Migrate to Innovate Summit:
Learn how migrating and modernizing to Azure can boost your business's performance, resilience, and security, enabling you to fully embrace AI.Register now
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Microsoft Sentinel in the Azure portal, Microsoft Sentinel in the Microsoft Defender portal
There might be instances where you need to halt the data collection from your SAP applications by the Microsoft Sentinel data connector agent, whether for maintenance, troubleshooting, or other administrative reasons.
This article provides step-by-step instructions on how to stop the ingestion of SAP logs into Microsoft Sentinel and disable the data connector agent.
If you're using the agentless solution (limited preview), remove the data connector and solution from Microsoft Sentinel, and then clean up any resources and changes you'd made to your SAP system for the integration.
Prerequisites
Before you stop the data collection from your SAP applications, ensure you have administrative access to:
The SAP data connector agent machine or container.
Stop log ingestion and disable the connector
To stop ingesting SAP logs into Microsoft and to stop the data stream from the Docker container, sign into your data connector agent machine and run:
docker stop sapcon-[SID/agent-name]
The Docker container stops and doesn't send any more SAP logs to Microsoft Sentinel. This stops both the ingestion and billing for the SAP system related to the connector.
If you need to reenable the Docker container, sign into the data connector agent machine and run:
docker start sapcon-[SID]
To stop ingesting a specific SID for a multi-SID container, make sure that you also delete the SID from the connector page UI in Microsoft Sentinel. This option is relevant only if you deployed the agent via the portal.
In Microsoft Sentinel, select Configuration > Data connectors and search for Microsoft Sentinel for SAP.
Select the data connector row and then select Open connector page in the side pane.
In the Configuration area on the Microsoft Sentinel for SAP data connector page, locate the SID agent you want to remove and select Delete.
Remove the user role and any optional CR installed on your ABAP system
If you're turning off the SAP data connector and stopping log ingestion from your SAP system, you might want to also remove the user role and optional CRs installed on your ABAP system.
To do so, import the deletion CR NPLK900259 into your ABAP system. For more information, see the SAP documentation.
Understand the Microsoft Sentinel solution for SAP BTP. The module explores the benefits of monitoring BTP activity, and describes the steps for deploying the Microsoft Sentinel solution for SAP BTP.