Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Microsoft Sentinel solutions for SAP applications include an SAP data connector, which collects logs from your SAP systems and sends them to your Microsoft Sentinel workspace, and out-of-the-box security content, which helps you gain insight into your organization's SAP environment and detect and respond to security threats. Installing your solution is a required step before you can configure your data connector.
Important
The data connector agent for SAP is being deprecated and will be permanently disabled by September 30th 2026. We recommend that you migrate to the agentless data connector. Learn more about the agentless approach from our blog post.
Content in this article is relevant for your security team.
Prerequisites
To deploy a Microsoft Sentinel solution for SAP applications from the content hub, you need:
- A Log Analytics workspace enabled for Microsoft Sentinel.
- Read and write permissions to the workspace. For more information, see Roles and permissions in Microsoft Sentinel.
Make sure that you also review the prerequisites for deploying Microsoft Sentinel solution for SAP applications, especially Azure prerequisites.
Install the solution
Installing the Microsoft Sentinel Solution for SAP makes both the data connector agent and the agentless data connector available to you from the Microsoft Sentinel Configuration > Data connectors page. The solution also deploys security content, such as the SAP -Audit Controls workbook and SAP-related analytics rules.
In the Microsoft Sentinel Content hub, search for SAP to install the SAP applications solution.
On the Microsoft Sentinel solution for SAP applications page, select Create to define deployment settings. For example:
On the default Basics tab, scroll down to select where to install the solution. If you're working with the Microsoft Sentinel solution for SAP applications in multiple workspaces, select Some of the data is on a different workspace, and then define your target workspace, your SOC workspace, and SAP workspace. For example:
For example:
Select Review + create or Next to browse through the solution components. When you're ready, select Create
The deployment process can take a few minutes. After the deployment is finished, you can view the deployed content in Microsoft Sentinel.
Tip
If you want the SAP and SOC data to be kept on the same workspace with no additional access controls, do not select Some of the data is on a different workspace. In such cases, for more information, see SAP and SOC data maintained in the same workspace.
For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.
Install the solution
Installing the Microsoft Sentinel Solution for SAP makes both the data connector agent and the agentless data connector available to you from the Microsoft Sentinel Configuration > Data connectors page. The solution also deploys security content, such as the SAP -Audit Controls workbook and SAP-related analytics rules.
In the Microsoft Sentinel Content hub, search for SAP to install the SAP applications solution.
On the Microsoft Sentinel solution for SAP applications page, select Create to define deployment settings. For example:
On the default Basics tab, scroll down to select where to install the solution. If you're working with the Microsoft Sentinel solution for SAP applications in multiple workspaces, select Some of the data is on a different workspace, and then define your target workspace, your SOC workspace, and SAP workspace. For example:
For example:
Select Review + create or Next to browse through the solution components. When you're ready, select Create
The deployment process can take a few minutes. After the deployment is finished, you can view the deployed content in Microsoft Sentinel.
Tip
If you want the SAP and SOC data to be kept on the same workspace with no additional access controls, do not select Some of the data is on a different workspace. In such cases, for more information, see SAP and SOC data maintained in the same workspace.
For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.
View deployed content
When the deployment is finished, display your new content by browsing again to the Microsoft Sentinel for SAP applications solution from the Content hub. Alternatively:
For the built-in SAP workbooks, in Microsoft Sentinel, go to Threat Management > Workbooks > Templates.
For a series of SAP-related analytics rules, go to Configuration > Analytics Rule templates.
Your data connector doesn't appear as connected until you configure your data connector and complete the connection.
Next step
Related content
For more information, see Microsoft Sentinel solution for SAP applications: security content reference.