Microsoft Sentinel
Cloud and workloadsMonitor the health and role of your SAP systems
In brief
The SAP connector page no longer displays system role and health as a table. Administrators should use the SAPSystems KQL function for roles and SentinelHealth or the SAP data collection health alert for health signals. Unknown SIDs are treated as production for security and billing.
What Defender admins need to know
Update runbooks and monitoring checks to use the workspace queries or alert. Populate the SAP - Systems watchlist and validate T000 permissions when roles are missing.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Monitor the health and role of your SAP systems
After you deploy the SAP solution, you want to ensure proper functioning and performance of your SAP systems, and keep track of your system health,role, connectivity, and performance.log ingestion. This article describes how you can check the connectivityto look up system role and health manually on the data connector pagefrom workspace tables and functions, and how to use a dedicated alert rule template to monitor the health of your SAP systems.
For a video demonstration of the procedures in this article, watch the following video:
[!VIDEO https://www.youtube.com/embed/FasuyBSIaQM?si=apdesRR29Lvq6aQM]
Prerequisites
Before you can perform the procedures in this article, you need to have an SAP data connector connected to your SAP system. SAP logs aren't displayed in the Microsoft Sentinel Logs page until your SAP system is connected and data starts streaming into Microsoft Sentinel.
For more information, see Connect your SAP system to Microsoft SentinelConnect your SAP system to Microsoft Sentinel.
Check your SAP data connector agent's health and connectivity
This procedure describes how to check yourThe agentless data connector's connection status page lists the SAP systems (SIDs) you configured, but system role and health are no longer surfaced there as a table. Query them from the Microsoft Sentinel for SAP data connector page, and is relevant only for the data connector agent.
In Microsoft Sentinel, selectData connectorsand search forMicrosoft Sentinel for SAP.Select theMicrosoft Sentinel for SAPconnector and selectOpen connector page.In theConfiguration > 2. Configure an SAP system and assign it to a collector agentarea, view details about the health of your SAP systems.For example::::image type="content" source="media/monitor-sap-system-health/health-status.png" alt-text="Screenshot of the Microsoft Sentinel for SAP applications health status table." lightbox="media/monitor-sap-system-health/health-status.png":::The fields in theConfigure an SAP system and assign it to a collector agentarea are described as follows:workspace instead:System
display namerole (production or nonproduction).TheUse the SAPSystems KQL function, which reads the SAPsystem ID (SID)- Systems watchlist andits client number. Together, thisreturns theSystemRolevaluequalifies the connection to the SAP system and definesforSAP BASIS which system you're connecting to.System role. Indicates whether the system is production state or not, whicheach SID. Role also affectsbilling. For more information,billing - seeSolution pricingSolution pricing.ValuesTypical values include:Value Description Production The system is defined by the SAP admin as a production system. Unknown (Production)Non-productionRoles such as development, test, quality assurance, or training. (empty or missing) The SAP - Systems watchlist isn't populated for the SID yet, or the ABAP user can't read the T000 table. Microsoft Sentinel couldn't retrieve the system status. Microsoft Sentinel regards this type of systemtreats an unknown SID asaproductionsystemforbothsecurity and billing purposes.In such cases, we recommend that you checkPopulate theMicrosoft Sentinelwatchlist and validate the roledefinitions andpermissions onthe SAP system, and validate that the system allows Microsoft Sentinel to read the content of theT000table. Next, consider updating the SAP connector to the latest version.Non-productionIndicates roles like developing, testing, and customizing..Agent name. Unique ID of the installed data connector agent.Health.
Indicates whetherQuery theSID is healthy. To troubleshootSentinelHealth table for the SAP data connector, or turn on the SAP - Data collection healthissues, review the container execution logs and review other troubleshooting stepscheck alert rule template (see the next sections).ValuesTypical signals include:Value Description System healthySuccess(green icon)Indicates thatMicrosoft Sentinel identified both logs and a heartbeat from the system.System Connected – unauthorized to collect role, production assumedSuccess with warnings(yellow icon)Microsoft Sentinel doesn't have sufficient permissions to define whetherConnection succeeded, but some log streams returned errors or thesystemABAP user isa production system. In this case, Microsoft Sentinel defines the system as a production system.In such cases, checkmissing authorizations. Check the Microsoft Sentinel role definitionsand permissionson the SAP system,and validate that the system allows Microsoft Sentinelincluding read access toread the content of theT000.table. Next, consider updating the SAP connector to the latest version.Connected with errors(yellow icon)Connection was successful but Microsoft Sentinel detected errors when fetching the system role and doesn't have the details of whether the system is or isn't a production system.System not connectedFailureMicrosoft Sentinel was unable to connect tocan't reach the SAPsystem, and cannot fetchsystem or thesystem role. In this case, Microsoft Sentinel doesn't havecredentials are invalid. Review thedetails of whether the system is or isn't a production system.Other statuses that reflect more details about connectivity issuesFor example,System unreachable for over 1 daytroubleshooting steps.
View SAP logs streaming into Microsoft Sentinel
InThe agentless data connector streams SAP logs into standard Log Analytics tables such as ABAPAuditLog, ABAPAuthorizationDetails, ABAPChangeDocsLog, and ABAPUserDetails. Query them from Microsoft Sentinel, selectSentinel GeneralLogs >(Azure portal) or from Logs > Custom logsAdvanced hunting (Defender portal). For example, run ABAPAuditLog | take 50to view the logs streaming in from the SAP system. For example:
:::image type="content" source="sap/media/deploy-sap-security-content/sap-logs-in-sentinel.png" alt-text="Screenshotconfirm that shows the SAP ABAP logs in the Custom Logs area in Microsoft Sentinel." lightbox="sap/media/deploy-sap-security-content/sap-logs-in-sentinel.png":::data is arriving.
For more information,the full list of tables and the recommended KQL functions to query them, see Log and table reference for the Microsoft Sentinel solution for SAP applications.
Check the SentinelHealth table for health indicators
Use an alert rule template to monitor the health of your SAP systems
The Microsoft Sentinel for SAP solution includes an alert rule template designed to give you insight into the health of yourthe SAP agent's data collection.
The rule needs at least seven days of loading history to detect the different seasonality patterns. We recommend a value of 14 days for the alert rule Look back parameter to allow detection of weekly activity profiles.
Once the alert rule is activated, the ruleit judges the recent telemetry and log volume observed on the workspace according to the history learned. The rule then alerts on potential issues, dynamically assigning severities according to the scope of the problem.
To turn on the analytics rule in Microsoft Sentinel, select Analytics > Rule templates, and locate the SAP - Data collection health check alert rule.
The analytics rule does the following:
- Evaluates
signals sent fromtheagent.connector's health signals. - Evaluates telemetry data.
- Evaluates alerts on log continuation and other system connectivity issues, if any are found.
- Learns the log ingestion history, and therefore works better with time.
@@ -5,74 +5,47 @@ ms.author: monaberdugo author: mberdugo ms.reviewer: mapankra ms.topic: how-to-ms.date: 09/30/2025+ms.date: 08/04/2026 ms.service: microsoft-sentinel+ai-usage: ai-assisted #customerIntent: As a security engineer, I want to learn how to monitor the health and connectivity of our SAP system connection to Microsoft Sentinel. +ms.custom: msecd-doc-authoring-1016 --- # Monitor the health and role of your SAP systems -After you [deploy the SAP solution](sap/deployment-overview.md), you want to ensure proper functioning and performance of your SAP systems, and keep track of your system health, connectivity, and performance. This article describes how you can check the connectivity health manually on the data connector page and use a dedicated alert rule template to monitor the health of your SAP systems.--> [!IMPORTANT]-> Monitoring the health of your SAP systems and the agentless data connector for SAP are both currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.--For a video demonstration of the procedures in this article, watch the following video:-<br><br>-> [!VIDEO https://www.youtube.com/embed/FasuyBSIaQM?si=apdesRR29Lvq6aQM]+After you [deploy the SAP solution](sap/deployment-overview.md), you want to ensure proper functioning and performance of your SAP systems, and keep track of system role, connectivity, and log ingestion. This article describes how to look up system role and health from workspace tables and functions, and how to use a dedicated alert rule template to monitor the health of your SAP systems. ## Prerequisites -- Before you can perform the procedures in this article, you need to have an SAP data connector connected to your SAP system. SAP logs aren't displayed in the Microsoft Sentinel **Logs** page until your SAP system is connected and data starts streaming into Microsoft Sentinel.--For more information, see [Connect your SAP system to Microsoft Sentinel](sap/deploy-data-connector-agent-container.md).--## Check your data connector agent's health and connectivity--This procedure describes how to check your data connector's connection status from the **Microsoft Sentinel for SAP** data connector page, and is relevant only for the data connector agent.--1. In Microsoft Sentinel, select **Data connectors** and search for *Microsoft Sentinel for SAP*.+Before you can perform the procedures in this article, you need to have an SAP data connector connected to your SAP system. SAP logs aren't displayed in the Microsoft Sentinel **Logs** page until your SAP system is connected and data starts streaming into Microsoft Sentinel. For more information, see [Connect your SAP system to Microsoft Sentinel](sap/deploy-data-connector-agentless.md). -1. Select the **Microsoft Sentinel for SAP** connector and select **Open connector page**.+## Check your SAP data connector's health and connectivity -1. In the **Configuration > 2. Configure an SAP system and assign it to a collector agent** area, view details about the health of your SAP systems.+The agentless data connector page lists the SAP systems (SIDs) you configured, but system role and health are no longer surfaced there as a table. Query them from the workspace instead: - For example:+- **System role (production or nonproduction)**. Use the [SAPSystems](sap/sap-solution-function-reference.md#sapsystems) KQL function, which reads the *SAP - Systems* watchlist and returns the `SystemRole` value for each SID. Role also affects billing - see [Solution pricing](sap/sap-applications-overview.md#solution-pricing). Typical values include: - :::image type="content" source="media/monitor-sap-system-health/health-status.png" alt-text="Screenshot of the Microsoft Sentinel for SAP applications health status table." lightbox="media/monitor-sap-system-health/health-status.png":::+ |Value |Description |+ |---------|---------|+ |**Production** | The system is defined by the SAP admin as a production system. |+ |**Non-production** | Roles such as development, test, quality assurance, or training. |+ |*(empty or missing)* | The *SAP - Systems* watchlist isn't populated for the SID yet, or the ABAP user can't read the T000 table. Microsoft Sentinel treats an unknown SID as production for security and billing purposes. Populate the watchlist and validate the role permissions on `T000`. | - The fields in the **Configure an SAP system and assign it to a collector agent** area are described as follows:+- **Health**. Query the **SentinelHealth** table for the SAP data connector, or turn on the *SAP - Data collection health check* alert rule template (see the next sections). Typical signals include: - - **System display name**. The SAP system ID (SID) and its client number. Together, this value qualifies the connection to the SAP system and defines for SAP BASIS which system you're connecting to.-- - **System role**. Indicates whether the system is production state or not, which also affects billing. For more information, see [Solution pricing](sap/solution-overview.md#solution-pricing). Values include:-- |Value |Description |- |---------|---------|- |**Production** | The system is defined by the SAP admin as a production system. |- |**Unknown (Production)** | Microsoft Sentinel couldn't retrieve the system status. Microsoft Sentinel regards this type of system as a production system for both security and billing purposes. <br><br>In such cases, we recommend that you check the Microsoft Sentinel role definitions and permissions on the SAP system, and validate that the system allows Microsoft Sentinel to read the content of the T000 table. Next, consider [updating the SAP connector](sap/update-sap-data-connector.md) to the latest version. |- |**Non-production** | Indicates roles like developing, testing, and customizing. |-- - **Agent name**. Unique ID of the installed data connector agent.-- - **Health**. Indicates whether the SID is healthy. To troubleshoot health issues, [review the container execution logs](sap/sap-deploy-troubleshoot.md#view-all-container-execution-logs) and review other [troubleshooting steps](sap/sap-deploy-troubleshoot.md). Values include:-- |Value |Description |- |---------|---------|- | **System healthy** (green icon)| Indicates that Microsoft Sentinel identified both logs and a heartbeat from the system.|- | **System Connected – unauthorized to collect role, production assumed** (yellow icon) | Microsoft Sentinel doesn't have sufficient permissions to define whether the system is a production system. In this case, Microsoft Sentinel defines the system as a production system. <br><br>In such cases, check the Microsoft Sentinel role definitions and permissions on the SAP system, and validate that the system allows Microsoft Sentinel to read the content of the T000 table. Next, consider [updating the SAP connector](sap/update-sap-data-connector.md) to the latest version. |- | **Connected with errors** (yellow icon) | Connection was successful but Microsoft Sentinel detected errors when fetching the system role and doesn't have the details of whether the system is or isn't a production system. |- | **System not connected** | Microsoft Sentinel was unable to connect to the SAP system, and cannot fetch the system role. In this case, Microsoft Sentinel doesn't have the details of whether the system is or isn't a production system. |- | Other statuses that reflect more details about connectivity issues | For example, **System unreachable for over 1 day**. |+ |Value |Description |+ |---------|---------|+ | **Success** | Microsoft Sentinel identified both logs and a heartbeat from the system. |+ | **Success with warnings** | Connection succeeded, but some log streams returned errors or the ABAP user is missing authorizations. Check the Microsoft Sentinel role definitions on the SAP system, including read access to `T000`. |+ | **Failure** | Microsoft Sentinel can't reach the SAP system or the credentials are invalid. Review the [troubleshooting steps](sap/sap-deploy-troubleshoot.md). | ## View SAP logs streaming into Microsoft Sentinel -In Microsoft Sentinel, select **General** > **Logs > Custom logs** to view the logs streaming in from the SAP system. For example:--:::image type="content" source="sap/media/deploy-sap-security-content/sap-logs-in-sentinel.png" alt-text="Screenshot that shows the SAP ABAP logs in the Custom Logs area in Microsoft Sentinel." lightbox="sap/media/deploy-sap-security-content/sap-logs-in-sentinel.png":::+The agentless data connector streams SAP logs into standard Log Analytics tables such as `ABAPAuditLog`, `ABAPAuthorizationDetails`, `ABAPChangeDocsLog`, and `ABAPUserDetails`. Query them from Microsoft Sentinel **Logs** (Azure portal) or from **Advanced hunting** (Defender portal). For example, run `ABAPAuditLog | take 50` to confirm that data is arriving. -For more information, see [Microsoft Sentinel solution for SAP applications solution logs reference](sap-solution-log-reference.md).+For the full list of tables and the recommended KQL functions to query them, see [Log and table reference for the Microsoft Sentinel solution for SAP applications](sap-solution-log-reference.md). ## Check the SentinelHealth table for health indicators @@ -87,17 +60,17 @@ For more information, see: ## Use an alert rule template to monitor the health of your SAP systems -The Microsoft Sentinel for SAP solution includes an alert rule template designed to give you insight into the health of your SAP agent's data collection.+The Microsoft Sentinel for SAP solution includes an alert rule template designed to give you insight into the health of the SAP data collection. The rule needs at least seven days of loading history to detect the different seasonality patterns. We recommend a value of 14 days for the alert rule **Look back** parameter to allow detection of weekly activity profiles. -Once activated, the rule judges the recent telemetry and log volume observed on the workspace according to the history learned. The rule then alerts on potential issues, dynamically assigning severities according to the scope of the problem.+Once the alert rule is activated, it judges the recent telemetry and log volume observed on the workspace according to the history learned. The rule then alerts on potential issues, dynamically assigning severities according to the scope of the problem. To turn on the analytics rule in Microsoft Sentinel, select **Analytics > Rule templates**, and locate the *SAP - Data collection health check* alert rule. The analytics rule does the following: -- Evaluates signals sent from the agent.+- Evaluates the connector's health signals. - Evaluates telemetry data. - Evaluates alerts on log continuation and other system connectivity issues, if any are found. - Learns the log ingestion history, and therefore works better with time.