SAP ERP

Reference

SAP ERP is an enterprise resource planning software developed by SAP SE. SAP ERP incorporates the key business functions of an organization. The SAP ERP connector for Power Automate and Power Apps allows you to invoke RFC and BAPI functions using on-premises data gateway.

This connector is available in the following products and regions:

Service	Class	Regions
Power Automate	Premium	All Power Automate regions
Power Apps	Premium	All Power Apps regions

Contact
Name	Microsoft
URL	Microsoft Power Automate Support Microsoft Power Apps Support

Connector Metadata
Publisher	Microsoft
Website	https://www.sap.com/products/enterprise-management-erp.html
Privacy policy	https://www.sap.com/about/legal/privacy.html

Using the SAP ERP connector

To get started on using this connector, read the following blog posts:

Pre-requisites

The SAP ERP connector has a dependency on the following components, which must be installed on the same machine:

On-premise data gateway (Version October 2023 - 3000.194 or higher)
Microsoft C++ Runtime DLL Version 14.x (Visual Studio 2015, 2017, 2019, and 2022) (SAP NCo dependency)
SAP .NET Connector from SAP
- Choose the NCo 3.1 64-bit version (32-bit is not supported)
- Do not install NCo 3.0 (unsupported)
- Requires valid S-user for download access. You may need to reach out to your SAP team.

SAP Authorizations

Your SAP user account needs access to the RFC_METADATA function group and the respective function modules for the following operations:

Operations	Access to function modules
RFC actions	`RFC_GROUP_SEARCH`, `DD_LANGU_TO_ISOLA`
BAPI actions	`BAPI_TRANSACTION_COMMIT`, `BAPI_TRANSACTION_ROLLBACK`, `RPY_BOR_TREE_INIT`, `SWO_QUERY_METHODS`, `SWO_QUERY_API_METHODS`
IDoc actions	`IDOCTYPES_LIST_WITH_MESSAGES`, `IDOCTYPES_FOR_MESTYPE_READ`, `INBOUND_IDOCS_FOR_TID`, `OUTBOUND_IDOCS_FOR_TID`, `GET_STATUS_FROM_IDOCNR`, `IDOC_RECORD_READ`
Read SAP table action	`RFC BBP_RFC_READ_TABLE` or `RFC_READ_TABLE`
Minimum access	`RFC_METADATA_GET`, `RFC_METADATA_GET_TIMESTAMP`

Authentication

The connector supports SAP Authentication, Windows Authentication, Microsoft Entra ID with Kerberos, and Microsoft Entra ID with Certificates (Public Preview).

Because the connector is designed to be used by multiple users of an app, the connections are not shared. Rather, each user will authenticate with the SAP system. The user credentials are provided in the connection, while additional details required to connect to the SAP system (like the server details, security configuration) are provided as part of the action.

SAP Authentication

Basic SAP authentication using SAP username and password.

Windows Authentication

Requires additional setup for Secure Network Communication (SNC). Requires additional setup for Kerberos-based SSO from Power Platform to on-premises data sources.

Microsoft Entra ID (with Kerberos)

Requires additional setup for Secure Network Communication (SNC). Requires additional setup for Kerberos-based SSO from Power Platform to on-premises data sources.

Microsoft Entra ID (with Certificates)

Microsoft Entra ID (with Certificates) is in Public Preview.

Requires additional setup for Secure Network Communication (SNC). Requires additional setup for Certificate-based SSO from Power Platform to on-premises data sources.

Configure Kerberos-based SSO

The SAP SNC name for a user (p:CN=JANEDOE@REDMOND.CORP.CONTOSO.COM) must equal the users Microsoft Entra ID fully qualified domain name (JANEDOE@REDMOND.CORP.CONTOSO.COM) for both Windows and Microsoft Entra ID authentication.

SAP SNC Name

Property	Description
Use SNC	Set to "Yes" if you want to enable SNC
SNC library	The SNC library name or path relative to NCo installation location or absolute path. Examples are `sapsnc.dll` or `.\security\sapsnc.dll` or `c:\security\sapsnc.dll`.
SNC SSO	Specifies whether the connector will use the identity of the service or the end user credentials
SNC My Name	If required, specify the identity to be used
SNC Partner Name	The name of the back-end SNC server
SNC Quality of Protection	The quality of service to be used for SNC communication of this particular destination or server. The default value is defined by the back-end system. The maximum value is defined by the security product used for SNC.

If Microsoft Entra ID or Windows Authentication is needed for the SAP ERP Connector you need to:

Configure Kerberos-based SSO from Power Platform to on-premises data sources
Configure SAP ERP to enable using CommonCryptoLib (sapcrypto.dll)

Configure Kerberos-based SSO from Power Platform to on-premises data sources Pre-requisites

After installation of the Data Gateway, the gateway runs as the machine-local service account, NT Service\PBIEgwService. To enable Kerberos constrained delegation, you have two options:

The gateway must run as a domain account, see documentation on how to Change Gateway Service Account ; or
Have your Microsoft Entra ID instance synchronized with your local Microsoft Entra ID instance (by using Microsoft Entra ID DirSync/Connect)

Configuration Steps:

Obtain domain admin rights to configure SPNs (SetSPN) and Kerberos constrained delegation settings
Configure Kerberos constrained delegation for the gateway and data source
Configure an SPN for the gateway service account
Add gateway service account to Windows Authorization and Access Group if required
Decide on the type of Kerberos constrained delegation to use:
- Configure the gateway service account for standard Kerberos constrained delegation
- Configure the gateway service account for resource-based Kerberos constrained delegation
Grant the gateway service account local policy rights on the gateway machine
Set user-mapping configuration parameters on the gateway machine (if necessary)

For more details on how to configure this, refer to Power BI documentation for Configure Kerberos-based SSO from Power BI service to on-premises data sources.

Configure SAP ERP to enable using CommonCryptoLib (sapcrypto.dll)

Ensure that your SAP ERP server is correctly configured for Kerberos SSO using CommonCryptoLib. If it is, you can use SSO to access your SAP ERP server with an SAP tool like SAP GUI that has been configured to use CommonCryptoLib. For more information on setup steps, see SAP Single Sign-On: Authenticate with Kerberos/SPNEGO. Your server should use CommonCryptoLib as its SNC Library and have an SNC name that starts with CN. For more information on SNC name requirements (specifically, the snc/identity/as parameter), see SNC Parameters for Kerberos Configuration.
Ensure that SAP Secure Login Client (SLC) isn't running on the computer the gateway is installed on. SLC caches Kerberos tickets in a way that can interfere with the gateway's ability to use Kerberos for SSO. If SLC is installed, uninstall it or make sure you exit SAP Secure Login Client. Right-click the icon in the system tray and select Log Out and Exit before you attempt an SSO connection by using the gateway. SLC isn't supported for use on Windows Server machines. For more information, see SAP Note 2780475 (s-user required).

SAP Secure Login Client

If you uninstall SLC or select Log Out and Exit, open a cmd window and enter klist purge to clear any cached Kerberos tickets before you attempt an SSO connection through the gateway.
Download 64-bit CommonCryptoLib (sapcrypto.dll) version 8.5.25 or greater from the SAP Launchpad, and copy it to a folder on your gateway machine. In the same directory where you copied sapcrypto.dll, create a file named sapcrypto.ini, with the following content:

ccl/snc/enable_kerberos_in_client_role = 1

The .ini file contains configuration information required by CommonCryptoLib to enable SSO in the gateway scenario.

Note

These files must be stored in the same location; in other words, /path/to/sapcrypto/ should contain both sapcrypto.ini and sapcrypto.dll.

Both the gateway service user and the Microsoft Entra ID user that the service user impersonates need read and execute permissions for both files. We recommend granting permissions on both the .ini and .dll files to the Authenticated Users group. For testing purposes, you can also explicitly grant these permissions to both the gateway service user and the Microsoft Entra ID user you use for testing. In the following screenshot we've granted the Authenticated Users group Read & execute permissions for sapcrypto.dll:

Grant Read & execute permissions for Authenticated Users

If you don't already have an SAP BW data source associated with the gateway you want the SSO connection to flow through, add one on the Manage gateways page in the Power BI service. If you already have such a data source, edit it:

Choose SAP Business Warehouse as the Data Source Type if you want to create an SSO connection to a BW Application Server.
Select Sap Business Warehouse Message Server if you want to create an SSO connection to a BW Message Server.

Create a CCL_PROFILE system environment variable and set its value to the path to sapcrypto.ini.

CCL_PROFILE system environment variable:

Create and set system environment variables

The sapcrypto.dll and .ini files must exist in the same location. In the above example, sapcrypto.ini and sapcrypto.dll are both located on the desktop.

Restart the gateway service.

Restart the gateway service

Microsoft Entra ID Authentication

This authentication type will only work with the following actions:

Call SAP function (V2)
Create stateful session
Read SAP table with parsing

The Microsoft Entra ID SAP Service Principal account must have AES 128 or AES 256 defined on the msDS-SupportedEncryptionType attribute. This blog post contains a table to help calcuate decimal/hex values for supported encryption types.

Known Issues and Limitations

The following are some of the known issues and limitations of the SAP ERP connector:

The connector supports only RFCs and BAPIs.
The connector does not support receiving messages from SAP Server.
Transactional RFCs (tRFCs) are not supported.
The gateway has a 2-MB payload limit for write operations and an 8-MB compressed data response limit for read operations.
Data gateway clusters in load-balancing mode aren't supported by stateful SAP actions. Stateful communications must remain on the same data gateway cluster node. For stateful SAP actions, use the data gateway either in non-cluster mode or in a cluster that's set up for failover only.
Upgrade your On-premises data gateway to the latest version if you receive an error during flow authoring similiar to: Length of the name of the RFC '<RFC_NAME>?honorSapOptionalFlag=1' is larger than the maximum allowed limit of 30
RFC/BAPI parameters fetched from SAP are cached within the On-premises data gateway. Restart the On-premises data gateway service to clear the cache and retrieve new values.

Collecting Logs

The following logs are useful to troubleshoot SapErp connector issues when contacting Microsoft support:

Enable Additional logging in the Diagnostics settings of your on-premises data gateway app to get Informational SAP Adapter's extended logs and SapErp Adapter's traces.
Update the following setting in the configuration file Microsoft.PowerBI.DataMovement.Pipeline.GatewayCore.dll.config. Typically, this configuration file sits where your on-premised data gateway is installed (e.g. C:\Program Files\On-premises data gateway\Microsoft.PowerBI.DataMovement.Pipeline.GatewayCore.dll.config).
```
<setting name="SapTraceLevel" serializeAs="String">
   <value>Verbose</value>
</setting>
```

SAP System Property Guidance

For actions that support the SAP system parameter, use the following table for guidance.

Property	Description
AppServerHost	The hostname of the SAP Application Server.
AppServerService	The service name or port number of the specific SAP Application Server to connect to (Optional for connection type (Logon) A - Application Server).
Client	The SAP client ID to connect to the SAP system. The SAP backends' client (or 'Mandant') into which to log in. It is a number ranging from 000 to 999.
Language	The language code to connect to the SAP system with. A two letter ISO 639-1 code. Must be installed within SAP. This overrides the browsers language setting.
LogonGroup	The Logon Group for the SAP System, from which the Message Server shall select an Application Server (Only available if connection type (Logon) is B - Message Server (Group)).
LogonType	The type of logon to the SAP System, either Application Server Logon (Type A) or Group Logon (Type B aka Message Server). Allowed values: ApplicationServer, Group
MessageServerHost	The hostname of the SAP System's Message Server (central instance) aka R3 System Name (Mandatory if connection type (Logon) is B - Message Server (Group)).
MessageServerService	The Service Name (as defined in etc/services) or the Port Number under which the Message Server is listening for load-balancing requests (Mandatory if connection type (Logon) is B - Message Server (Group) and System ID is not present).
SafeTyping	By default, when you create your SAP connection, strong typing is used to check for invalid values by performing validation against the schema. This behavior can help you detect issues earlier. The Safe Typing option is available for backward compatibility and only checks the string length. Allowed values: true, false
SncCertificate	X.509 certificate in Base64 encoded form, without the begin or end certificate tags.
SncMyName	The installed SNC solution usually knows its own SNC name. Only for solutions supporting 'multiple identities', you may need to specify the identity to be used for this destination/server (optional).
SncLibraryPath	Name or path of the SNC library to be used. With the On-Premises Data Gateway, the path can be an absolute or relative to the NCo library.
SncPartnerName	The backends' SNC name (Required when Logon Type is Application Server).
SncQop	Quality of Service to be used for SNC communication of this destination/server. Allowed values: Authentication, Integrity, Privacy, Default, Maximum
SncSso	The SNC SSO specifies whether to use SNC identity or credentials provided on RFC level.
SsoCertificateSubject	Subject of the certificate on the OPDG Windows machine for Certificate-based authentication with Microsoft Entra ID
SystemId	The SAP system's three-letter system ID (Mandatory if connection type (Logon) is B - Message Server (Group) and Message Server Service is not present).
SystemNumber	The SAP System's System Number. It is a number ranging from 00 to 99 (Mandatory if connection type (Logon) is A - Application Server).
UseSnc	When selected, the connections will be secured with SNC. Allowed values: Yes

Migrating from `Call SAP Function` to `Call SAP Function (v2)`

The Call SAP Function was deprecated in July of 2023, and support will end in July 2026. Users will need to migrate their existing v1 actions before that time, or their flows will break.

Replace multiple form fields with a single JSON string for connection properties.
Use the following property mapping:

v1 Field Label	v2 Property
AS Host	AppServerHost
Client	Client
AS System Number	SystemNumber
SAP function name	N/A - not relevant to connection string
Stateful Session	N/A - Stateful sessions are available in "Advanced Options" where an ID may be specified for `Session Id`. Steps with the same `Session Id` will be run as part of the same stateful session.
Use SNC	UseSnc
SNC library	SncLibraryPath
SNC SSO	SncSso
SNC My Name	SncMyName
SNC Partner Name	SncPartnerName
SNC Quality of Protection	SncQop

Example

Call SAP Function V1:

Call SAP Function v1

Call SAP Function V2:

Call SAP Function v2

Given the screenshot, the connection string would look like this:

{
  "AppServerHost": "sap.example.com",
  "Client": 100,
  "SystemNumber": "00"
}

Since Use SNC is "No" in the screenshot, no property is needed. The default is "false"

Using Environment Variables

Flows built in solutions can manage these connection string using Environment Variables. This is the recommended method, as it allows you to change connection parameters based on the environment. If your flow is not in a solution, keep the string handy for copy/paste.

General Limits

Name	Value
Maximum number of properties supported by dynamic schema. Parse JSON action can be used to generate schema from a sample payload if exceeding maximum number of properties.	1024

Creating a connection

The connector supports the following authentication types:


Azure AD Integrated	Use Azure Active Directory to access SAP.	Department of Defense (DoD) in Azure Government and MOONCAKE and US Government (GCC) and US Government (GCC-High) only	Not shareable
Microsoft Entra ID (with certificates)	Use Microsoft Entra ID Principal Propagation via X509 certificates to access SAP.	All regions	Not shareable
Microsoft Entra ID (with Kerberos)	Use Microsoft Entra ID Principal Propagation via Kerberos to access SAP.	All regions except Department of Defense (DoD) in Azure Government and MOONCAKE and US Government (GCC) and US Government (GCC-High)	Not shareable
SAP Authentication	Use SAP username and password to access SAP server.	All regions	Not shareable
Windows Authentication	Use windows username and password to access your SAP Server.	All regions	Not shareable
Default [DEPRECATED]	This option is only for older connections without an explicit authentication type, and is only provided for backward compatibility.	All regions	Not shareable

Azure AD Integrated

Auth ID: OAuthSso

Applicable: Department of Defense (DoD) in Azure Government and MOONCAKE and US Government (GCC) and US Government (GCC-High) only

Use Azure Active Directory to access SAP.