Guides for setup and Basis administrators

These guides are for tenant administrators setting up the SAP integration and for SAP Basis administrators running the connector agent. For background, see Connections and the connector agent.

Work through them roughly in order: switch on, run the initial setup, add systems, define landscapes, then create, enrol and configure the agent.

Switch on the SAP integration

Make the SAP pages and endpoints available. Prerequisite: tenant administrator.

1. Open Settings → Regulatory features.
2. Find the flag sap_integration and switch it on.
3. Open Settings → SAP integrations. The page SAP Integrations now shows its sections instead of SAP integration is off for this tenant.

Run the initial setup

Load the SAP skills and the SoD risk catalog. Prerequisite: integration.config.manage.

1. Open Settings → SAP integrations and go to Initial setup.
2. Select Seed SAP skills. TENSOR reports how many skills it created.
3. Select Seed SoD risk catalog. TENSOR reports how many rules it created.

Both actions are safe to repeat; existing entries are skipped. The seeded catalog is one item of the cutover checklist.

Add a cloud SAP system (OAuth)

Register S/4HANA Cloud, SAP BTP or Cloud ALM. Prerequisite: integration.config.manage; an OAuth client in the SAP system.

1. Open Settings → SAP integrations and select Add SAP system.
2. Enter a Display name.
3. Under Authentication mode, choose OAuth 2.0 (Cloud).
4. Enter Token URL, Client ID, Client secret, API base URL and System ID.
5. Choose the System type: S/4HANA Cloud, SAP BTP or Cloud ALM.
6. Select Save. TENSOR confirms Credentials saved.

The system appears under Connected SAP systems. The client secret is stored encrypted and never shown again. For Cloud ALM, the read-only poll starts automatically.

Add an on-premises SAP system (RFC)

Register an ECC, S/4HANA on-premises or Solution Manager system whose data the agent will deliver. Prerequisite: integration.config.manage.

1. Open Settings → SAP integrations and select Add SAP system.
2. Enter a Display name and choose RFC (on-prem).
3. Enter Application server host, System number, Client and System ID (SID).
4. Select Save.

No SAP password is entered here. The technical user and password go only into the connector agent's local configuration on your network.

Test a connection and read its health

Check that a cloud connection works. Prerequisite: integration.config.manage (reading needs integration.config.read).

1. Open Settings → SAP integrations and find the system under Connected SAP systems.
2. Select Test connection and wait for Connection successful or Connection failed.
3. Read Status and Last checked, and open Recent health events for details.

For RFC systems TENSOR does not connect to SAP itself. Judge their health by the connector agent's Last heartbeat and Last envelope.

Define an SAP landscape

Map the DEV, QA and PROD systems of one transport path. Prerequisite: integration.config.manage; the connections exist.

1. Open Settings → SAP integrations and go to SAP landscapes.
2. Select Create landscape.
3. Enter Landscape name and, optionally, a Description.
4. Choose the DEV connection, QA connection and PROD connection (or Not assigned).
5. Select Save landscape. To change assignments later, edit them and select Save assignments.

Landscape names must be unique. Auto-created Changes depend on the landscape role of the SAP system CI, so make sure your development systems carry the role dev. The CAB role per landscape stage has no screen yet.

Create a connector agent

Register the agent that will deliver on-premises SAP data. Prerequisite: integration.config.manage.

1. Open Settings → SAP connector agents (page Connector agents).
2. Select Create agent.
3. Enter an Agent name and choose the Allowed SAP connections.
4. Select Create agent. The dialog One-time enrollment token shows the token.
5. Copy the token into the agent configuration now, then select I have copied the token.

The token is shown only once and cannot be retrieved later. If you lose it, create a new agent.

Install and enrol the agent on your network

Start collecting SAP data. Prerequisite: SAP Basis administrator with access to a host with Node.js 22 and HTTPS egress to TENSOR; for live mode, the SAP NW RFC SDK and node-rfc installed under your SAP licence.

1. Install the TENSOR SAP connector agent on the host.
2. Create the local configuration file with the TENSOR base URL, the agent ID, the enrollment token and one entry per SAP system (SID, RFC connection data, TENSOR connection ID).
3. Run tensor-sap-agent enroll --config ./agent.json. The token is replaced by the signing secret and the file is set to owner-only access.
4. Run one validation pass with tensor-sap-agent once --config ./agent.json.
5. Start the scheduler with tensor-sap-agent run --config ./agent.json, ideally as a service.
6. In TENSOR, check that the agent shows Active and a recent Last heartbeat.

Without the SAP libraries the agent starts in fixture mode and says so. Use fixture mode to test the path end to end before you connect a real system.

Configure collectors

Decide what the agent reads and how often. Prerequisite: integration.config.manage.

1. Open Settings → SAP connector agents and find the agent.
2. Under Collectors, switch on the collectors you need: Transports, System inventory, Authorizations, License measurement, Monitoring alerts, HANA status.
3. Set the interval of each collector in seconds, minutes or hours.

The agent picks up the new configuration on its next pass. Each collector runs on its own schedule.

Monitor or disable an agent

Keep the data flow healthy and retire an agent. Prerequisite: integration.config.read; disabling needs integration.config.manage.

1. Open Settings → SAP connector agents.
2. Check the status (Pending enrollment, Active, Heartbeat missing, Disabled), Last heartbeat, Agent version, Last envelope and Envelopes.
3. To retire an agent, select Disable and confirm.

A disabled agent can no longer push data or fetch its configuration. Disabling cannot be reversed; enrol a new agent as replacement.

Upload an EarlyWatch Alert report

Keep EWA reports as evidence per SAP system. Prerequisite: integration.config.manage.

1. Open Settings → SAP integrations and go to EarlyWatch Alert evidence.
2. Select Upload EWA report.
3. Choose the SAP system (CI), enter Period start and Period end, and select the Report file (PDF).
4. Select Upload report.

The report appears in the list and on the SAP system CI under EWA reports, marked Evidence current. If the newest report is older than 100 days, the badge changes to Evidence stale.

Check HANA status

See backup and replication health of your HANA databases. Prerequisite: integration.config.read; HANA collector active.

1. Open Settings → SAP integrations and go to HANA status.
2. For each database, read the replication role (Primary, Secondary, No replication) and Replication lag.
3. Check Full backup and Log backup ages and their badge (OK or At risk).
4. Check Tablespace used, Captured and BackInt tool.

A full backup older than 24 hours or a log backup older than 1 hour is At risk; tablespace at 85 percent is a warning and at 95 percent critical.