| title | Install a Microsoft Sentinel solution for SAP applications | ||
|---|---|---|---|
| description | Learn how to install a Microsoft Sentinel solution for SAP applications from the content hub to your Log Analytics workspace enabled for Microsoft Sentinel. | ||
| author | mberdugo | ||
| ms.author | monaberdugo | ||
| ms.topic | how-to | ||
| ms.date | 09/30/2025 | ||
| appliesto |
|
||
| ms.collection | usx-security | ||
| zone_pivot_groups | sentinel-sap-connection | ||
| ms.custom | sfi-image-nochange |
The Microsoft Sentinel solutions for SAP applications include an SAP data connector, which collects logs from your SAP systems and sends them to your Microsoft Sentinel workspace, and out-of-the-box security content, which helps you gain insight into your organization's SAP environment and detect and respond to security threats. Installing your solution is a required step before you can configure your data connector.
:::zone pivot="connection-agent"
[!INCLUDE data-connector-agent-deprecation]
:::image type="content" source="media/deployment-steps/install-solution.png" alt-text="Diagram of the SAP solution deployment flow, highlighting the Install solution content step." border="false":::
:::zone-end
:::zone pivot="connection-agentless"
:::image type="content" source="media/deployment-steps/install-solution-agentless.png" alt-text="Diagram of the SAP solution deployment flow, highlighting the Install solution content step." border="false":::
:::zone-end
Content in this article is relevant for your security team.
:::zone pivot="connection-agentless"
:::zone-end
To deploy a Microsoft Sentinel solution for SAP applications from the content hub, you need:
- A Log Analytics workspace enabled for Microsoft Sentinel.
- Read and write permissions to the workspace. For more information, see Roles and permissions in Microsoft Sentinel.
Make sure that you also review the prerequisites for deploying Microsoft Sentinel solution for SAP applications, especially Azure prerequisites.
:::zone pivot="connection-agentless"
Installing the Microsoft Sentinel Solution for SAP makes both the data connector agent and the agentless data connector available to you from the Microsoft Sentinel Configuration > Data connectors page. The solution also deploys security content, such as the SAP -Audit Controls workbook and SAP-related analytics rules.
-
In the Microsoft Sentinel Content hub, search for SAP to install the SAP applications solution.
-
On the Microsoft Sentinel solution for SAP applications page, select Create to define deployment settings. For example:
:::image type="content" source="./media/deploy-sap-security-content/sap-solution.png" alt-text="Screenshot that shows the Microsoft Sentinel solution for SAP applications solution pane." lightbox="./media/deploy-sap-security-content/sap-solution.png":::
-
On the default Basics tab, scroll down to select where to install the solution. If you're working with the Microsoft Sentinel solution for SAP applications in multiple workspaces, select Some of the data is on a different workspace, and then define your target workspace, your SOC workspace, and SAP workspace. For example:
For example:
:::image type="content" source="./media/deploy-sap-security-content/sap-multi-workspace.png" alt-text="Screenshot that shows how to configure the Microsoft Sentinel solution for SAP applications to work across multiple workspaces.":::
-
Select Review + create or Next to browse through the solution components. When you're ready, select Create
The deployment process can take a few minutes. After the deployment is finished, you can view the deployed content in Microsoft Sentinel.
Tip
If you want the SAP and SOC data to be kept on the same workspace with no additional access controls, do not select Some of the data is on a different workspace. In such cases, for more information, see SAP and SOC data maintained in the same workspace.
For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.
:::zone-end
:::zone pivot="connection-agent"
Installing the Microsoft Sentinel Solution for SAP makes both the data connector agent and the agentless data connector available to you from the Microsoft Sentinel Configuration > Data connectors page. The solution also deploys security content, such as the SAP -Audit Controls workbook and SAP-related analytics rules.
-
In the Microsoft Sentinel Content hub, search for SAP to install the SAP applications solution.
-
On the Microsoft Sentinel solution for SAP applications page, select Create to define deployment settings. For example:
:::image type="content" source="./media/deploy-sap-security-content/sap-solution.png" alt-text="Screenshot that shows the Microsoft Sentinel solution for SAP applications solution pane." lightbox="./media/deploy-sap-security-content/sap-solution.png":::
-
On the default Basics tab, scroll down to select where to install the solution. If you're working with the Microsoft Sentinel solution for SAP applications in multiple workspaces, select Some of the data is on a different workspace, and then define your target workspace, your SOC workspace, and SAP workspace. For example:
For example:
:::image type="content" source="./media/deploy-sap-security-content/sap-multi-workspace.png" alt-text="Screenshot that shows how to configure the Microsoft Sentinel solution for SAP applications to work across multiple workspaces.":::
-
Select Review + create or Next to browse through the solution components. When you're ready, select Create
The deployment process can take a few minutes. After the deployment is finished, you can view the deployed content in Microsoft Sentinel.
Tip
If you want the SAP and SOC data to be kept on the same workspace with no additional access controls, do not select Some of the data is on a different workspace. In such cases, for more information, see SAP and SOC data maintained in the same workspace.
For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.
:::zone-end
When the deployment is finished, display your new content by browsing again to the Microsoft Sentinel for SAP applications solution from the Content hub. Alternatively:
-
For the built-in SAP workbooks, in Microsoft Sentinel, go to Threat Management > Workbooks > Templates.
-
For a series of SAP-related analytics rules, go to Configuration > Analytics Rule templates.
Your data connector doesn't appear as connected until you configure your data connector and complete the connection.
[!div class="nextstepaction"] Configure your SAP system for the Microsoft Sentinel solution
For more information, see Microsoft Sentinel solution for SAP applications: security content reference.