> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP CRM

> Connect SAP Sales Cloud or SAP Service Cloud (Version 2) to Oleria to bring business users, business roles, and role assignments into your identity and access graph.

Connect SAP CRM to Oleria to see who can sign in to your SAP Sales Cloud or SAP Service Cloud tenant and which business roles each user holds. Oleria reads users and business roles through the tenant's SCIM API using a dedicated technical API user, so you can review access to your CRM and take action directly from Oleria.

<Note>
  This integration supports **SAP Sales Cloud Version 2** and **SAP Service Cloud Version 2** tenants, whose addresses end in `.crm.cloud.sap`. Tenants on the earlier SAP Cloud for Customer (C4C) platform, with addresses ending in `.crm.ondemand.com`, aren't supported.
</Note>

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your SAP CRM tenant:

* **Accounts** - business users, with their user name, email address, user type (employee or external), status, and validity dates. A user is shown as disabled when they are inactive, blocked, obsolete, still in preparation, or outside their **Valid From** and **Valid Until** dates.
* **Roles** - every business role in the tenant, including roles no one holds.
* **Role membership** - which business roles each user holds.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview#sync-model).

<Note>
  SAP's SCIM API covers business users only. Technical users (API, communication, and support users) aren't discovered, including the API user Oleria connects with. SAP CRM has no public audit log API, so this integration has no activity data.
</Note>

## Prerequisites

* An SAP Sales Cloud or SAP Service Cloud **Version 2** tenant, and an administrator who can create technical roles and technical users.
* Your tenant's host name, for example `my123456.de1.crm.cloud.sap`.
* Admin access to the Oleria workspace.

## Create the Oleria API user in SAP

<Steps>
  <Step title="Create a technical role">
    In SAP, open the user menu and select **System Settings** -> **All Settings** -> **Users and Control** -> **Roles**. Choose **Technical Roles** and add a role, for example `OLERIA_API`. Turn on **Admin** and add the **User**, **Role**, **Employee**, and **Admin** business services.

    If you want Oleria to run remediation actions, leave **Write Access** for the **User** service set to **Unrestricted**. For read-only access, set it to **No Access**. Save and activate the role.
  </Step>

  <Step title="Create a technical API user">
    Go to **Users and Control** -> **Users**, choose **Technical Users**, and add an API user, for example `OLERIA_API`. The user name can't contain spaces or periods. Set a strong password that meets the security policy, then assign the technical role you created.
  </Step>

  <Step title="Keep the user for Oleria only">
    Don't use this user for anything else. If the password expires or the user is locked, Oleria can't sync until you update the connection.
  </Step>
</Steps>

## Connect SAP CRM to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **SAP CRM**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field | Notes |
    | :- | :- |
    | Tenant Host | Required. Your tenant's host name, for example `my123456.de1.crm.cloud.sap`. You can paste the address from your browser; Oleria keeps only the host. |
    | API User Name | Required. The name of the technical API user you created. |
    | API User Password | Required. That user's password. |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate**. Oleria signs in as the API user and checks that it can read business users and business roles. Find the newly connected tenant on the **Connected** tab of your Oleria **Integrations** page.
  </Step>
</Steps>

If **Authenticate** fails, Oleria shows the reason:

* **Wrong credentials:** check the API user name and password, and that the user isn't locked.
* **Missing business service:** check that the technical role includes the business service the message names.
* **Not a Version 2 tenant:** check that the host is a Sales Cloud or Service Cloud Version 2 tenant.

<Note>
  You can connect each SAP CRM tenant to Oleria once, and you can't move a connection to a different tenant. If you change the API user name when you edit the integration, enter the password again. To keep the stored password when you edit only other fields, leave the field empty.
</Note>

## Verify the integration

Confirm the SAP CRM tenant appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts, business roles, and role membership in your Oleria workspace.

## Remediation actions

Oleria can take these actions in SAP CRM. They need **Write Access** on the **User** business service.

* **Deactivate a user** sets the user to inactive. In Oleria this action is labeled **Disable account**. The user's business roles are kept, and nothing is deleted. Reverting the action reactivates the user.
* **Reactivate a user** sets the user back to active. Reverting the action deactivates the user again.

  Oleria reactivates a user only if that lets them sign in again. It refuses when the user's **Valid Until** date has passed, **Valid From** is in the future, or the user is still **In Preparation**. Change those in SAP first. If SAP sets the user active but still shows them as blocked, the action reports that the reactivation was only partly applied.
* **Assign a business role** adds the user to the role. Other members of the role aren't changed. Reverting the action removes the role again.
* **Remove a business role** takes the role away from the user. Reverting the action assigns the role again.

Oleria confirms every change by reading the user or role again, and follows these rules:

* **It never deletes.** Oleria never deletes a user, which would make the user obsolete in SAP. It never replaces a role's full member list.
* **Some users are refused.** Oleria won't reactivate a user that's obsolete in SAP (deactivating one succeeds without a change, because it already can't sign in), and it won't deactivate its own API user.
* **Unconfirmed changes are reported.** If Oleria can't confirm whether a change was applied, the action reports that it may have been applied and states how to undo it in SAP. Check the user before running it again.

## Known limitations

* Tenants on the earlier SAP Cloud for Customer (C4C) platform aren't supported.
* **Technical users aren't discovered.** That covers API, communication, and support users, and the technical roles assigned to them.
* **Administrators aren't flagged.** SAP doesn't expose a business role's **Admin** setting through its API, so Oleria doesn't mark accounts as administrators.
* **No MFA, SSO or permission detail.** Oleria doesn't import multi-factor authentication or single sign-on settings, or the business services and restrictions a business role grants.
* **No activity data.** SAP CRM has no public audit log API.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.