Connect your SAP system to Microsoft Sentinel

Content in this article is relevant for your security, infrastructure, and SAP BASIS teams. Make sure to perform the steps in this article in the order that they're presented.

Content in this article is relevant for your security team.

Watch a demo video

Watch one of the following video demonstrations of the deployment process described in this article.

A deep dive on the portal options:

Includes more details about using Azure KeyVault. No audio, demonstration only with captions:

Create a virtual machine and configure access to your credentials

We recommend creating a dedicated virtual machine for your data connector agent container to ensure optimal performance and avoid potential conflicts. For more information, see System prerequisites for the data connector agent container.

We recommend that you store your SAP and authentication secrets in an Azure Key Vault. How you access your key vault depends on where your virtual machine (VM) is deployed:

If you can't use a registered application or a service principal, use a configuration file to manage your credentials, though this method isn't preferred. For more information, see Deploy the data connector using a configuration file.

For more information, see:

• Authentication in Azure Key Vault
• What are managed identities for Azure resources?
• Application and service principal objects in Microsoft Entra ID

Your virtual machine is typically created by your infrastructure team. Configuring access to credentials and managing key vaults is typically done by your security team.

Create a key vault

This procedure describes how to create a key vault to store your agent configuration information, including your SAP authentication secrets. If you're using an existing key vault, skip directly to step 2.

To create your key vault:

1. Run the following commands, substituting actual names for the <placeholder> values.

   az keyvault create \
     --name <KeyVaultName> \
     --resource-group <KeyVaultResourceGroupName>
   

2. Copy the name of your key vault and the name of its resource group. You'll need these when you assign the key vault access permissions and run the deployment script in the next steps.

Assign key vault access permissions

1. In your key vault, assign the Azure Key Vault Secrets Reader role to the identity that you created and copied earlier.

2. In the same key vault, assign the following Azure roles to the user configuring the data connector agent:

   • Key Vault Contributor, to deploy the agent
   • Key Vault Secrets Officer, to add new systems

Deploy the data connector agent from the portal (Preview)

Now that you created a VM and a Key Vault, your next step is to create a new agent and connect to one of your SAP systems. While you can run multiple data connector agents on a single machine, we recommend that you start with one only, monitor the performance, and then increase the number of connectors slowly.

This procedure describes how to create a new agent and connect it to your SAP system using the Azure or Defender portals. We recommend that your security team perform this procedure with help from the SAP BASIS team.

Deploying the data connector agent from the portal is supported from both the Azure portal, and the Defender portal when Microsoft Sentinel is onboarded to the Defender portal.

While deployment is also supported from the command line, we recommend that you use the portal for typical deployments. Data connector agents deployed using the command line can be managed only via the command line, and not via the portal. For more information, see Deploy an SAP data connector agent from the command line.

Prerequisites:

• To deploy your data connector agent via the portal, you need:

  • Authentication via a managed identity or a registered application
  • Credentials stored in an Azure Key Vault

  If you don't have these prerequisites, deploy the SAP data connector agent from the command line instead.

• To deploy the data connector agent, you also need sudo or root privileges on the data connector agent machine.

• If you want to ingest Netweaver/ABAP logs over a secure connection using Secure Network Communications (SNC), you need:

  • The path to the sapgenpse binary and libsapcrypto.so library
  • The details of your client certificate

  For more information, see Configure your system to use SNC for secure connections.

To deploy the data connector agent:

1. Sign in to the newly created VM on which you're installing the agent, as a user with sudo privileges.

2. Download and/or transfer the SAP NetWeaver SDK to the machine.

3. In Microsoft Sentinel, select Configuration > Data connectors.

4. In the search bar, enter SAP. Select Microsoft Sentinel for SAP - agent-based from the search results and then Open connector page.

5. In the Configuration area, select Add new agent (Preview).

   

6. In the Create a collector agent pane, enter the following agent details:

   Name	Description
   Agent name	Enter a meaningful agent name for your organization. We don't recommend any specific naming convention, except that the name can include only the following types of characters: a-z A-Z 0-9 _ (underscore) . (period) - (dash)
   Subscription / Key vault	Select the Subscription and Key vault from their respective drop-downs.
   NWRFC SDK zip file path on the agent VM	Enter the path in your VM that contains the SAP NetWeaver Remote Function Call (RFC) Software Development Kit (SDK) archive (.zip file). Make sure that this path includes the SDK version number in the following syntax: <path>/NWRFC<version number>.zip. For example: /src/test/nwrfc750P_12-70002726.zip.
   Enable SNC connection support	Select to ingest NetWeaver/ABAP logs over a secure connection using SNC. If you select this option, enter the path that contains the sapgenpse binary and libsapcrypto.so library, under SAP Cryptographic Library path on the agent VM. If you want to use an SNC connection, make sure to select Enable SNC connection support at this stage as you can't go back and enable an SNC connection after you finish deploying the agent. If you want to change this setting afterwards, we recommend that you create a new agent instead.
   Authentication to Azure Key Vault	To authenticate to your key vault using a managed identity, leave the default Managed Identity option selected. To authenticate to your key vault using a registered application, select Application Identity. You must have the managed identity or registered application set up ahead of time. For more information, see Create a virtual machine and configure access to your credentials.

   For example:

   

7. Select Create and review the recommendations before you complete the deployment:

   

8. Deploying the SAP data connector agent requires that you grant your agent's VM identity with specific permissions to the Microsoft Sentinel workspace, using the Microsoft Sentinel Business Applications Agent Operator and Reader roles.

   To run the commands in this step, you must be a resource group owner on your Microsoft Sentinel workspace. If you aren't a resource group owner on your workspace, this procedure can also be performed after the agent deployment is complete.

   Under Just a few more steps before we finish, copy the Role assignment commands from step 1 and run them on your agent VM, replacing the [Object_ID] placeholder with your VM identity object ID. For example:

   

   To find your VM identity object ID in Azure:

   • For a managed identity, the object ID is listed on the VM's Identity page.

   • For a service principal, go to Enterprise application in Azure. Select All applications and then select your VM. The object ID is displayed on the Overview page.

   These commands assign the Microsoft Sentinel Business Applications Agent Operator and Reader Azure roles to your VM's managed or application identity, including only the scope of the specified agent's data in the workspace.

   Important

   Assigning the Microsoft Sentinel Business Applications Agent Operator and Reader roles via the CLI assigns the roles only on the scope of the specified agent's data in the workspace. This is the most secure, and therefore recommended option.

   If you must assign the roles via the Azure portal, we recommend assigning the roles on a small scope, such as only on the Microsoft Sentinel workspace.

9. Select Copy next to the Agent deployment command in step 2. For example:

   

10. Copy the command line to a separate location and then select Close.

    The relevant agent information is deployed into Azure Key Vault, and the new agent is visible in the table under Add an API based collector agent.

    At this stage, the agent's Health status is "Incomplete installation. Please follow the instructions". Once the agent is installed successfully, the status changes to Agent healthy. This update can take up to 10 minutes. For example:

    

    Note

    The table displays the agent name and health status for only those agents you deploy via the Azure portal. Agents deployed using the command line aren't displayed here. For more information, see the Command line tab instead.

11. On the VM where you plan to install the agent, open a terminal and run the Agent deployment command that you copied in the previous step. This step requires sudo or root privileges on the data connector agent machine.

    The script updates the OS components and installs the Azure CLI, Docker software, and other required utilities, such as jq, netcat, and curl.

    Supply extra parameters to the script as needed to customize the container deployment. For more information on available command line options, see Kickstart script reference.

    If you need to copy your command again, select View to the right of the Health column and copy the command next to Agent deployment command on the bottom right.

12. In the Microsoft Sentinel solution for SAP application's data connector page, in the Configuration area, select Add new system (Preview) and enter the following details:

    • Under Select an agent, select the agent you created earlier.

    • Under System identifier, select the server type:

      • ABAP Server
      • Message Server to use a message server as part of an ABAP SAP Central Services (ASCS).

    • Continue by defining related details for your server type:

      • For an ABAP server, enter the ABAP Application server IP address/FQDN, the system ID and number, and the client ID.
      • For a message server, enter the message server IP address/FQDN, the port number or service name, and the logon group

    When you're done, select Next: Authentication.

    For example:

    

13. On the Authentication tab, enter the following details:

    • For basic authentication, enter the user and password.
    • If you selected an SNC connection when you set up the agent, select SNC and enter the certificate details.

    When you're done, select Next: Logs.

14. On the Logs tab, select the logs you want to ingest from SAP, and then select Next: Review and create. For example:

    

15. (Optional) For optimal results in monitoring the SAP PAHI table, select Configuration History. For more information, see Verify that the PAHI table is updated at regular intervals.

16. Review the settings you defined. Select Previous to modify any settings, or select Deploy to deploy the system.

The system configuration you defined is deployed into the Azure Key Vault you defined during the deployment. You can now see the system details in the table under Configure an SAP system and assign it to a collector agent. This table displays the associated agent name, SAP System ID (SID), and health status for systems that you added via the portal or otherwise.

At this stage, the system's Health status is Pending. If the agent is updated successfully, it pulls the configuration from Azure Key vault, and the status changes to System healthy. This update can take up to 10 minutes.

Watch the connector onboarding video

Use the onboarding video to support the deployment and configuration of the Microsoft Sentinel Solution for SAP - agentless data connector described in this documentation.

Connect your agentless data connector

1. In Microsoft Sentinel, go to the Configuration > Data connectors page and locate the Microsoft Sentinel for SAP - agentless data connector.

2. In the Configuration area, expand step 1. Trigger automatic deployment of required Azure resources / SOC Engineer, and select Deploy required Azure resources.

   Important

   If you don't have the Entra ID Application Developer role or higher, and you select deploy required Azure resources, an error message is displayed, for example: "Deploy required Azure resources" (errors may vary). This means that the data collection rule (DCR) and data collection endpoint (DCE) were created, but you need to ensure that your Entra ID app registration is authorized. Continue to set up the correct authorization.

   Note

   When deploying the required Azure resources for the Microsoft Sentinel solution for SAP applications (agentless), Azure Resource Manager (ARM) may take up to 45 seconds to complete resource provider operations. During this time, the deployment might appear delayed. This behavior is expected. Wait for the operation to complete before retrying or redeploying.

3. Do one of the following:

   • If you have the Entra ID Application Developer role or higher, continue to the next step.

   • If you don't have the Entra ID Application Developer role or higher:

     • Share the DCR ID with your Entra ID administrator or colleague with the required permissions.
     • Ensure that the Monitoring Metrics Publisher role is assigned on the DCR, with the service principal assignment, using the client ID from the Entra ID app registration.
     • Retrieve the client ID and client secret from the Entra ID app registration to use for authorization on the DCR.

     The SAP admin uses the client ID and client secret information to post to the DCR.

4. Scroll down and select Add SAP client.

5. In the Connect to an SAP Client side pane, enter the following details:

   Field	Description
   RFC destination name	The name of the RFC destination, taken from your BTP destination.
   SAP Agentless Client ID	The clientid value taken from the Process Integration Runtime service key JSON file.
   SAP Agentless Client Secret	The clientsecret value taken from the Process Integration Runtime service key JSON file.
   Authorization server URL	The tokenurl value taken from the Process Integration Runtime service key JSON file. For example: https://your-tenant.authentication.region.hana.ondemand.com/oauth/token
   Integration Suite Endpoint	The url value taken from the Process Integration Runtime service key JSON file. For example: https://your-tenant.it-account-rt.cfapps.region.hana.ondemand.com

6. Select Connect.

Mass-Onboard SAP systems at scale

To onboard SAP systems to the Sentinel Solution for SAP applications at scale, API and CLI based approaches are recommended. Get started with this script library.

Rotate the BTP client secret

We recommend that you periodically rotate the BTP subaccount client secrets used by the data connector. For an automated, platform-based approach, see our Automatic SAP BTP trust store certificate renewal with Azure Key Vault – or how to stop thinking about expiry dates once and for all (SAP blog).

This script library demonstrates the automatic process of updating an existing data connector with a new secret.

Customize data connector behavior (optional)

If you have an SAP agentless data connector for Microsoft Sentinel, you can use the SAP Integration Suite to customize how the agentless data connector ingests data from your SAP system into Microsoft Sentinel.

This procedure is only relevant when you want to customize the SAP agentless data connector behavior. Skip this procedure if you're satisfied with the default functionality. For example, if you're using Sybase, we recommend that you turn off ingestion for Change Docs logs in the iflow by configuring the collect-changedocs-logs parameter. Due to database performance issues, ingesting Change Docs logs Sybase isn't supported.

Prerequisites for customizing data connector behavior

• You must have access to the SAP Integration Suite, with permissions to create and edit value mappings.
• A separate SAP integration package, either existing or new, that is dedicated to hosting the value mapping artifact. The Microsoft Sentinel for SAP integration package installed from the marketplace is in configure-only mode, so you can't add it there.

Create the value mapping artifact and customize settings

Create a value mapping artifact in your SAP Integration Suite tenant and add only the parameters you want to override. Any parameter you don't define keeps its default value.

You have two options for getting the artifact in place:

• Option 1 (recommended): Import the prebuilt Key Value Map from the Microsoft Sentinel for SAP community repository. The repository ships a Data Collector Customizing (Key Value Map) pre-populated blueprint for customizing. Download the latest base package from the releases page and import it into your SAP Integration Suite tenant. Then continue with the customization steps below.

  Tip

  The same community repository hosts other Microsoft-provided integration recipes you can adopt alongside the agentless data connector, such as SAP Ariba, SAP S/4HANA Cloud public edition (GROW), SAP User block, and SAP Table Reader. Browse the integration-artifacts folder for the full and up-to-date list. Community contributions are welcome.

• Option 2: Create the artifact manually. In your dedicated package, create a new Value Mapping artifact. For more information, see the SAP documentation on creating a value mapping.

After the value mapping artifact is in place, customize and activate it:

1. Add the entries that customize your data connector behavior. Use one of the following approaches:

   • To customize settings across all SAP systems, add value mappings under the global bi-directional mapping agency, using the parameter name as the source key and your override as the target value.
   • To customize settings for specific SAP systems, create a separate bi-directional mapping agency for each SAP system. Name each agency to exactly match the name of the RFC destination that you want to customize (for example, myRfc, key, myRfc, value), and add the parameter entries under that agency.

   For more information, see the SAP documentation on configuring value mappings.

2. Save and deploy the value mapping artifact to activate the updated settings.

Use the following table as a guide for what to enter in the value mapping artifact. Add only the rows for the parameters you want to override:

The following table lists the customizable parameters for the SAP agentless data connector for Microsoft Sentinel:

General collection controls

Audit Log parameters

Change Docs parameters

User Details parameters

Role Authorization parameters

Truncation behaviour of the safeguards

When either limit is reached, a marker record is written to the output with a descriptive message indicating which limit was hit, the actual record count, and the collection time window. The two limits produce distinct markers (TRUNCATED_HEADERS and TRUNCATED_DETAILS) so they can be distinguished in Sentinel.