01 What happened
SAP announced the integration of the Application Vulnerability Report for SAP BAIP custom apps into the Microsoft Sentinel Solution for SAP BAIP. The integration enriches BAIP telemetry with CVE findings, enabling correlation with Entra ID sign-ins, lateral movement, and sensitive data downloads in Sentinel. The connector is in preview; the report service remains in Beta. Getting started requires deploying Sentinel Solution for SAP BAIP v3.2.1, enabling the connector with a service key, and deploying the BAIP Activity workbook and analytic rules.
02 Key details
- Since April 2026, custom BAIP apps have become first-class targets in software supply chain attacks; SAP states customers who ran vulnerability scanning spotted the exposure fastest and rolled out fixes within hours.
- The Application Vulnerability Report continuously identifies known CVEs in running BAIP apps without an agent or separate scanner.
- Integration with Microsoft Sentinel enables SOC teams to correlate CVE findings with suspicious Entra ID sign-ins, lateral movement, and sensitive data downloads.
- To start, deploy Microsoft Sentinel Solution for SAP BAIP v3.2.1, enable the connector (preview) with a service key, and use the BAIP Activity workbook and analytic rules.
03 Why it matters
Isolated vulnerability reports lack runtime exploitation signals. Correlating CVE findings with SOC data in Sentinel turns separate noise items into actionable incidents.
04 Who it matters to
SAP BAIP security teams and SOCs (Security Operations Centers).