You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sap/workloads/exchange-online-integration-sap-email-outbound.md
+26-26Lines changed: 26 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,13 +11,13 @@ ms.author: mapankra
11
11
---
12
12
# Exchange Online Integration for Email-Outbound from SAP NetWeaver
13
13
14
-
Sending emails from your SAP backend is a standard feature widely distributed for use cases such as alerting for batch jobs, SAP workflow state changes or invoice distribution. Many customers established the setup using [Exchange Server on-premises](/exchange/exchange-server). With a shift to [Microsoft 365](https://www.microsoft.com/microsoft-365) and [Exchange Online](/exchange/exchange-online) comes a set of cloud-native approaches impacting that setup.
14
+
Sending emails from your SAP backend is a standard feature widely distributed for use cases such as alerting for batch jobs, SAP workflow state changes, or invoice distribution. Many customers established the setup using [Exchange Server on-premises](/exchange/exchange-server). With a shift to [Microsoft 365](https://www.microsoft.com/microsoft-365) and [Exchange Online](/exchange/exchange-online) comes a set of cloud-native approaches impacting that setup.
15
15
16
16
This article describes the setup for **outbound** email-communication from NetWeaver-based SAP systems to Exchange Online. That applies to SAP ECC, S/4HANA, SAP RISE managed, and any other NetWeaver based system.
17
17
18
18
## Overview
19
19
20
-
Existing implementations relied on SMTP Auth and elevated trust relationship because the legacy Exchange Server on-premises could live close to the SAP system itself and was governed by customers themselves. With Exchange Online there's a shift in responsibilities and connectivity paradigm. Microsoft supplies Exchange Online as a Software-as-a-Service offering built to be consumed securely and as effectively as possible from anywhere in the world over the public Internet.
20
+
Existing implementations relied on SMTP Auth and elevated trust relationship because the legacy Exchange Server on-premises could live close to the SAP system itself governed by customers themselves. With Exchange Online there's a shift in responsibilities and connectivity paradigm. Microsoft supplies Exchange Online as a Software-as-a-Service offering built to be consumed securely and as effectively as possible from anywhere in the world over the public Internet.
21
21
22
22
Follow our standard [guide](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365) to understand the general configuration of a "device" that wants to send email via Microsoft 365.
23
23
@@ -29,13 +29,13 @@ Follow our standard [guide](/exchange/mail-flow-best-practices/how-to-set-up-a-m
29
29
Currently, there are four different options supported by SAP NetWeaver that we want to describe. The first three correlate with the scenarios described in the [Exchange Online documentation](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365).
4.[Using SMTP relay server as intermediary to Exchange Online](#option-4-using-smtp-relay-server-as-intermediary-to-exchange-online)
35
35
36
-
For brevity we'll refer to the [**SAP Connect administration tool**](https://wiki.scn.sap.com/wiki/display/SI/SCOT+-+SAPconnect+Administration) used for the mail server setup only by its transaction code SCOT.
36
+
For brevity we refer to the [**SAP Connect administration tool**](https://wiki.scn.sap.com/wiki/display/SI/SCOT+-+SAPconnect+Administration) used for the mail server setup only by its transaction code SCOT.
37
37
38
-
We will update this guide when additional SAP-supported options become available.
38
+
We update this guide when more SAP-supported options become available.
@@ -46,12 +46,12 @@ Choose this option when you want to send mail to **people inside and outside** y
46
46
47
47
Connect SAP applications directly to Microsoft 365 using SMTP Auth endpoint **smtp.office365.com** in SCOT.
48
48
49
-
A valid email address will be required to authenticate with Microsoft 365. The email address of the account that's used to authenticate with Microsoft 365 will appear as the sender of messages from the SAP application.
49
+
A valid email address is required to authenticate with Microsoft 365. The email address of the account that's used to authenticate with Microsoft 365 appears as the sender of messages from the SAP application.
50
50
51
51
### Requirements for SMTP AUTH
52
52
53
53
-**SMTP AUTH**: Needs to be enabled for the mailbox being used. SMTP AUTH is disabled for organizations created after January 2020 but can be enabled per-mailbox. For more information, see [Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online](/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission).
54
-
-**Authentication**: Use Basic Authentication (which is simply a username and password) to send email from SAP application. If SMTP AUTH is intentionally disabled for the organization, you must use Option 2, 3 or 4 below.
54
+
-**Authentication**: Use Basic Authentication (which is simply a username and password) to send email from SAP application. If SMTP AUTH is intentionally disabled for the organization, you must use Option 2, 3, or 4.
55
55
-**Mailbox**: You must have a licensed Microsoft 365 mailbox to send email from.
56
56
-**Transport Layer Security (TLS)**: Your SAP Application must be able to use TLS version 1.2 and above.
57
57
-**Port**: Port 587 (recommended) or port 25 is required and must be unblocked on your network. Some network firewalls or Internet Service Providers block ports, especially port 25, because that\'s the port that email servers use to send mail.
@@ -67,7 +67,7 @@ There are two ways to enable SMTP AUTH in Exchange online:
67
67
> [!NOTE]
68
68
> if your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article.
69
69
70
-
The per-mailbox setting to enable SMTP AUTH is available in the [Microsoft 365 Admin Center](https://admin.microsoft.com/) or via [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).
70
+
The per-mailbox setting to enable SMTP AUTH is available in the [Microsoft 365 Admin Center](https://admin.microsoft.com/), or via [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell).
71
71
72
72
1. Open the [Microsoft 365 admin center](https://admin.microsoft.com/) and go to **Users** -> **Active users**.
73
73
@@ -85,15 +85,15 @@ The per-mailbox setting to enable SMTP AUTH is available in the [Microsoft 365 A
85
85
86
86
5.**Save changes**.
87
87
88
-
This will enable SMTP AUTH for that individual user in Exchange Online that you require for SCOT.
88
+
This enables SMTP AUTH for that individual user in Exchange Online that you require for SCOT.
89
89
90
90
### Configure SMTP Auth with SCOT
91
91
92
92
1. Ping or telnet **smtp.office365.com** on port **587** from your SAP application server to make sure ports are open and accessible.
93
93
94
94
:::image type="content" source="media/exchange-online-integration/telnet-scot-sec-1-1.png" alt-text="Screenshot of ping":::
95
95
96
-
2. Make sure SAP Internet Communication Manager (ICM) parameter is set in your instance profile. See below an example:
96
+
2. Make sure SAP Internet Communication Manager (ICM) parameter is set in your instance profile. See this example:
97
97
98
98
| parameter | value |
99
99
|---|---|
@@ -115,13 +115,13 @@ This will enable SMTP AUTH for that individual user in Exchange Online that you
Click on the "Settings" button (next to the Security field) to add TLS settings and basic authentication details as mentioned in point 2 if required. Make sure your ICM parameter is set accordingly.
118
+
Click on the "Settings" button (next to the Security field) to add TLS settings and basic authentication details as mentioned in point 2 if necessary. Make sure your ICM parameter is set accordingly.
119
119
120
-
Make sure to use a valid Microsoft 365 email ID and password. In addition to that it needs to be the same user that you've enabled for SMTP Auth at the beginning. This email ID will show up as the sender.
120
+
Make sure to use a valid Microsoft 365 email ID and password. In addition to that it needs to be the same user that you've enabled for SMTP Auth at the beginning. This email ID shows up as the sender.
Coming back to the previous screen: Click on "Set" button and check "Internet" under "Supported Address Types". Using the wildcard "\*" option will allow you to send emails to all domains without restriction.
124
+
Coming back to the previous screen: Click on "Set" button and check "Internet" under "Supported Address Types". Using the wildcard "\*" option allows you to send emails to all domains without restriction.
@@ -150,7 +150,7 @@ This will enable SMTP AUTH for that individual user in Exchange Online that you
150
150
151
151
## Option 2: SMTP Direct Send
152
152
153
-
Microsoft 365 offers the ability to configure [direct send](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#option-2-send-mail-directly-from-your-printer-or-application-to-microsoft-365-or-office-365-direct-send) from the SAP application server. This option is limited in that it only permits mail to be routed to addresses in your own Microsoft 365 organization with a valid e-mail address therefore cannot be used for external recipients (e.g., vendors or customers).
153
+
Microsoft 365 offers the ability to configure [direct send](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#option-2-send-mail-directly-from-your-printer-or-application-to-microsoft-365-or-office-365-direct-send) from the SAP application server. This option is limited. It only permits mails to addresses in your own Microsoft 365 organization with a valid e-mail address. It cannot be used for external recipients (for example vendors or customers).
154
154
155
155
## Option 3: Using Microsoft 365 SMTP Relay Connector (recommended)
156
156
@@ -160,20 +160,20 @@ Only choose this option when:
160
160
- SMTP client submission (Option 1) isn't compatible with your business needs or with your SAP Application.
161
161
- You can't use direct send (Option 2) because you must send email to external recipients.
162
162
163
-
SMTP relay lets Microsoft 365 relay emails on your behalf by using a connector that's configured with your public IP address or a TLS certificate. Compared to the other options, the connector setup increases complexity.
163
+
SMTP relay lets Microsoft 365 relay emails on your behalf by using a connector configured with your public IP address or a TLS certificate. Compared to the other options, the connector setup increases complexity.
164
164
165
165
### Requirements for SMTP Relay
166
166
167
167
-**SAP Parameter**: SAP instance parameter configured and SMTP service are activated as explained in option 1, follow steps 2 to 4 from "Configure SMTP Auth with SCOT" section.
168
168
-**Email Address**: Any email address in one of your Microsoft 365 verified domains. This email address doesn't need a mailbox. For example, `noreply@*yourdomain*.com`.
169
169
-**Transport Layer Security (TLS)**: SAP application must be able to use TLS version 1.2 and above.
170
170
-**Port**: port 25 is required and must be unblocked on your network. Some network firewalls or ISPs block ports, especially port 25 due to the risk of misuse for spamming.
171
-
-**MX record**: your Mail Exchanger (MX) endpoint, for e.g., yourdomain.mail.protection.outlook.com. Find more information on the next section.
172
-
-**Relay Access**: A Public IP address or SSL certificate is required to authenticate against the relay connector. To avoid configuring direct access it's recommended to use Source Network Translation (SNAT) as described in this article. [Use Source Network Address Translation (SNAT) for outbound connections](../../load-balancer/load-balancer-outbound-connections.md).
171
+
-**MX record**: your Mail Exchanger (MX) endpoint, for example yourdomain.mail.protection.outlook.com. Find more information on the next section.
172
+
-**Relay Access**: A Public IP address or SSL certificate is required to authenticate against the relay connector. To avoid configuring direct access, it's recommended to use Source Network Translation (SNAT) as described in this article. [Use Source Network Address Translation (SNAT) for outbound connections](../../load-balancer/load-balancer-outbound-connections.md).
173
173
174
174
### Step-by-step configuration instructions for SMTP relay in Microsoft 365
175
175
176
-
1. Obtain the public (static) IP address of the endpoint which will be sending the mail using one of the methods listed in the [article](../../load-balancer/load-balancer-outbound-connections.md) above. A dynamic IP address isn\'t supported or allowed. You can share your static IP address with other devices and users, but don't share the IP address with anyone outside of your company. Make a note of this IP address for later.
176
+
1. Obtain the public (static) IP address of the endpoint that sends the mail using one of the methods listed in the [article](../../load-balancer/load-balancer-outbound-connections.md) above. A dynamic IP address isn\'t supported or allowed. You can share your static IP address with other devices and users, but don't share the IP address with anyone outside of your company. Make a note of this IP address for later.
177
177
178
178
:::image type="content" source="media/exchange-online-integration/azure-portal-pip-sec-3-1.png" alt-text="Where to retrieve the public ip on the Azure Portal":::
179
179
@@ -196,7 +196,7 @@ SMTP relay lets Microsoft 365 relay emails on your behalf by using a connector t
6. New Exchange Admin Center (EAC) portal will open.
199
+
6. New Exchange Admin Center (EAC) portal opens.
200
200
201
201
:::image type="content" source="media/exchange-online-integration/exchange-admin-center-sec-3-6.png" alt-text="Microsoft 365 Admin Center mailbox":::
202
202
@@ -234,7 +234,7 @@ SMTP relay lets Microsoft 365 relay emails on your behalf by using a connector t
234
234
235
235
1. Make sure SAP ICM Parameter and SMTP service is activated as explained in Option 1 (steps 2-4)
236
236
2. Go to SCOT transaction in SMTP node as shown in previous steps of Option 1.
237
-
3. Add mail Host as Mail Exchanger (MX) record value noted in Step 4 (i.e. yourdomain.mail.protection.outlook.com).
237
+
3. Add mail Host as Mail Exchanger (MX) record value noted in Step 4 (yourdomain.mail.protection.outlook.com).
238
238
239
239
:::image type="content" source="media/exchange-online-integration/scot-smtp-connection-relay-sec-3-3.png" alt-text="SMTP config in SCOT":::
240
240
@@ -252,18 +252,18 @@ Port: 25
252
252
253
253
An intermediate relay server can be an alternative to a direct connection from the SAP application server to Microsoft 365. This server can be based on any mail server that will allow direct authentication and relay services.
254
254
255
-
The advantage of this solution is that it can be deployed in the hub of a hub-spoke virtual network within your Azure environment or within a DMZ to protect your SAP application hosts from direct access. It also allows for centralized outbound routing to immediately offload all mail traffic to a central relay when sending from multiple application servers.
255
+
The advantage of this solution is that it can be deployed in the hub of a hub-spoke virtual network within your Azure environment. Or within a DMZ to protect your SAP application hosts from direct access. It also allows for centralized outbound routing to immediately offload all mail traffic to a central relay when sending from multiple application servers.
256
256
257
-
The configuration steps are the same as for the Microsoft 365 SMTP Relay Connector (Option 3) with the only differences being that the SCOT configuration should reference the mail host that will perform the relay rather than direct to Microsoft 365. Depending on the mail system that is being used for the relay it will also be configured directly to connect to Microsoft 365 using one of the supported methods and a valid user with password. It is recommended to send a test mail from the relay directly to ensure it can communicate successfully with Microsoft 365 before completing the SAP SCOT configuration and testing as normal.
257
+
The configuration steps are the same as for the Microsoft 365 SMTP Relay Connector (Option 3). The only differences being that the SCOT configuration should reference the mail host that will perform the relay rather than direct to Microsoft 365. Depending on the mail system that is being used for the relay it will also be configured directly to connect to Microsoft 365 using one of the supported methods and a valid user with password. It's recommended to send a test mail from the relay directly to ensure it can communicate successfully with Microsoft 365 before completing the SAP SCOT configuration and testing as normal.
258
258
259
259
:::image type="content" source="media/exchange-online-integration/sap-outbound-mail-with-smtp-relay.png" alt-text="Relay Server Architecture":::
260
260
261
-
The example architecture shown illustrates multiple SAP application servers with a single mail relay host in the hub. Depending on the volume of mail to be sent it is recommended to follow a detailed sizing guide for the mail vendor to be used as the relay. This may require multiple mail relay hosts which operate with an Azure Load Balancer.
261
+
The example architecture shown illustrates multiple SAP application servers with a single mail relay host in the hub. Depending on the volume of mail to be sent it's recommended to follow a detailed sizing guide for the mail vendor to be used as the relay. This may require multiple mail relay hosts which operate with an Azure Load Balancer.
262
262
263
263
## Next Steps
264
264
265
265
[Understand mass-mailing with Azure Twilio - SendGrid](https://docs.sendgrid.com/for-developers/partners/microsoft-azure-2021)
0 commit comments