This integration supports SAP Sales Cloud Version 2 and SAP Service Cloud Version 2 tenants, whose addresses end in
.crm.cloud.sap. Tenants on the earlier SAP Cloud for Customer (C4C) platform, with addresses ending in .crm.ondemand.com, aren’t supported.What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your SAP CRM tenant:- Accounts - business users, with their user name, email address, user type (employee or external), status, and validity dates. A user is shown as disabled when they are inactive, blocked, obsolete, still in preparation, or outside their Valid From and Valid Until dates.
- Roles - every business role in the tenant, including roles no one holds.
- Role membership - which business roles each user holds.
SAP’s SCIM API covers business users only. Technical users (API, communication, and support users) aren’t discovered, including the API user Oleria connects with. SAP CRM has no public audit log API, so this integration has no activity data.
Prerequisites
- An SAP Sales Cloud or SAP Service Cloud Version 2 tenant, and an administrator who can create technical roles and technical users.
- Your tenant’s host name, for example
my123456.de1.crm.cloud.sap. - Admin access to the Oleria workspace.
Create the Oleria API user in SAP
1
Create a technical role
In SAP, open the user menu and select System Settings -> All Settings -> Users and Control -> Roles. Choose Technical Roles and add a role, for example
OLERIA_API. Turn on Admin and add the User, Role, Employee, and Admin business services.If you want Oleria to run remediation actions, leave Write Access for the User service set to Unrestricted. For read-only access, set it to No Access. Save and activate the role.2
Create a technical API user
Go to Users and Control -> Users, choose Technical Users, and add an API user, for example
OLERIA_API. The user name can’t contain spaces or periods. Set a strong password that meets the security policy, then assign the technical role you created.3
Keep the user for Oleria only
Don’t use this user for anything else. If the password expires or the user is locked, Oleria can’t sync until you update the connection.
Connect SAP CRM to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select SAP CRM.
2
Complete the connection form
Select Continue and provide the following:
3
Confirm the connection
Select Authenticate. Oleria signs in as the API user and checks that it can read business users and business roles. Find the newly connected tenant on the Connected tab of your Oleria Integrations page.
- Wrong credentials: check the API user name and password, and that the user isn’t locked.
- Missing business service: check that the technical role includes the business service the message names.
- Not a Version 2 tenant: check that the host is a Sales Cloud or Service Cloud Version 2 tenant.
You can connect each SAP CRM tenant to Oleria once, and you can’t move a connection to a different tenant. If you change the API user name when you edit the integration, enter the password again. To keep the stored password when you edit only other fields, leave the field empty.
Verify the integration
Confirm the SAP CRM tenant appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, business roles, and role membership in your Oleria workspace.Remediation actions
Oleria can take these actions in SAP CRM. They need Write Access on the User business service.- Deactivate a user sets the user to inactive. In Oleria this action is labeled Disable account. The user’s business roles are kept, and nothing is deleted. Reverting the action reactivates the user.
- Reactivate a user sets the user back to active. Reverting the action deactivates the user again. Oleria reactivates a user only if that lets them sign in again. It refuses when the user’s Valid Until date has passed, Valid From is in the future, or the user is still In Preparation. Change those in SAP first. If SAP sets the user active but still shows them as blocked, the action reports that the reactivation was only partly applied.
- Assign a business role adds the user to the role. Other members of the role aren’t changed. Reverting the action removes the role again.
- Remove a business role takes the role away from the user. Reverting the action assigns the role again.
- It never deletes. Oleria never deletes a user, which would make the user obsolete in SAP. It never replaces a role’s full member list.
- Some users are refused. Oleria won’t reactivate a user that’s obsolete in SAP (deactivating one succeeds without a change, because it already can’t sign in), and it won’t deactivate its own API user.
- Unconfirmed changes are reported. If Oleria can’t confirm whether a change was applied, the action reports that it may have been applied and states how to undo it in SAP. Check the user before running it again.
Known limitations
- Tenants on the earlier SAP Cloud for Customer (C4C) platform aren’t supported.
- Technical users aren’t discovered. That covers API, communication, and support users, and the technical roles assigned to them.
- Administrators aren’t flagged. SAP doesn’t expose a business role’s Admin setting through its API, so Oleria doesn’t mark accounts as administrators.
- No MFA, SSO or permission detail. Oleria doesn’t import multi-factor authentication or single sign-on settings, or the business services and restrictions a business role grants.
- No activity data. SAP CRM has no public audit log API.