Microsoft Entra ID SSO for SAP GUI: Understanding the SAML vs SNC Boundary

Rohit Yadav — Tue, 01 Sep 2026 11:53:44 +0000

Integrating SAP with Microsoft Entra ID for Single Sign-On (SSO) can appear straightforward when SAML 2.0 is available as an authentication option.

However, the actual implementation depends on which SAP interface users are accessing.

In a recent customer environment assessment, the requirement was to enable SSO between Microsoft Entra ID and SAP GUI for Windows 7.70.

The initial approach considered a SAML 2.0-based integration. During the technical assessment, we found an important architectural distinction:

SAML 2.0 can be used for applicable SAP web authentication scenarios, but SAP GUI desktop authentication to an SAP ABAP backend follows an SNC-based authentication path.

This article explains what was checked, what was found, why the initial approach could not proceed with the currently available components, and what needs to be validated before implementing SAP GUI SSO.

Requirement

The customer requirement was to provide Single Sign-On for SAP users using their Microsoft Entra ID identity.

The expected user experience was:

User
↓
Microsoft Entra ID
↓
SSO
↓
SAP GUI
↓
SAP ABAP

The customer environment does not have traditional on-premises Active Directory.

The SAP application is accessed through SAP GUI for Windows 7.70.

This point was important because SAP GUI and browser-based SAP applications do not use the same authentication path.

Environment Identified

During the assessment, the following environment details were identified:

Component Finding
Identity Provider Microsoft Entra ID
SAP Client SAP GUI for Windows 7.70
SAP Backend SAP ABAP
SAP System MSD
SAP Instance D00
Operating System Windows client / Linux SAP server
On-premises AD Not available
SNC Enabled
SAP CommonCryptoLib Present
sapgenpse Available
SNC PSE Present
Secure Login Client Not identified on tested workstation

First Important Check — What SAP Client Is Being Used?

The first step in an SAP SSO project should be identifying the actual client used by end users.

There is a major difference between:

SAP GUI for Windows
SAP GUI for HTML
SAP Fiori
SAP web applications

In this environment, the users are accessing SAP through:

SAP GUI for Windows 7.70

Therefore, the authentication architecture needs to support the SAP GUI connection to the SAP ABAP backend.

SAML 2.0 vs SAP GUI Authentication

Microsoft Entra ID supports SAML 2.0 integration with applicable SAP NetWeaver web authentication scenarios.

However, SAP GUI desktop authentication is different.

SAP GUI communicates with the SAP ABAP backend using Secure Network Communication (SNC) when SNC is configured.

Therefore, the following should not be assumed to be the same:

Browser SAP SSO
↓
SAML 2.0

and:

SAP GUI SSO
↓
SNC
↓
X.509 / Kerberos

This was the key architectural finding during the assessment.

Checking the SAP Backend

The SAP server configuration was reviewed to determine whether SNC was already configured.

The following configuration was identified:

snc/enable = 1

This confirms that SNC is enabled on the SAP application server.

The configured SNC identity was also identified:

p:CN=MSP

This indicates that the SAP server already has an SNC identity configured.

SAP Cryptographic Components

The SAP server was also checked for the required cryptographic components.

The following were identified:

libsapcrypto.so
sapgenpse

SAP CommonCryptoLib provides cryptographic functionality used by SAP SNC.

The presence of these components was a positive finding because the SAP backend already has the underlying SNC cryptographic capability.

SNC PSE

An SAP SNC PSE was also identified:

SAPSNCS.pse

The PSE contains the cryptographic identity used by the SAP server.

A certificate associated with the SAP SNC configuration was also identified.

However, an important distinction needs to be made:

The SAP server's SNC certificate is not the same as an individual user's SSO certificate.

Having a server-side SNC PSE does not automatically provide SSO for SAP users.

User-Level SNC Configuration

The next important check is the SAP user configuration.

For certificate-based authentication, the individual SAP user needs to be associated with the appropriate SNC identity.

This is typically checked through:

SU01
↓
User
↓
SNC

In the assessed environment, the test user did not have the required SNC identity mapping configured.

Therefore, even though SNC was enabled on the server, the complete user authentication chain was not established.

SAP Secure Login Client Check

The Windows workstation used for testing was also checked.

SAP Secure Login Client was not identified on the tested workstation.

This is significant because an SAP GUI certificate-based SSO architecture may require a client-side Secure Login component to provide the appropriate credential to SAP GUI/SNC.

The availability and licensing of the required SAP Secure Login components therefore needs to be confirmed with the SAP/Basis team.

Why the Initial SAML Approach Could Not Proceed

The initial assumption was:

Microsoft Entra ID
↓
SAML 2.0
↓
SAP GUI

However, SAP GUI does not simply consume a SAML assertion as its direct authentication mechanism to the ABAP backend.

The relevant authentication path is based on SNC.

A certificate-based architecture would instead involve a flow similar to:

Microsoft Entra ID
↓
Authentication / Identity Layer
↓
X.509 User Certificate
↓
SAP Secure Login Client
↓
SAP GUI
↓
SNC
↓
SAP ABAP

The exact components in this architecture must be validated against the customer's SAP version, licensing and available services.

Current Blockers

Based on the assessment, the following blockers were identified.

Blocker 1 — Secure Login Component

The required SAP Secure Login component/service referenced during the assessment is not currently available/confirmed.

Blocker 2 — Secure Login Client

SAP Secure Login Client was not identified on the tested SAP GUI workstation.

Blocker 3 — User Certificate

No established mechanism for issuing individual X.509 authentication certificates to SAP GUI users was identified.

Blocker 4 — SAP User Mapping

The test SAP user does not currently have the required SNC identity mapping.

Blocker 5 — No On-Premises Active Directory

The customer does not have on-premises Active Directory.

Therefore, a traditional AD/Kerberos-based SAP GUI SSO architecture cannot be assumed for this environment.

Blocker 6 — SAP Licensing / Service Availability

The availability and licensing of the required SAP Secure Login/SAP SSO components have not yet been confirmed.

Important Clarification

The finding should not be interpreted as:

SAP does not support SAML 2.0.

That statement would be too broad.

The correct interpretation is:

SAP supports SAML 2.0 for applicable authentication scenarios, including supported SAP web-based scenarios. However, SAP GUI desktop authentication to the SAP ABAP backend follows the SNC authentication path.

Therefore, Microsoft Entra ID SAML configuration by itself does not complete the SAP GUI SSO implementation.

What Is Already Available?

The assessment did identify several useful components in the existing environment.

Available
SAP GUI 7.70
SAP ABAP backend
SNC enabled
SAP CommonCryptoLib
sapgenpse
SAP SNC PSE
SAP server SNC identity
Not Available / Not Confirmed
SAP Secure Login Client
User X.509 certificate mechanism
SAP user SNC identity mapping
Enterprise PKI/CA
SAP Secure Login Service availability
SAP SSO licensing
Complete user certificate authentication flow

This means the SAP backend is not starting from zero.

The existing SNC infrastructure can be investigated further once the missing components and requirements are confirmed.

Information Required From the SAP/Basis Team

Before any production configuration changes are made, the following should be confirmed with the SAP team:

Exact SAP ABAP/NetWeaver version.
Exact SAP kernel version.
Whether the current SAP version supports the required X.509/SNC SSO architecture.
Whether SAP Secure Login Service is available.
Whether SAP Single Sign-On 3.0 is licensed.
Whether SAP Secure Login Client is required.
Whether SAP Secure Login Client is supported with SAP GUI 7.70.
Whether an enterprise PKI/CA is available.
Who issues user authentication certificates.
Required certificate format.
Required certificate Subject/SAN.
Required SNC name format.
How the X.509 identity should be mapped to the SAP user.
Whether the existing SAP SNC PSE can be reused.
Whether any additional SAP components or licenses are required.

Recommended Validation Flow

Once the SAP-side prerequisites are confirmed, the implementation should be validated using a single test user.

The validation flow should be:

Microsoft Entra ID
↓
User Authentication
↓
Certificate / Secure Login
↓
SAP GUI
↓
SNC
↓
SAP ABAP
↓
SAP User Mapping

The first objective should be to prove SSO for one test user before considering wider deployment.

Troubleshooting Checklist

For future SAP GUI SSO troubleshooting, validate the following in order:

[ ] Confirm SAP GUI version
[ ] Confirm SAP backend version
[ ] Confirm SAP GUI vs browser access
[ ] Check snc/enable
[ ] Check snc/identity/as
[ ] Check CommonCryptoLib
[ ] Check SAP SNC PSE
[ ] Check server certificate
[ ] Check SAP user SNC mapping
[ ] Check client SNC configuration
[ ] Check Secure Login Client
[ ] Check user certificate
[ ] Check certificate trust
[ ] Check PKI/CA
[ ] Check SAP licensing
[ ] Perform single-user pilot

This sequence helps avoid spending time configuring Microsoft Entra SAML before confirming that the SAP GUI authentication path is ready.

Security Considerations

SAP environments contain highly sensitive infrastructure information.

When troubleshooting or documenting SAP SSO, avoid publishing:

SAP usernames
Internal IP addresses
Internal hostnames
SAP system passwords
PSE passwords
Private keys
Certificate private material
Customer tenant identifiers
Internal URLs
Production configuration secrets

If screenshots are used in documentation, sensitive customer information should be removed or blurred.

Key Lessons Lesson 1 — Identify the SAP client first

Always determine whether users are accessing SAP through SAP GUI, Fiori, SAP GUI for HTML, or another web interface.

Lesson 2 — Do not assume SAML solves every SAP SSO scenario

The identity provider may support SAML while the SAP client uses a different authentication protocol.

Lesson 3 — Server SNC is not user SSO

An SNC PSE on the SAP server establishes server-side cryptographic identity.

It does not automatically create user-level SSO.

Lesson 4 — User mapping is critical

Certificate-based authentication requires the certificate identity to be correctly associated with the SAP user.

Lesson 5 — Validate before changing production

Existing SAP SNC and PSE configurations should be understood before making production changes.

Conclusion

The assessment demonstrated that the customer already has an SNC-enabled SAP backend with SAP CommonCryptoLib, sapgenpse, an SNC PSE and a configured SAP server identity.

However, the complete user authentication path required for SAP GUI SSO is not currently established.

The key finding is:

Microsoft Entra ID SAML 2.0 configuration alone is not sufficient to provide SSO to the existing SAP GUI desktop client.

For SAP GUI, the authentication architecture needs to account for SNC and an appropriate user authentication credential, such as an X.509 certificate or another supported mechanism.

The availability of SAP Secure Login components, PKI, licensing and SAP-side user mapping must therefore be validated before the implementation can proceed.

Official References
Microsoft Learn — Configure SAP NetWeaver for Single Sign-On with Microsoft Entra ID
SAP Help — SAP Secure Login Service for SAP GUI
SAP Help — SNC and X.509 certificate authentication
SAP Help — SAP user SNC identity mapping

DEV Community: Rohit Yadav

Microsoft Entra ID SSO for SAP GUI: Understanding the SAML vs SNC Boundary