SAP Access

Question

I need to have access to my SAP to do my Work Orders?

Answer 1

Access to SAP work orders can be enabled by integrating SAP with Microsoft Entra ID and, if needed, Microsoft Entra Private Access, depending on how SAP is deployed.

Key options:

1. Enable single sign-on (SSO) to SAP

• Configure Microsoft Entra ID as the identity provider for SAP so that users sign in with their Entra credentials and then access SAP applications (for example, SAP Fiori or SAP GUI-based front ends) to work on work orders.
• For SAP NetWeaver-based systems, SSO can be set up using SAML or OAuth as described in the SAP NetWeaver integration guidance.
• For SAP SaaS and modern apps, configure Microsoft Entra ID as the corporate identity provider via SAP Cloud Identity Services so that SAP applications trust Microsoft Entra for authentication.

2. Provide access to SAP applications via SAP Cloud Identity Services

• Provision users and groups from Microsoft Entra ID into SAP Cloud Identity Services using the SAP Cloud Identity Services enterprise application.
• From SAP Cloud Identity Services, provision accounts into the downstream SAP applications (for example, SAP S/4HANA or other SAP apps where work orders are managed) so that users can log in and perform their work.

3. Provide access to on-premises SAP systems

• For on-premises SAP ECC or S/4HANA systems, provision users from Microsoft Entra ID either:
  • Via SAP Cloud Identity Services to SAP S/4HANA On-Premise through the SAP cloud connector, or
  • Via the Microsoft Entra provisioning service and on-premises web services connector to SAP ECC/R/3, exposing the required BAPIs for user creation and updates.
• Once provisioned and SSO is configured, users can access the on-premises SAP system (potentially via Microsoft Entra Private Access if remote/private network access is required) to execute work orders.

4. Control and secure access

• Use Microsoft Entra ID to manage who is assigned to SAP applications and roles (for example, via groups and entitlement management), ensuring only authorized users can access work-order-related functionality.
• Optionally integrate Microsoft Entra entitlement management with SAP Cloud Identity Access Governance (IAG) so SAP business roles (including work-order roles) can be granted through Microsoft Entra access packages.

To gain access, contact the Microsoft Entra or SAP administrator in the organization and request assignment to the relevant SAP application and role. They will:

1. Ensure the user account is provisioned from Microsoft Entra ID into the appropriate SAP system via SAP Cloud Identity Services or the on-premises connector.
2. Configure or confirm SSO from Microsoft Entra ID to the SAP application.
3. Grant the SAP role(s) that allow work-order creation and processing.

---

References:

• Manage access to your SAP applications
• Connect to SAP from workflows in Azure Logic Apps
• Security operations for SAP on Azure