Agentless SAP connector ingests only few users into ABAPUserDetails

The first check is whether the connector has completed its configured ingestion-cycle-days period, because ABAPUserDetails is intentionally collected progressively across that cycle rather than necessarily appearing in full during each poll.

Check the user-master collection cycle

The default ingestion-cycle-days value is 7 days, with supported values from 1 through 14 days. It controls how long the connector takes to ingest the complete User Master dataset, including all users and roles; changes to User Master data are handled separately.^1^

1. Establish when this SAP client was connected or when the Data Collector configuration was last redeployed.
2. Wait for one complete configured cycle before comparing SAP and Sentinel totals.
3. Check whether records continue arriving:

ABAPUserDetails
| where TimeGenerated > ago(14d)
| summarize Records=count() by bin(TimeGenerated, 1d)
| order by TimeGenerated asc

A steadily increasing population during the cycle indicates phased collection, not necessarily user-type filtering.

Verify the effective Integration Suite settings

In the value-mapping artifact used by the Data Collector iFlow, inspect both:

• the global agency; and
• the agency whose name exactly matches this SAP system’s RFC destination.

System-specific mappings can override global behavior. Parameters not present in the artifact retain their defaults.^1^

Confirm these effective values:

After changing a value mapping, save and deploy the artifact. For a controlled diagnostic, temporarily setting ingestion-cycle-days to 1 can make the full cycle complete sooner, but monitor SAP and Integration Suite load while testing.

The published customization parameters do not document a selector that intentionally limits ABAPUserDetails to technical users. User and authorization details are supported sources for the agentless connector.^2^

If a complete cycle still produces only a subset

Because the source records and broad SAP authorization have already been checked, inspect execution completeness rather than repeating those checks:

1. In SAP Integration Suite, open Monitor → Integrations.
2. Locate Data Collector executions for the affected RFC destination.
3. Inspect the Message Processing Log (MPL) for failed, retried, long-running, or abandoned user-master reads.
4. If no useful error appears, temporarily enable trace logging and reproduce one collection run.
5. Deploy the Prerequisite checker iFlow against the same RFC destination. Run it for up to 24 hours at one-minute frequency, then inspect its MPL attachments and per-check runtime measurements—particularly the user master read.^3^

The agentless poller enforces timeouts when calling the Data Collector iFlow; exceeding them can cause partial ingestion or retries. The prerequisite checker is the documented method for identifying a slow RFC destination or user-master operation.^3^

Information needed if the issue persists

Provide these items in a Microsoft support case, with secrets and personal data removed:

• Connector onboarding or last-redeployment timestamp.
• Effective ingestion-cycle-days and collect-user-master-data-users values from both global and RFC-specific mappings.
• Expected SAP user count and current distinct ABAPUserDetails count after a complete cycle.
• Sanitized examples of one ingested technical user and one missing dialog user.
• Data Collector MPL status, duration, correlation/message ID, attachments, and trace output.
• Prerequisite checker results and user-master-read runtime.
• Whether ingestion grows each day, stops at a repeatable count, or varies between cycles.
• SAP product/release, client number, RFC destination name, and deployed Sentinel Integration Suite package version.

These details distinguish normal cycle-based ingestion from iFlow timeout, batching, or package-level selection behavior.

References

1. Connect your SAP system to Microsoft Sentinel
2. Migrate to the Microsoft Sentinel agentless SAP data connector
3. Troubleshooting your Microsoft Sentinel solution for SAP applications deployment