Merge pull request #300346 from limwainstein/agentless-sap-connector-onboarding-clarifications

SAP agentless connector - adding missing permissions information

Author: prmerger-automator[bot]

articles/sentinel/sap/deploy-data-connector-agent-container.md

@@ -5,7 +5,7 @@ author: batamig
 ms.author: bagol
 ms.topic: how-to
 ms.custom: devx-track-azurecli
-ms.date: 10/28/2024
+ms.date: 05/26/2025
 appliesto:
     - Microsoft Sentinel in the Microsoft Defender portal
     - Microsoft Sentinel in the Azure portal
@@ -48,6 +48,9 @@ Before you connect your SAP system to Microsoft Sentinel:
 
 - Make sure that all of the deployment prerequisites are in place. For more information, see [Prerequisites for deploying Microsoft Sentinel solution for SAP applications](prerequisites-for-deploying-sap-continuous-threat-monitoring.md).
 
+    > [!IMPORTANT]
+    > If you're working with the agentless data connector, you need the **Entra ID Application Developer** role or higher to successfully deploy the relevant Azure resources. If you don't have this permission, work with a colleague that has the permission to complete the process. For the full procedure, see the [connect the agentless data connector](#connect-your-agentless-data-connector-limited-preview) step.
+
 - Make sure that you have the Microsoft Sentinel solution for **SAP applications** [installed in your Microsoft Sentinel workspace](deploy-sap-security-content.md)
 
 - Make sure that your SAP system is fully [prepared for the deployment](preparing-sap.md).
@@ -336,7 +339,22 @@ At this stage, the system's **Health** status is **Pending**. If the agent is up
 
 1. In Microsoft Sentinel, go to the **Configuration > Data connectors** page and locate the **Microsoft Sentinel for SAP - agent-less (Preview)** data connector.
 
-1. In the **Configuration** area, scroll down and select **Add SAP client**.
+1. In the **Configuration** area, expand step **1. Trigger automatic deployment of required Azure resources / SOC Engineer**, and select **Deploy required Azure resources**.
+
+    > [!IMPORTANT]
+    > If you don't have the **Entra ID Application Developer** role or higher, and you select **deploy required Azure resources**, an error message is displayed, for example: "Deploy required azure resources" (errors may vary). This means that the data collection rule (DCR) and data collection endpoint (DCE) were created, but you need to ensure that your Entra ID app registration is authorized. Continue to set up the correct authorization.
+
+1. Do one of the following: 
+    - If you have the **Entra ID Application Developer** role or higher, continue to the next step.
+    - If you don't have the **Entra ID Application Developer** role or higher:
+        - Share the DCR ID with your Entra ID administrator or colleague with the required permissions. 
+        - Retrieve the client ID and client secret from the Entra ID app registration to use for authorization on the DCR. The SAP admin uses this information to post to the DCR. 
+        - Ensure that the **Monitoring Metrics Publishing** role is assigned on the DCR, with the service principal assignment, using the client ID from the Entra ID app registration.                           
+
+        > [!NOTE]
+        > If you're a SAP administrator and don't have access to the connector installation, download the [integration package](https://aka.ms/SAPAgentlessPackage) directly. 
+
+1. Scroll down and select **Add SAP client**.
 
 1. In the **Connect to an SAP Client** side pane, enter the following details:
 

articles/sentinel/sap/sap-deploy-troubleshoot.md

@@ -4,7 +4,7 @@ description: Learn how to troubleshoot specific issues that might occur in your
 author: batamig
 ms.author: bagol
 ms.topic: troubleshooting
-ms.date: 11/07/2024
+ms.date: 05/26/2025
 appliesto:
     - Microsoft Sentinel in the Microsoft Defender portal
     - Microsoft Sentinel in the Azure portal
@@ -39,6 +39,12 @@ Some legacy SAP systems may be missing required functionality for the **RFC_READ
 
 For more information, see [Configure SAP Cloud Connector settings](preparing-sap.md#configure-sap-cloud-connector-settings).
 
+## "Deploy required azure resources" error when setting up the data connector
+
+When you set up the Microsoft Sentinel for SAP - agentless data connector, under the **Initial connector configuration > Step 1: Trigger automatic deployment of required Azure resources / SOC Engineer**, after you select **Deploy required resources**, you might see the "Deploy required azure resources" error or similar (errors may vary). This error might indicate that you're missing the required permissions for the Entra ID app registration.
+
+If you don't have the **Entra ID Application Developer** role or higher, you need to work with a colleague that has this permission to finish setting up the Azure resources. For more information, follow the procedure in the [data connector agent connection](deploy-data-connector-agent-container.md#connect-your-agentless-data-connector-limited-preview) step.
+
 ## Missing "Last address routed"
 
 If you see an error in the security audit log that you're missing the last address routed (an IP address), follow the guidance in the SAP note 3566290.