployment steps: installing the SAP solution in your workspace and preparing your SAP system. For the full list of prerequisites, see the Prerequisites section.

:::zone pivot="connection-agent"

[!INCLUDE data-connector-agent-deprecation]

:::image type="content" source="media/deployment-steps/deploy-data-connector.png" alt-text="Diagram of the SAP solution deployment flow, highlighting the Connect your SAP system step." border="false" :::

Content in this article is relevant for your security, infrastructure, and SAP BASIS teams. Make sure to perform the steps in this article in the order that they're presented.

:::zone-end

:::zone pivot="connection-agentless"

:::image type="content" source="media/deployment-steps/deploy-data-connector-agentless.png" alt-text="Diagram of the SAP solution deployment flow, highlighting the Connect your SAP system step." border="false":::

Content in this article is relevant for your security team.

:::zone-end

Prerequisites

Before you connect your SAP system to Microsoft Sentinel:

:::zone pivot="connection-agent"

Watch a demo video

Watch one of the following video demonstrations of the deployment process described in this article.

A deep dive on the portal options:

[!VIDEO https://www.youtube.com/embed/bg0vmUvcQ5Q?si=hugWYn1wjlq4seCR]

Includes more details about using Azure KeyVault. No audio, demonstration only with captions:

[!VIDEO https://www.youtube.com/embed/TXANRi88mqI?si=D_5TlOlswKW9OSee]

Create a virtual machine and configure access to your credentials

We recommend creating a dedicated virtual machine for your data connector agent container to ensure optimal performance and avoid potential conflicts. For more information, see System prerequisites for the data connector agent container.

We recommend that you store your SAP and authentication secrets in an Azure Key Vault. How you access your key vault depends on where your virtual machine (VM) is deployed:

Deployment methodAccess method
Container on an Azure VMWe recommend using an Azure system-assigned managed identity to access Azure Key Vault.

If a system-assigned managed identity can't be used, the container can also authenticate to Azure Key Vault using a Microsoft Entra ID registered-application service principal, or, as a last resort, a configuration file.
A container on an on-premises VM, or a VM in a third-party cloud environmentAuthenticate to Azure Key Vault using a Microsoft Entra ID registered-application service principal.

If you can't use a registered application or a service principal, use a configuration file to manage your credentials, though this method isn't preferred. For more information, see Deploy the data connector using a configuration file.

For more information, see:

Your virtual machine is typically created by your infrastructure team. Configuring access to credentials and managing key vaults is typically done by your security team.

Managed identity

Create a managed identity with an Azure VM

Perform the following steps to create an Azure VM with a system-assigned managed identity that can authenticate to Azure Key Vault.

  1. Run the following command to Create a VM in Azure, substituting actual names from your environment for the <placeholders>:

    az vm create --resource-group <resource group name> --name <VM Name> --image Canonical:0001-com-ubuntu-server-focal:20_04-lts-gen2:latest --admin-username <azureuser> --public-ip-address "" --size  Standard_D2as_v5 --generate-ssh-keys --assign-identity --role <role name> --scope <subscription Id>

    For more information, see Quickstart: Create a Linux virtual machine with the Azure CLI.

This command creates the VM resource, producing output that looks like this:

```json
{
  "fqdns": "",
  "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/resourcegroupname/providers/Microsoft.Compute/virtualMachines/vmname",
  "identity": {
    "systemAssignedIdentity": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
    "userAssignedIdentities": {}
  },
  "location": "westeurope",
  "macAddress": "00-11-22-33-44-55",
  "powerState": "VM running",
  "privateIpAddress": "192.168.136.5",
  "publicIpAddress": "",
  "resourceGroup": "resourcegroupname",
  "zones": ""
}
```
  1. Copy the systemAssignedIdentity GUID. You need this GUID to assign key vault access permissions and run the deployment script. This is your managed identity.

Registered application

Register an application to create an application identity

  1. Run the following command from the Azure command line to create and register an application:

    az ad sp create-for-rbac

    This command creates the application, producing output that looks like this:

    {
  "appId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
  "displayName": "azure-cli-2022-01-28-17-59-06",
  "password": "ssssssssssssssssssssssssssssssssss",
  "tenant": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
}

    For more information, see the Azure CLI reference documentation.

  2. Copy the appId, tenant, and password from the output. You need these values to assign the key vault access policy and run the deployment script later in this procedure.

  3. Before proceeding any further, create a virtual machine on which to deploy the agent. You can create this machine in Azure, in another cloud, or on-premises.

Create a key vault

This procedure describes how to create a key vault to store your agent configuration information, including your SAP authentication secrets. If you're using an existing key vault, skip the creation command and proceed to copy the key vault name and resource group.

To create your key vault:

  1. Run the following commands, substituting actual names for the <placeholder> values. 

    az keyvault create \
  --name <KeyVaultName> \
  --resource-group <KeyVaultResourceGroupName>

  2. Copy the name of your key vault and the name of its resource group. You'll need the key vault name and resource group name when you assign key vault access permissions and run the deployment script later in this procedure.

Assign key vault access permissions

Grant the required key vault permissions to the agent identity and the user who configures the data connector agent.

  1. In your key vault, assign the Azure Key Vault Secrets Reader role to the VM managed identity or registered application identity that you created for key vault access.

  2. In the same key vault, assign the following Azure roles to the user configuring the data connector agent:

    • Key Vault Contributor, to deploy the agent
    • Key Vault Secrets Officer, to add new systems

Deploy the data connector agent from the portal (Preview)

Now that you created a VM and a Key Vault, your next step is to create a new agent and connect to one of your SAP systems. While you can run multiple data connector agents on a single machine, we recommend that you start with one only, monitor the performance, and then increase the number of connectors slowly.

This procedure describes how to create a new agent and connect it to your SAP system using the Azure or Defender portals. We recommend that your security team perform this procedure with help from the SAP BASIS team.

Deploying the data connector agent from the portal is supported from both the Azure portal, and the Defender portal when Microsoft Sentinel is onboarded to the Defender portal.

While deployment is also supported from the command line, we recommend that you use the portal for typical deployments. Data connector agents deployed using the command line can be managed only via the command line, and not via the portal. For more information, see Deploy an SAP data connector agent from the command line.

Prerequisites:

  • To deploy your data connector agent via the portal, you need:

    • Authentication via a managed identity or a registered application
    • Credentials stored in an Azure Key Vault

    If you don't have these prerequisites, deploy the SAP data connector agent from the command line instead.

  • To deploy the data connector agent, you also need sudo or root privileges on the data connector agent machine.

  • If you want to ingest Netweaver/ABAP logs over a secure connection using Secure Network Communications (SNC), you need:

    • The path to the sapgenpse binary and libsapcrypto.so library
    • The details of your client certificate

    For more information, see Configure your system to use SNC for secure connections.

To deploy the data connector agent:

  1. Sign in to the newly created VM on which you're installing the agent, as a user with sudo privileges.

  2. Download and/or transfer the SAP NetWeaver SDK to the machine.

  3. In Microsoft Sentinel, select Configuration > Data connectors.

  4. In the search bar, enter SAP. Select Microsoft Sentinel for SAP - agent-based from the search results and then Open connector page.

  5. In the Configuration area, select Add new agent (Preview).

    :::image type="content" source="media/deploy-data-connector-agent-container/configuration-new-agent.png" alt-text="Screenshot of the instructions to add an SAP API-based collector agent." lightbox="media/deploy-data-connector-agent-container/configuration-new-agent.png":::

  6. In the Create a collector agent pane, enter the following agent details:

    NameDescription
    Agent nameEnter a meaningful agent name for your organization. We don't recommend any specific naming convention, except that the name can include only the following types of characters:
    • a-z
    • A-Z
    • 0-9
    • _ (underscore)
    • . (period)
    • - (dash)
    Subscription / Key vaultSelect the Subscription and Key vault from their respective drop-downs.
    NWRFC SDK zip file path on the agent VMEnter the path in your VM that contains the SAP NetWeaver Remote Function Call (RFC) Software Development Kit (SDK) archive (.zip file).

    Make sure that this path includes the SDK version number in the following syntax: <path>/NWRFC<version number>.zip. For example: /src/test/nwrfc750P_12-70002726.zip.
    Enable SNC connection supportSelect to ingest NetWeaver/ABAP logs over a secure connection using SNC.

    If you select Enable SNC connection support, enter the path that contains the sapgenpse binary and libsapcrypto.so library, under SAP Cryptographic Library path on the agent VM.

    If you want to use an SNC connection, make sure to select Enable SNC connection support at this stage as you can't go back and enable an SNC connection after you finish deploying the agent. If you want to change this setting afterwards, we recommend that you create a new agent instead.
    Authentication to Azure Key VaultTo authenticate to your key vault using a managed identity, leave the default Managed Identity option selected. To authenticate to your key vault using a registered application, select Application Identity.

    You must have the managed identity or registered application set up ahead of time. For more information, see Create a virtual machine and configure access to your credentials.

    For example:

    :::image type="content" source="media/deploy-data-connector-agent-container/create-agent-managed-id.png" alt-text="Screenshot of the Create a collector agent area.":::

  7. Select Create and review the recommendations before you complete the deployment:

    :::image type="content" source="media/deploy-data-connector-agent-container/finish-agent-deployment.png" alt-text="Screenshot of the final stage of the agent deployment.":::

  8. Deploying the SAP data connector agent requires that you grant your agent's VM identity with specific permissions to the Microsoft Sentinel workspace, using the Microsoft Sentinel Business Applications Agent Operator and Reader roles.

    To run the commands in this step, you must be a resource group owner on your Microsoft Sentinel workspace. If you aren't a resource group owner on your workspace, this procedure can also be performed after the agent deployment is complete.

    Under Just a few more steps before we finish, copy the Role assignment commands from step 1 and run them on your agent VM, replacing the [Object_ID] placeholder with your VM identity object ID. For example:

    :::image type="content" source="media/deploy-data-connector-agent-container/finish-agent-deployment-role.png" alt-text="Screenshot of the Copy icon for the command from step 1.":::

    To find your VM identity object ID in Azure:

    • For a managed identity, the object ID is listed on the VM's Identity page.

    • For a service principal, go to Enterprise application in Azure. Select All applications and then select your VM. The object ID is displayed on the Overview page.

    These commands assign the Microsoft Sentinel Business Applications Agent Operator and Reader Azure roles to your VM's managed or application identity, including only the scope of the specified agent's data in the workspace.

  1. Select Copy :::image type="content" source="media/deploy-data-connector-agent-container/copy-icon.png" alt-text="Screenshot of the Copy icon next to the Agent deployment command." border="false"::: next to the Agent deployment command in step 2. For example:

    :::image type="content" source="media/deploy-data-connector-agent-container/finish-agent-deployment-agent.png" alt-text="Screenshot of the Agent command to copy in step 2.":::

  2. Copy the command line to a separate location and then select Close.

    The relevant agent information is deployed into Azure Key Vault, and the new agent is visible in the table under Add an API based collector agent.

    Before the agent is installed on the VM, the agent's Health status is "Incomplete installation. Please follow the instructions". Once the agent is installed successfully, the status changes to Agent healthy. This update can take up to 10 minutes. For example:

    :::image type="content" source="media/deploy-data-connector-agent-container/installation-status.png" alt-text="Screenshot of the health statuses of API-based collector agents on the SAP data connector page." lightbox="media/deploy-data-connector-agent-container/installation-status.png":::

  1. On the VM where you plan to install the agent, open a terminal and run the Agent deployment command that you copied in the previous step. This step requires sudo or root privileges on the data connector agent machine.

    The script updates the OS components and installs the Azure CLI, Docker software, and other required utilities, such as jq, netcat, and curl.

    Supply extra parameters to the script as needed to customize the container deployment. For more information on available command line options, see Kickstart script reference.

    If you need to copy your command again, select View :::image type="content" source="media/deploy-data-connector-agent-container/view-icon.png" border="false" alt-text="Screenshot of the View icon next to the Health column."::: to the right of the Health column and copy the command next to Agent deployment command on the bottom right.

  2. In the Microsoft Sentinel solution for SAP application's data connector page, in the Configuration area, select Add new system (Preview) and enter the following details:

    • Under Select an agent, select the agent you created earlier.

    • Under System identifier, select the server type:

      • ABAP Server
      • Message Server to use a message server as part of an ABAP SAP Central Services (ASCS).

    • Continue by defining related details for your server type:

      • For an ABAP server, enter the ABAP Application server IP address/FQDN, the system ID and number, and the client ID.
      • For a message server, enter the message server IP address/FQDN, the port number or service name, and the logon group

    When you're done, select Next: Authentication.

    For example:

    :::image type="content" source="media/deploy-data-connector-agent-container/create-system.png" alt-text="Screenshot of the Add new system area's System settings tab.":::

  3. On the Authentication tab, enter the following details:

    • For basic authentication, enter the user and password.
    • If you enabled SNC connection support during agent creation, select SNC and enter the certificate details.

    When you're done, select Next: Logs.

  4. On the Logs tab, select the logs you want to ingest from SAP, and then select Next: Review and create. For example:

    :::image type="content" source="media/deploy-data-connector-agent-container/logs-page.png" alt-text="Screenshot of the Logs tab in the Add new system side pane.":::

  5. (Optional) For optimal results in monitoring the SAP PAHI table, select Configuration History. For more information, see Verify that the PAHI table is updated at regular intervals.

  6. Review the settings you defined. Select Previous to modify any settings, or select Deploy to deploy the system.

The system configuration you defined is deployed into the Azure Key Vault you defined during the deployment. You can now see the system details in the table under Configure an SAP system and assign it to a collector agent. This table displays the associated agent name, SAP System ID (SID), and health status for systems that you added via the portal or otherwise.

After you deploy the system configuration, the system's Health status is Pending. If the agent is updated successfully, it pulls the configuration from Azure Key vault, and the status changes to System healthy. This update can take up to 10 minutes.

:::zone-end

:::zone pivot="connection-agentless"

Watch the connector onboarding video

Use the onboarding video to support the deployment and configuration of the Microsoft Sentinel Solution for SAP - agentless data connector described in this documentation.

[!VIDEO https://www.youtube.com/embed/PbO1S1E29Yk]

Connect your agentless data connector

  1. In Microsoft Sentinel, go to the Configuration > Data connectors page and locate the Microsoft Sentinel for SAP - agentless data connector.

  2. In the Configuration area, expand step 1. Trigger automatic deployment of required Azure resources / SOC Engineer, and select Deploy required Azure resources.

  1. Do one of the following:

    • If you have the Entra ID Application Developer role or higher, continue to the next step.

    • If you don't have the Entra ID Application Developer role or higher:

      • Share the DCR ID with your Entra ID administrator or colleague with the required permissions.
      • Ensure that the Monitoring Metrics Publisher role is assigned on the DCR, with the service principal assignment, using the client ID from the Entra ID app registration.
      • Retrieve the client ID and client secret from the Entra ID app registration to use for authorization on the DCR.

      The SAP admin uses the client ID and client secret information to post to the DCR.

  2. Scroll down and select Add SAP client.

  3. In the Connect to an SAP Client side pane, enter the following details:

    Field Description
    RFC destination name The name of the RFC destination, taken from your BTP destination.
    SAP Agentless Client ID The clientid value taken from the Process Integration Runtime service key JSON file.
    SAP Agentless Client Secret The clientsecret value taken from the Process Integration Runtime service key JSON file.
    Authorization server URL The tokenurl value taken from the Process Integration Runtime service key JSON file. For example: https://your-tenant.authentication.region.hana.ondemand.com/oauth/token
    Integration Suite Endpoint The url value taken from the Process Integration Runtime service key JSON file. For example: https://your-tenant.it-account-rt.cfapps.region.hana.ondemand.com

  4. Select Connect.

Mass-Onboard SAP systems at scale

To onboard SAP systems to the Sentinel Solution for SAP applications at scale, API and CLI based approaches are recommended. Get started with the SAP Integration Suite tools for Microsoft Sentinel.

Rotate the BTP client secret

We recommend that you periodically rotate the BTP subaccount client secrets used by the data connector. For an automated, platform-based approach, see our Automatic SAP BTP trust store certificate renewal with Azure Key Vault – or how to stop thinking about expiry dates once and for all (SAP blog).

The SAP Integration Suite tools for Microsoft Sentinel demonstrate the automatic process of updating an existing data connector with a new secret.

Customize data connector behavior (optional)

If you have an SAP agentless data connector for Microsoft Sentinel, you can use the SAP Integration Suite to customize how the agentless data connector ingests data from your SAP system into Microsoft Sentinel.

This procedure is only relevant when you want to customize the SAP agentless data connector behavior. Skip this procedure if you're satisfied with the default functionality. For example, if you're using Sybase, we recommend that you turn off ingestion for Change Docs logs in your SAP Integration Suite integration flow by configuring the collect-changedocs-logs parameter. Due to database performance issues, ingesting Change Docs logs Sybase isn't supported.

Prerequisites for customizing data connector behavior

Before you customize data connector behavior, make sure the following prerequisites are met:

  • You must have access to the SAP Integration Suite, with permissions to create and edit value mappings.
  • A separate SAP integration package, either existing or new, that is dedicated to hosting the value mapping artifact. The Microsoft Sentinel for SAP integration package installed from the marketplace is in configure-only mode, so you can't add it there.

Create the value mapping artifact and customize settings

Create a value mapping artifact in your SAP Integration Suite tenant and add only the parameters you want to override. Any parameter you don't define keeps its default value.

You have two options for getting the artifact in place:

  • Option 1 (recommended): Import the prebuilt Key Value Map from the Microsoft Sentinel for SAP community repository. The repository ships a Data Collector Customizing (Key Value Map) pre-populated blueprint for customizing. Download the latest base package from the releases page and import it into your SAP Integration Suite tenant. Then continue with the customization steps below.
  • Option 2: Create the artifact manually. In your dedicated package, create a new Value Mapping artifact. For more information, see the SAP documentation on creating a value mapping.

After the value mapping artifact is in place, customize and activate it:

  1. Add the entries that customize your data connector behavior. Use one of the following approaches:

    • To customize settings across all SAP systems, add value mappings under the global bi-directional mapping agency, using the parameter name as the source key and your override as the target value.
    • To customize settings for specific SAP systems, create a separate bi-directional mapping agency for each SAP system. Name each agency to exactly match the name of the RFC destination that you want to customize (for example, myRfc, key, myRfc, value), and add the parameter entries under that agency.

    For more information, see the SAP documentation on configuring value mappings.

  2. Save and deploy the value mapping artifact to activate the updated settings.

:::image type="content" source="./media/deploy-data-connector-agent-container/agentless-value-mapping-artifact.png" alt-text="Screenshot placeholder of the value mapping artifact in SAP Cloud Integration with example agentless data connector parameters." lightbox="./media/deploy-data-connector-agent-container/agentless-value-mapping-artifact.png":::

Use the following table as a guide for what to enter in the value mapping artifact. Add only the rows for the parameters you want to override:

Field in the value mapping artifactWhat to enter
Agency (source and target)global for all SAP systems, or the RFC destination name (for example, myRfc) to scope the override to a specific SAP system.
Identifier (source and target)key as the source identifier and value as the target identifier.
Source valueThe parameter name from the customizable parameters table (for example, collect-changedocs-logs).
Target valueThe override value for that parameter (for example, false).

The following table lists the customizable parameters for the SAP agentless data connector for Microsoft Sentinel:

General collection controls

The following parameters control overall data collection behavior for the agentless connector.

ParameterDescriptionAllowed valuesDefault value
changedocs-object-classesList of object classes that are ingested from Change Docs logs.Comma separated list of object classesBANK, CLEARING, IBAN, IDENTITY, KERBEROS, OA2_CLIENT, PCA_BLOCK, PCA_MASTER, PFCG, SECM, SU_USOBT_C, SECURITY_POLICY, STATUS, SU22_USOBT, SU22_USOBX, SUSR_PROF, SU_USOBX_C, USER_CUA
collect-audit-logsDetermines whether Audit Log data is ingested or not to the table ABAPAuditLog.true: Ingested
false: Not ingested		true
collect-changedocs-logsDetermines whether Change Docs logs are ingested or not into the table ABAPChangeDocsLog.true: Ingested
false: Not ingested		true
force-audit-log-to-read-from-all-clientsDetermines whether the Audit Log is read from all clients.true: Read from all clients
false: Not read from all clients		false
ingestion-cycle-daysTime, in days, given to ingest the full User Master data, including all roles and users. This parameter doesn't affect the ingestion of changes to User Master data.Integer, between 1-141
collect-user-master-data-usersDetermines whether User Details data is ingested or not to the tables ABAPUserDetails.true: Ingested, false: Not ingestedtrue
collect-user-master-data-rolesDetermines whether Role Authorization data is ingested or not to the tables ABAPAuthorizationDetails.true: Ingested, false: Not ingestedtrue
offset-in-secondsDetermines the offset, in seconds, for both the start and end times of a data collection window. Use this parameter to delay data collection by the configured number of seconds.Integer, between 1-60060

Audit Log parameters

The following parameters control Audit Log collection behavior.

ParameterDescriptionAllowed valuesDefault value
force-audit-log-to-read-from-all-clientsDetermines whether the Audit Log is read from all clients.true: Read from all clients, false: Not read from all clientsfalse
max-rowsActs as a safeguard that limits the number of Audit Log records processed in a single data collection window. This parameter no longer applies to Change Docs collection.Integer, between 1-1000000150000

Change Docs parameters

The following parameters control Change Docs log collection.

ParameterDescriptionAllowed valuesDefault value
changedocs-object-classesList of object classes that are ingested from Change Docs logs.Comma separated list of object classesBANK, CLEARING, IBAN, IDENTITY, KERBEROS, OA2_CLIENT, PCA_BLOCK, PCA_MASTER, PFCG, SECM, SU_USOBT_C, SECURITY_POLICY, STATUS, SU22_USOBT, SU22_USOBX, SUSR_PROF, SU_USOBX_C, USER_CUA
max-changedocs-headersActs as a safeguard that limits the number of Change Docs header records (CDHDR records) processed in a single data collection window. Use this parameter to reduce runtime and memory pressure during spikes in header volume.Integer, between 1-10000001000
max-changedocs-detailsActs as a safeguard that limits the number of Change Docs detail records (CDPOS records) processed in a single data collection window. Use this parameter to tune throughput versus memory usage.Integer, between 1-100000010000
change-docs-batch-sizeNumber of Change Docs header records used per detail-fetch call. Reduce this value if RFC calls time out.Integer, between 1-10001000

User Details parameters

The following parameters control User Details collection.

ParameterDescriptionAllowed valuesDefault value
max-usersActs as a safeguard that limits the number of unique users processed in a single collection cycle.Integer, between 1-1000000125
user-batch-sizeNumber of users processed per batch when retrieving active user data. Reduce this value if RFC calls time out.Integer, between 1-1000125
role-profiles-maxDetermines the maximum combined number of profiles and roles that can be emitted for a user before the connector writes a wildcard truncation marker instead of the full list.Integer, between 1-100001000
role-profiles-batch-sizeNumber of profiles or roles written per output row. Users with more profiles or roles than this value are split across multiple rows.Integer, between 1-100014

Role Authorization parameters

The following parameters control Role Authorization data collection.

ParameterDescriptionAllowed valuesDefault value
max-rolesActs as a safeguard that limits the number of roles processed in a single collection cycle.Integer, between 1-100000050
max-roles-authz-overallActs as a safeguard that limits the cumulative number of role authorization records fetched across all roles in a single collection cycle.Integer, between 1-100000025000
max-roles-authz-individualActs as a safeguard that limits the number of authorization records fetched for an individual role. Roles that exceed this limit are skipped.Integer, between 1-10000005000
role-authz-batch-sizeNumber of records fetched per batch when retrieving role authorization data. Reduce this value if RFC calls time out.Integer, between 1-1000100

Truncation behaviour of the safeguards

When either limit is reached, a marker record is written to the output with a descriptive message indicating which limit was hit, the actual record count, and the collection time window. The two limits produce distinct markers (TRUNCATED_HEADERS and TRUNCATED_DETAILS) so they can be distinguished in Sentinel.

:::zone-end

Check connectivity and health

After you deploy the SAP data connector, check your agent's health and connectivity. For more information, see Monitor the health and role of your SAP systems.

Next step

Once the connector is deployed, proceed to configure the Microsoft Sentinel solution for SAP applications content. Specifically, configuring details in the watchlists is an essential step in enabling detections and threat protection.

[!div class="nextstepaction"] Enable SAP detections and threat protection