SSO Implementation Guide - SAP Analytics Cloud & SAP Datasphere

With Microsoft Entra ID (Azure AD) as Identity Provider and SAP BW/ERP Backend

Version: 1.0 | Date: April 2026

Overview & Architecture

This guide explains how to configure SAML 2.0 Single Sign-On (SSO) so that users can:

1. Log in once via Microsoft Entra ID (Azure AD)
2. Access SAP Analytics Cloud (SAC) or SAP Datasphere without a second login prompt
3. Have SAC/Datasphere pass that SSO token through to the SAP BW / ERP backend (Live connections)

User Browser
    │
    ▼
Microsoft Entra ID (IdP / Azure AD)  ◄── SAML trust configured here (Enterprise App)
    │  SAML assertion
    ▼
SAP Analytics Cloud / SAP Datasphere  ◄── Trusted IdP configured here
    │  SAML Bearer assertion (for live connection)
    ▼
SAP BW / SAP ERP Backend  ◄── UCON HTTP Whitelist + auth/new_buffering + OAuth

Key principle: SAC/Datasphere is a Service Provider (SP). Entra ID / IAS is the Identity Provider (IdP). The BW backend trusts the SAML assertion forwarded by SAC.

Prerequisites Checklist

Before you start, confirm the following are in place:

PART A — SAP BW/ERP Backend Configuration

A1. Set Profile Parameter auth/new_buffering

Why this is required: Without auth/new_buffering = 4, the SAP system does not buffer SAML-based authentication tokens correctly, and SSO will fail silently. The authorization trace (SU53) will show this as a failed check.

Steps:

1. Log in to the SAP system (the source BW/ERP system, not SAC).
2. Run transaction RZ10 → select the DEFAULT profile → choose Extended Maintenance → click Change.
3. Find or add the parameter auth/new_buffering and set value to 4.
4. Save and activate the profile.
5. Restart the SAP application server for the change to take effect (coordinate with Basis).

Alternative — verify current value:

• Run transaction RZ11, enter parameter name auth/new_buffering, click Display → the current value must be 4.
• In the authorization error trace (SU53), the instance field shows Profilparameter auth/new_buffering and the value — it must be 4.

Screenshot reference: The SU53 authorization trace shown in the video (video timestamp ~11:47 / ~12:18) clearly shows Profilparameter auth/new_buffering = 4 in the instance description field. If this reads anything other than 4, SSO will not work.

A2. Activate UCON RFC/HTTP Scenario

The Unified Connectivity (UCON) framework controls which HTTP services the SAP backend allows to be called from external systems (like SAC/Datasphere). You need to activate the correct scenario.

Steps:

1. Run transaction UCONPHTL (or search for "Phasenverwaltungswerkzeug für Unified Connectivity" in the Easy Access menu).
2. The System field should show your system ID (e.g., CB1-0020297346).
3. Click "Als systemweites Standardszenario setzen" (Set as system-wide default scenario) if it is not already the default.
4. Verify the Communication-Assembly status at the bottom — it should show active, not "existiert nicht".

In the Scenario dropdown, select C HTTP-Whitelist-Szenario (scenario C).

The other scenarios shown in the dropdown are: RFC-Basisszenario, Rollenbau-Szenario, HTTP-Whitelist-Szenario (choose this one), RFC-Basisszenario. Make sure C HTTP-Whitelist-Szenario is selected.

A3. Configure UCON HTTP Whitelist — Context Types

The HTTP Whitelist Tool controls cross-origin requests. SAC/Datasphere needs to make AJAX calls to the BW backend, and the browser will block these unless the BW system explicitly whitelists the SAC/Datasphere origin.

Navigate to the HTTP Whitelist Tool:

1. Run transaction UCON_CHW (or navigate: UCONPHTL → HTTP-Whitelist → Edit).
   • The title bar will show: "HTTP Whitelist Tool für Unified Connectivity (UCON) – Ändern"

There are 4 context types that must be configured. Work through each one:

Context Type 01 — Trusted Network Zone

• Kontext: 01 | Beschreibung: Trusted Network Zone
• Modus: Set to Protokoll. (logging mode initially for testing, then switch to Aktive Prüfung for production)
• This context controls which network zones are trusted.

Context Type 02 — ClickJacking Framing Protection

• Kontext: 02 | Beschreibung: ClickJacking Framing Protection
• Modus: Protokoll.
• Prevents the SAC iframe from being blocked by clickjacking protection.

Context Type 03 — CSS-Stylesheet

• Kontext: 03 | Beschreibung: CSS-Stylesheet
• Modus: Protokoll.

Context Type 04 — Cross-origin Resource Sharing (CORS) ← Most Critical

• Kontext: 04 | Beschreibung: Cross-origin Resource Sharing
• Modus: Aktive Prüfung (Active Check — this one must be active)
• This is the context that controls CORS and is the primary blocker if not configured.

To switch mode for a context:

1. Select the context (e.g., 04) in the context dropdown.
2. In the Whitelist section on the right, click the Edit icon (pencil).
3. In the Modus dropdown, select Aktive Prüfung (or Protokoll. for testing).
4. Save.

A4. Add SAC/Datasphere URL to the CORS Whitelist

Now add the actual SAC/Datasphere tenant URL to the whitelist for Context Type 04.

Steps:

1. In transaction UCON_CHW, ensure Context 04 (Cross-origin Resource Sharing) is selected.
2. In the Whitelist panel (right side), click the New Entry button (green + icon in the toolbar).
3. The Eingabefenster (input dialog) opens with these fields:

4. Click the Save button (green checkmark) in the dialog.
5. The entry will now appear in the Whitelist panel on the right.

Important: The same entry needs to be added for all 4 context types (01–04). Each context type may need the SAC/Datasphere host whitelisted.

A5. Verify with Authorization Trace (SU53)

After configuration, test by attempting an SSO connection from SAC to BW. If it fails, check the authorization trace.

Steps:

1. In the BW/ERP system, run transaction SU53 immediately after a failed login attempt.
2. Or run SU53 for the technical user (e.g., SUDECKM in the demo) via menu: Berechtigungswerte → Berechtigungsdaten von Benutzer anzeigen.
3. Look for failed authorization checks (Fehlgeschlagene Prüfungen).

What the trace shows when UCON is missing:

• Transaction: UCONPHTL
• Authorization object: S_UCON_ADM (Administrationsberechtigung für Unified Connectivity)
• Field UCON_NAME: <DUMMY> — this means the UCON Service Assembly ID is not set
• Field UCON_TYPE: <DUMMY> — UCON type for authorization check is not set

What this means: The user's authorization profile does not include S_UCON_ADM. The technical user used for the SAC connection needs this authorization, or the UCON scenario must be activated system-wide (which bypasses individual user auth checks).

Resolution:

• Ensure the system-wide UCON scenario is activated (Step A2).
• If individual user auth is needed, add S_UCON_ADM to the user's role with appropriate values.

A6. Test with a New Client Login

To validate the BW-side configuration independently:

1. Open a new SAP logon (or use a different client, e.g., client 100 as shown in the video at ~11:01).
2. Log in with a test user.
3. Navigate to the SAP Easy Access menu — if the UCON scenario and whitelist are correctly set, you should see the user's menu without errors.
4. Check SESSION_MANAGER transaction — successful SSO will show a proper session established.

PART B — Microsoft Entra ID (Azure AD) Configuration

The video shows the Entra ID configuration being reviewed on the SAML_Omnitracker enterprise application (~24:01 onward). The same steps apply to any SAC or Datasphere SAML application.

B1. Create or Find the Enterprise Application in Entra ID

1. Go to Microsoft Entra admin center → Enterprise applications → All applications.
2. Search for your existing SAC/Datasphere application, OR click + New application → + Create your own application → name it (e.g., SAC_SSO or Datasphere_SSO) → select "Integrate any other application you don't find in the gallery".
3. Open the application → go to Single sign-on → select SAML.

B2. Configure Basic SAML Settings

Click Edit in section 1 — Basic SAML Configuration.

Critical: The Identifier (Entity ID) must exactly match the Entity ID configured on the SAC/Datasphere side. Any mismatch causes authentication failure.

Save the basic SAML configuration.

B3. Configure Attributes & Claims

In section 2 — Attributes & Claims, verify/configure the user attribute mappings that will be sent in the SAML assertion to SAC/Datasphere.

The video shows these standard mappings on the SAML_Omnitracker app:

Key point for SAP systems: The Unique User Identifier / Name ID should typically be mapped to user.userprincipalname or user.mail — whichever matches the user's email address in SAP. This is the value SAP will use to identify the user, so it must match the user's email in the SAP backend.

For BW SSO (principal propagation): The username claim mapped to user.onpremisessamaccountname is critical — SAP BW will use the SAM account name to map the user to a BW user ID.

B4. Review SAML Certificates

In section 3 — SAML Certificates, note the following values — you will need them for SAC/Datasphere configuration:

B5. Collect URLs for SAC/Datasphere Configuration

In section 4 — Set up [Application Name], collect these URLs to configure on the SAP side:

These URLs are displayed in section 4 of the Entra ID SAML setup page.

B6. Assign Users and Groups

1. In the Enterprise Application → go to Users and groups → + Add user/group.
2. Add all users or groups who should have access to SAC/Datasphere via SSO.
3. Only assigned users/groups will receive a valid SAML token.

Blocker: If a user is not assigned to the Enterprise Application in Entra ID, they will receive an authentication error even if everything else is correctly configured.

PART C — SAP Analytics Cloud / SAP Datasphere Configuration

C1. SAC: Configure Trusted Identity Provider

Note: SAP Analytics Cloud and SAP Datasphere use the same underlying BTP authentication mechanism. The steps are nearly identical; the navigation path is slightly different.

For SAP Analytics Cloud:

1. Log in to SAC as System Owner or Admin.
2. Navigate to: Main Menu (hamburger) → System → Administration → Security.
3. Under Authentication, click + Add Identity Provider (or edit the existing one).

For SAP Datasphere:

1. Log in to Datasphere as DW Administrator.
2. Navigate to: System → Administration → Security → Authentication & SSO.

Configuration fields (same for both):

Critical for BW live connection SSO: Under the IdP settings, ensure "Forward SAML to backend" or "Principal Propagation" is enabled. This allows SAC to pass the user's SAML assertion through to the BW backend for live queries.

C2. SAC/Datasphere: Configure the BW Live Connection with SSO

Once the IdP trust is configured, set up the Live Connection to BW with SSO:

1. Navigate to: Connections → + Add Connection → SAP BW (or SAP BW/4HANA).
2. Set Authentication Method to SAML Single Sign-On.
3. Enter the BW system URL (HTTPS endpoint).
4. The Service URL must be the HTTPS URL of the BW system's ICF service, e.g.:
   https://bwhost.company.com:443/sap/bw/ina/GetServerInfo
5. Test the connection — if the UCON whitelist (Part A) and profile parameters are correctly set, the test will succeed.

PART D — End-to-End Verification

D1. Test SSO Login Flow

1. Open a private/incognito browser window.
2. Navigate to your SAC or Datasphere URL.
3. You should be redirected to Microsoft Entra ID login page.
4. Enter corporate credentials.
5. After successful authentication, you should be redirected back to SAC/Datasphere and automatically logged in.
6. In SAC: open a story with a BW live data source — data should load without prompting for BW credentials.

D2. If SSO Fails — Troubleshooting Checklist

D3. Check SU53 in the BW System

After any failed attempt, in the BW system immediately run:

Transaction: SU53

• The trace shows the exact authorization object and field that blocked the request.
• Look for S_UCON_ADM with UCON_NAME = <DUMMY> → means UCON is not properly activated.
• Look for S_USER_PRO with PROFILE = * → means the user has no authorization profile at all.

Quick Reference — Transaction Codes

References

• SAP Help Portal: SAP Analytics Cloud — Enable SSO
• SAP Help Portal: SAP Datasphere — Authentication
• SAP Blog: SAP BW/4HANA — UCON and HTTP Whitelist Configuration
• Microsoft Docs: Entra ID SAML-based Single Sign-on
• SAP Note: 2383/1: UCON — Unified Connectivity, Activation of HTTP Services
• SAP Note: 1682316: auth/new_buffering profile parameter

Document based on workshop recording "SSO zwischen SAC (SAP Analytic cloud) Tenant und SAP BW (PB1)" — RWA LH SAP BW, April 8, 2026. Participants: Sudeck Martin, Bauer-Gray Martin, Hudak Timotej, Mittermayer Marco, Belciu Paul, Moldoveanu Daniel, Chivu Petru.