SAC live connection to SAP S/4HANA: the three methods, prerequisites and common gotchas

Setting up a live connection from SAP Analytics Cloud to S/4HANA is one of those tasks that's straightforward once you know the map — and a multi-day headache when you don't. There are three methods, one non-negotiable prerequisite, and one gotcha that catches almost everyone. Here's the map.

First, the prerequisite: the InA service

Whatever method you pick, the source must expose the InA service (Information Access). Make sure /sap/bw/ina/service/v2 (or a higher-level package) is active and reachable. You can test it in a browser: open https://<your-ABAP-system>/sap/bw/ina/GetServerInfo?sap-client=<client> — you should be prompted to log in and then get a JSON response. If that fails, nothing downstream will work. On SAP NetWeaver 7.52 or above, apply SAP Note 2531811 (or import ABAP 7.52 SP1) to fix known CORS issues first.

The three connection methods

1. Direct connection (CORS) — the browser talks straight to S/4HANA; no extra server sits in between. You enable CORS on the ABAP Application Server (parameter icf/cors_enabled = 1 via RZ11), add your SAC tenant host to the HTTP allowlist (transaction /NUCONCOCKPIT, service path /sap/bw/ina, methods GET/HEAD/POST/OPTIONS), and configure cross-site cookies. Simplest topology, but it means the browser must reach the source directly.

2. Tunnel connection (SAP Cloud Connector) — for on-premise systems behind a firewall. SAC establishes an HTTPS tunnel to S/4HANA through the SAP Cloud Connector. This is the method to use when you don't want to expose the ABAP AS to the browser, and it supports SSO via Principal Propagation (SAC and S/4HANA must share the same identity provider).

3. Cloud edition (OAuth) — if you're on S/4HANA Cloud, the connection uses OAuth and the setup is comparatively easy: the browser connects directly to the cloud service, no Cloud Connector needed.

The gotcha everyone hits: the login popup

You finish the config, open a live story, and every user gets prompted for their S/4HANA username and password before the data loads. That is almost always cross-site cookies + SSO, not a broken connection. Modern browsers (Chrome's SameSite policy) block the source's session cookie unless S/4HANA issues it with the right attributes. Two fixes: configure cross-site cookies on the source, and set up proper SSO (SAML with the same IdP, or Principal Propagation on the tunnel method) so no popup ever appears. A frequent secondary cause is a missing SSL/TLS certificate on the S/4HANA side — live connections require HTTPS end to end.

Who needs to be involved

This is not a solo job. Most steps happen on the ABAP Application Server, before you ever create the connection in SAC. Expect to work with the SAC system owner plus Basis/security stakeholders. On the SAC side you'll need the right roles — Admin, Application Creator, BI Content Creator, BI Admin or Planner Reporter — with connection and data-source permissions.

Before you commit

Live to S/4HANA gives you real-time, governed data with no copy — but remember it's analytics-first: planning generally needs an import model. If you're weighing the approaches, start with SAC live connection vs import model. And if your use case turns out to be planning or a standalone regulatory model, the template catalog and regulatory accelerators cover the import side.

Sources: SAP Help Portal — Live Data Connection to SAP S/4HANA (Direct CORS via Unified Connectivity, Tunnel via Cloud Connector, Cloud Edition via OAuth); SAP Note 2531811 (CORS on NetWeaver 7.52+). Transactions, parameters and paths can change between releases — verify against your system version.