# Integrating SailPoint with SAP S/4HANA Cloud SaaS > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. SAP S/4HANA is an Enterprise Resource Planning (ERP) Business Suite based on the SAP HANA in-memory database with which transactions and business data analysis can be performed in real time. This guide is designed to give specific information about the requirements and field definitions needed for SAP S/4HANA Cloud SaaS. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features SAP S/4HANA Cloud SaaS supports the following features: - Aggregation of SAP S/4HANA Business Users as Accounts - Add/Remove Entitlements (supported entitlements are Business Roles) - Enable/Disable SAP S/4HANA Cloud accounts - Aggregation of Business Role as Account-Group - Create Business User Account on S/4HANA Cloud > **Note** > > Create Business User is supported for user type "Employee" (BUP003). - Update User Attributes (User Date Valid From and User Date Valid To) Refer to [Source Features]() for more information on features. Contact your CSM or SailPoint [Services]() for feature settings. ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). > [!NOTE] > > **Example** > > [![Privilege Level - High]()]() > > [![Privilege Level - Medium]()]() ## Prerequisites - Create the Communication User, Communication System, and Communication Arrangement on the SAP system, and export Role Data for SAP S/4HANA Cloud. - The role details must be exported in a .csv file. ### File Upload Utility The file upload utility provides a way for you to upload files to the cloud automatically. For more information about downloading and using the file upload utility with the SAP S/4HANA Cloud source, refer to [File Upload Utility](). ### Create Communication User A Communication User is a user defined in the SAP S/4HANA Cloud system for inbound communication and processing messages in the system. 1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the **Communication Management** panel, select **Maintain Communication Users**. A list of existing communication users page is displayed. 2. To create a new communication user, select **New**. 3. Enter the following details and select **Create**: - User Name\* - Description\* - Password 4. Note the details of the User Name and Password used above. ### Create Communication System A Communication system is defined in the SAP S/4HANA Cloud system as a target system. Communication systems must be created for inbound and outbound communication. 1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the **Communication Management** panel, select **Communication Systems**. A list of existing communication systems page is displayed. 2. To create a new communication system, select **New**. 3. Enter the following details, and select **Create**: - System ID\* - System Name\* 4. For inbound communication, perform the following: 1. Enter the details for the **Host Name\***. 2. In the **User for Inbound Communication** panel, select **Add (+)** to add a new user. 3. Select an **Authentication Method** from the dropdown list, specify a relevant **User Name**, and select **OK**. 5. For outbound communication, perform the following: 1. In the **User for Outbound Communication** panel, select an **Authentication Method** from the dropdown list and specify the **User Name** and **Password**. 2. Select **Create**. 6. Select **Save** to complete the creation of the communication system. ### Create Communication Arrangement Communication Arrangement is defined in the SAP S/4HANA Cloud system to enable key users to create and edit communication arrangements that are set up with a communication partner. 1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the **Communication Management** panel, select **Communication Arrangements**. A list of existing communication arrangements page is displayed. 2. To create a new communication arrangement, select **New**. 3. Enter the following details and then select **Create**: - Scenario\* - The Scenario ID is **SAP\_COM\_0093** and **SAP\_COM\_0465** - Arrangement Name 4. Select the ID of the **Communication System\*** and enter other details. 5. Select **Save** to complete the creation of a communication arrangement. #### Obtaining the URL Details The existing list of Communication Arrangements page is updated to include the newly created communication arrangement for the **SAP\_COM\_0093** and **SAP\_COM\_0465** scenario as explained above. To obtain the URL details, perform the following: 1. Select the newly created communication arrangement with Scenario ID **SAP\_COM\_0093** and **SAP\_COM\_0465**. The details of the **SAP\_COM\_0093** and **SAP\_COM\_0465** communication arrangement are displayed. 2. Under the **Inbound Services** section, copy the URL mentioned in **Service URL/Service Instance**. ### Create Business User Account The S/4HANA Cloud system supports the creation of Business User accounts. A key requirement for creating a Business User is the presence of a Worker ID. The Worker ID must be passed when creating the user. Additionally, you can use the custom-exposed Worker ID API to fetch worker details from the S/4HANA Cloud system. > [!NOTE] > > The Worker ID API is an optional parameter. If the Worker ID is not known, the Worker ID API can be used to retrieve it. For instructions on obtaining the Worker ID API for your system, refer to [Obtain Worker ID API in S/4HANA Cloud](<#obtain-worker-id-api-in-s4hana-cloud>). > [!NOTE] > > In the S/4HANA Public Cloud, you can only create a Business User Account with a reference to a valid Worker ID. #### Approaches for Creating a Business User in S/4HANA Cloud System 1. Create Business User using Worker ID API - Ensure that the Email ID and Username in the provisioning plan are unique values. - Ensure that the First Name, Last Name, and Email ID in the provisioning plan must be valid to fetch the Worker ID. If both options are provided, Approach B (Passing Worker ID) takes precedence over Approach A (Using Worker ID API). 2. Create Business User using Worker ID This is the standard method for creating a Business User in the S/4HANA Cloud system. - Ensure that the Worker ID, First Name, Last Name, and Email ID in the provisioning plan are appropriate for creating the Business User. #### Obtain Worker ID API in S/4HANA Cloud This is the optional setup process to retrieve the Worker ID from the S/4HANA Cloud System using an API. The Worker ID can be fetched by passing Email, First Name, and Last Name as filters. > [!NOTE] > > This is an optional custom-exposed API that must be explicitly configured in the S/4HANA Cloud system before use. **To configure the Worker ID API:** 1. Create an External API CDS View: - Open the Fiori App for creating custom CDS views (Custom CDS View). - Search for the standard CDS view I\_WorkforcePerson. - Select the following fields: FirstName, LastName, DefaultEmailAddress, PersonFullName, and PersonExternalID. - Select **Publish** to make the view available for use. [![Create Business User]()]() 2. Create a Communication Scenario: - In the Fiori App, create a new Communication Scenario. - Go to **Inbound Services** and add the service generated from the custom CDS view. - Publish the service to make it accessible. 3. Set Up the Communication Arrangement: - Go to Communication Arrangements. Select the Communication Scenario you created earlier. - Enter the required fields such as System and User Name. - Retrieve the generated URL for the communication arrangement. [![Communication Arrangement URL]()]() 4. Configure the Worker ID API in the Connector Settings: - Add the Entity Name (from the API metadata) to the API URL. - Enter the complete URL in the Worker ID API field on the configuration settings page of the connector. ## Required Permissions The following table lists the required permissions for the specific operations mentioned later in this section: | Operation | Required Permissions | | --- | --- | | Test Connection | Test Connection | | Aggregation | Test Connection and Aggregation | | Provisioning | Test Connection, Aggregation and Provisioning | The administrative user must have access to the following Inbound Services to perform the operations: | Operation | Inbound SOAP Services | Service Interface | | --- | --- | --- | | Test Connection /Account Aggregation | Business User - Read | `https:///sap/bc/srt/scs_ext/sap/querybusinessuserin` | | Group Aggregation | Business User - Read | `https:///sap/bc/http/sap/aps_iam_api_scim/Groups` | | Provisioning | Business User - Update | `https:///sap/bc/srt/scs_ext/sap/managebusinessuserin` | | Provisioning | Business User - Update | `https:///sap/bc/http/sap/aps_iam_api_scim/Users` | > [!NOTE] > > After you create the Communication Arrangement SAP\_COM\_0093 on the SAP managed system and the Communication User is assigned, the service account for the SAP S/4HANA Cloud source will have all the permissions. Refer to [SAP S/4HANA Prerequisites]() for more information.