Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Architecture and deployment

Deploy Microsoft Sentinel solution for SAP BTP | Microsoft Learn

21 October 2026New feature+26 / −3 lines

In brief

The article now documents a connector that ingests SAP Application Vulnerability Report Service findings into Microsoft Sentinel, including setup prerequisites, credentials, polling and ingestion-delay settings, verification, and related analytics content.

What Defender admins need to know

SAP BTP administrators can integrate application vulnerability findings into Sentinel. No action is required unless they want to configure this integration.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Deploy Microsoft Sentinel solution for SAP BTP | Microsoft Learn

This article describes how to deployDeploy the Microsoft Sentinel solution for SAP Business Technology Platform (BTP) system. The Microsoft Sentinel solution for SAP BTP monitors and protects your SAP BTP system. It collectsto collect audit logs and activity logs from the BTP infrastructure and BTP-based apps, detect suspicious activity, and then detects threats, suspicious activities, illegitimate activities, and more.investigate threats. For an overview, see Microsoft Sentinel Solution for SAP BTP.

Important

  • Your organization uses SAP BTP (in a Cloud Foundry environment) to streamline interactions with SAP applications and other business applications.
  • You have an SAP BTP Subaccount (which supports BTP Subaccounts in the Cloud Foundry environment). You can also use a SAP BTP trial account.
  • You have the SAP BTP auditlog-management service and service key (see Set up the BTP Subaccount and solution).
  • To ingest application vulnerability findings, you have the SAP Application Vulnerability Report Service enabled and a service key for it. This connector uses separate credentials from the SAP BTP audit-log connector.
  • You have the Microsoft Sentinel Contributor role on the target Microsoft Sentinel workspace.

Set up the BTP subaccount and solution

3. On the **SAP BTP** connector page, confirm that Microsoft Sentinel receives the BTP data, or query the **SAPBTPAuditLog\_CL** table directly.
  1. Enable the SAP BTP workbook and the SAP BTP built-in analytics rules that are provided as part of the solution by following the guidelines for deploying Microsoft Sentinel analytics rules.

Configure the Application Vulnerability Report connector (Preview)

Important

This connector is in Preview. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

Use this connector to ingest findings from the SAP Application Vulnerability Report Service. It can monitor SAP BTP apps in multiple subaccounts across regions. It doesn't share the service key or credentials used by the SAP BTP audit-log connector.

  1. In SAP BTP, configure the Application Vulnerability Report Service and create a dedicated service key. For more information, see the SAP Finding Provider Service API.

  2. From the service key, record the Finding Provider API URL (url), authorization server URL (uaa.url), client ID (uaa.clientid), and client secret (uaa.clientsecret). Also record the subaccount ID.

  3. In your Microsoft Sentinel workspace, select Data connectors and search for Application Vulnerability Report for SAP BTP.

  4. Open the connector page, select Add account, and enter the subaccount name and ID, client ID and secret, authorization server URL, and Finding Provider API URL.

  5. Configure the advanced options if needed:

    • Polling Frequency: The connector polls every 60 to 120 minutes. The default is 60 minutes.
    • Log Ingest Delay: The delay, in minutes, used to account for findings published late by SAP BTP. The supported range is 120 to 300 minutes. The default is 300 minutes.

  6. Submit the account configuration to save the connection.

  7. Verify that findings arrive in the SAPBTPAVL_CL table. Allow for the configured log-ingest delay before expecting recent findings.

  8. Enable the SAP BTP - Use of custom app with high or critical vulnerability analytics rule and use the Application Vulnerabilities tab in the SAP BTP workbook. For more information, see SAP BTP security content.

Learn more about the integration of SAP Application Vulnerability Report Service with Microsoft Sentinel for SAP in the SAP community blog post.

Note

To onboard SAP BTP subaccounts at scale, API and CLI based approaches are recommended. Get started with the SAP BTP onboarding script library.