01 What happened
SAP has introduced the Patch Day Policy Agent in SAP Cloud ALM Configuration & Security Analysis (CSA). From one Joule prompt, the agent scans ABAP security notes for a target month, creates checks and policies, validates test results and activates only the checks that pass.
02 Key details
- The agent queries the ABAP_RECOMMENDED_NOTES_STATUS store, creates checks named ABAP-SNOTE-{noteId}-{version}, and builds one Single Policy per service type plus a monthly Composite Policy.
- New checks stay inactive until their asynchronous test runs complete. Only checks whose test runs pass are activated; failed or timed-out checks remain inactive and are listed as action items for administrators.
- Re-running the agent for the same month adds only missing checks, records duplicates as SKIPPED_DUPLICATE and does not recreate existing policies. A single failed check does not block processing of other eligible notes.
- Prerequisites include an invoking user with the Configuration & Security Administrator or Configurator role in CSA, ABAP systems integrated for CSA data collection, and an active daily data push to SAP Cloud ALM. The agent is available in SAP Discovery Center, where costs are estimated with a sizing formula.
03 Why it matters
Security Risk Officers in large SAP landscapes spend hours each month on repetitive patch-day configuration. The announcement shows which steps the agent automates, which safeguards apply and which prerequisites must be met before use.
04 Who it matters to
Security risk specialists and SAP system administrators.
Original source