Enterprise Application Proxy is not working for SAP Business One HANA

Question

Enterprise Application Proxy is not working for SAP Business One HANA

85817493 0

We have configured Microsoft Entra Application Proxy to provide external access to SAP Business One HANA hosted on an on-premises Linux server. The connector is operational and registered successfully, but HTTPS traffic from the connector to the backend SAP server is failing with a TLS handshake error (SSPI). Accessing the application via the external proxy URL results in HTTP 401 and HTTP 500 errors.
Environment

Application: SAP Business One HANA (web client)
Backend server: Linux, IP pii removed, port 443, internally accessible via https://sapb1/
Connector server: Windows Server, IP pii removed
Connector version: Microsoft Entra Private Network Connector v1.5.4594.0
Connector group: Default – North America
Firewall: FortiGate 60F (outbound policy configured for connector server; Microsoft Azure, Azure AD, Service Bus, and Connectors internet services allowed on HTTPS/HTTP/AMQP 5671)
External URL: https://sapbusinessone-azengineers.msappproxy.net
Internal URL: https://sapb1/
Pre-authentication: Passthrough
Backend SSL validation: Disabled
Translate URLs in headers: Enabled
Translate URLs in application body: Enabled

What is working

Connector service is running with no errors in the Windows Event Log
Connector is successfully registered and visible in the Entra portal
login.microsoftonline.com:443 is reachable from the connector server
bootstrap.msappproxy.net:443 is reachable from the connector server
SAP backend is reachable internally from the connector server (Test-NetConnection pii removed succeeds)
FortiGate packet sniffer confirms outbound traffic from pii removed is reaching servicebus.windows.net (65.55.54.16) via the WAN interface
SAP Web UI resources (SAP UI5/jQuery) are partially loading in the browser through the proxy URL

Shubham Sharma 16,195 Reputation points Microsoft External Staff Moderator

2026-05-11T01:55:58.8133333+00:00
Hey there – it looks like your Application Proxy connector is successfully registered and talking to Azure, but it’s failing to complete the TLS handshake when it tries to reach your SAP Business One HANA backend.

Here’s a path you can take to narrow down and fix the issue:

Validate your Internal URL and SNI • In the Entra portal, make sure the Internal URL exactly matches the FQDN on your SAP server’s TLS certificate (for example, sapb1.contoso.com rather than just “sapb1”). • On the connector machine, confirm name resolution:
Test-NetConnection sapb1.contoso.com -Port 443
• Then try a quick PowerShell fetch, skipping cert validation, to see if it ever gets past the handshake:
Invoke-WebRequest https://sapb1.contoso.com -SkipCertificateCheck -UseBasicParsing
If that fails with a TLS/SSPI error, you know it’s not App Proxy yet but a pure SChannel <> SAP mismatch.

Check TLS versions and cipher suites • SAP HANA’s web-server may only be offering ciphers or TLS versions that Windows’s SChannel won’t negotiate. • Ensure SAP is configured to allow at least TLS 1.2 with an ECDHE cipher suite (which SChannel supports by default). • If your SAP instance is locked to very old or very new ciphers/TLS, adjust it so the connector and SAP can agree on a protocol/cipher.

Gather SChannel logs on the connector • Enable detailed Schannel event logging in the registry under: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\EventLogging • Reproduce the failure, then look in the System event log for Schannel errors—those hex error codes will clue you in on whether it’s name mismatch, unsupported protocol, expired cert, etc.

Run the Application Proxy connector diagnostics • In the Azure portal, go to Azure Active Directory > Enterprise applications > your SAP app > Connectors and click “Diagnostics.” • Use the built-in tests to hit your internal URL and see exactly which stage is failing.

Double-check your App Proxy settings • Pre-authentication should be set to Passthrough as you have it. • Backend SSL validation disabled will skip trust-chain checks, but it doesn’t override name/SNI matching—so that URL/FQDN step is still critical. • URL translation on headers/body is fine, but make sure it isn’t inadvertently mangling host headers.

Reference docs:

• Debug Application Proxy connector issues:

https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy-debug-connectors

• Application Proxy troubleshooting guide:

https://docs.microsoft.com/azure/active-directory/app-proxy/application-proxy-troubleshoot

• Debug Application Proxy application issues (page-render/CORS/etc):

https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy-debug-apps

Hope this helps you pinpoint the TLS handshake snag so your SAP Business One HANA web client can go live through App Proxy! Let me know what you find out.

1 answer

Your answer

Answer 1

85817493 0

Thank you Mr. Sharma,
As per the diagnostic test, everything is working and configured correctly. But still Application proxy is not working, it is landing at login page for sap business one and after entering local credentials for sap it keeps finding the next page. User's image

Shubham Sharma 16,195 Reputation points Microsoft External Staff Moderator

2026-05-11T08:14:20.4233333+00:00
85817493

Thank you for your reply.

Based on your scenario, diagnostics screenshot, and behavior (login page loads → after entering SAP credentials → page keeps loading / never completes), the issue is NOT connector or TLS anymore — it has moved to application-layer behavior (session, headers, URL translation, or app rendering). This symptom is common with SAP UI5 / SAP Business One web client behind App Proxy.

Root cause

From Microsoft guidance and similar SAP/App Proxy cases:

Application content / resources not fully published

SAP UI5 apps load multiple dynamic resources (scripts, APIs, endpoints).

If App Proxy is publishing a partial path (or root incorrectly), the app:

loads login page

authenticates

fails to load dependent resources → results in infinite loading / spinner

Microsoft confirms this behavior:

Apps may load but not function correctly when required content exists outside the published path

For your reference: https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-troubleshoot

Session / cookie or host-header mismatch (very common with SAP)

With:

Passthrough authentication

SAP doing its own login session

External domain (msappproxy.net) ≠ Internal domain (sapb1)

SAP may:

issue cookies bound to internal hostname

expect same-host requests

reject or lose session after redirect

Result:

Login succeeds → next request loses session → infinite loading / retry loop

URL translation not enough for SAP UI5

Even though you enabled:

Translate URLs in headers

Translate URLs in body

SAP UI5 often:

uses hardcoded absolute URLs

performs AJAX calls to internal hostname

If even one call points to https://sapb1/..., it fails externally.

Below is the resolution: -

Step 1 – Publish the full root URL

Ensure:

Internal URL = https://sapb1.contoso.com/

NOT https://sapb1/

NOT https://sapb1/somepath

Must match:

FQDN in certificate (SNI requirement)

Full application root

Microsoft guidance:

Publish the highest-level path to include all scripts and resources needed by the app.

https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-troubleshoot

Step 2 – Fix hostname consistency (important for SAP)

Change setup to:

Option A (Recommended)

Use Custom Domain

Example: sap.company.com

Map it in App Proxy

Configure same FQDN on SAP

Ensures:

Cookies valid

Sessions stable

No host mismatch

Option B (If no custom domain)

Force SAP to:

accept external hostname OR

disable strict host validation

(Handled in SAP Web Dispatcher / HANA config)

Step 3 – Validate session cookies

Check using browser DevTools (F12):

After login:

Are cookies issued?

Domain = sapb1 (internal) → problem

Domain = external URL

If mismatch:

SAP must be configured for:

proxy mode / external URL awareness

Step 4 – Check failed network calls

Open F12 → Network tab and look for:

401 / 403 / 404

Requests going to: https://sapb1/...

instead of: https://<external-url>.msappproxy.net

Microsoft explicitly recommends using browser dev tools to detect missing resources

Step 5 – SAP-specific fix

For SAP Business One / UI5:

Configure:

Reverse proxy support / external URL

X-Forwarded headers handling

Ensure SAP respects:

X-Forwarded-Host

X-Forwarded-Proto

Step 6 – Reconsider Passthrough mode

Currently using Pre-authentication: Passthrough

This causes:

No identity normalization

Raw SAP session handling

Passthrough bypasses Entra authentication and session control

https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-security

Try:

Switch to Azure AD pre-authentication

Even without SSO

Improves session consistency
Shubham Sharma 16,195 Reputation points Microsoft External Staff Moderator

2026-05-13T08:28:27.9333333+00:00

85817493

Following up to see if the provided resolution was helpful. If you have any further queries do let us know.

Share via

Enterprise Application Proxy is not working for SAP Business One HANA

1 answer

Your answer