View Categories

Installation Guide: Multi-Tenant

2 min read

Power BI Connector for SAP is distributed as a SaaS application on SAP BTP. To install it for your organization, an administrator subscribes your BTP subaccount to the connector, assigns role collections to end users, and creates a destination pointing at your S/4HANA system.

i
If your S/4HANA system runs on-premise, additional configuration is required inside SAP itself. Complete the steps below first, then continue with On-Premise SAP Configuration.

Prerequisites #

  • An SAP BTP subaccount where you have Subaccount Administrator permissions.
  • An identity provider (SAP IAS, or a corporate IdP trusted by your BTP subaccount) so users can sign in with their corporate credentials.
  • Service plan entitlements for xsuaa, connectivity, and destination in your subaccount (added below).
  • (On-premise S/4HANA only) Cloud Connector configured between your BTP subaccount and your SAP backend.

Step 1: Add the required entitlements #

In the BTP cockpit, open Subaccount → Entitlements and add the following service plans:

Service Plan
xsuaa application
connectivity lite
destination lite

Save the entitlements.

Tenant subaccount entitlements

Step 2: Subscribe to the connector #

In the BTP cockpit, open Subaccount → Instances and Subscriptions. Locate powerbi-connector in the available subscriptions and click Subscribe.

For SAP’s general procedure, see Subscribe to multitenant applications using the cockpit.

Step 3: Assign role collections #

Two role collections are created automatically when you subscribe:

  • Metrica Software Power BI Connector User — sign in; create and edit personal data sources; share them with other users in the same tenant; mint personal access tokens; view your own activity history.
  • Metrica Software Power BI Connector Administrator — everything a User does, plus tenant-wide settings on the Administration page (for example, the token expiry policy) and visibility into other users’ activity. The Administrator role includes the User scope, so administrators do not need both.

Assign the role collections in Subaccount → Security → Users:

  1. Open the user, identity provider group, or SAP IAS group you want to grant access to.
  2. Add the appropriate role collection.
  3. Save. The user must sign out and back in for the new role to take effect.
Assigning a role collection in the BTP cockpit

For more on role assignment, see Application Permissions Setup.

Step 4: Create the SAP destination #

The connector reads from SAP through the BTP Destination Service. Create a destination named exactly s4-destination — this name is wired into the connector configuration and cannot be changed.

In Subaccount → Connectivity → Destinations → New Destination, set:

  • Name: s4-destination
  • Type: HTTP
  • URL: your S/4HANA system’s base URL
  • Proxy Type:
    • OnPremise if your S/4HANA runs on-premise (routes via Cloud Connector).
    • Internet if your S/4HANA is reachable directly over the public internet (typically S/4HANA Public Cloud).
  • Authentication: one of the options below.

Add an additional property:

  • Property: sap-client
  • Value: your S/4HANA client number (for example, 200).

Authentication options #

For productive deployments, use one of:

  • OAuth2ClientCredentials
  • OAuth2SAMLBearerAssertion
  • PrincipalPropagation — for on-premise S/4HANA via Cloud Connector.

For sandbox / development against the SAP API Business Hub sandbox or a non-productive dev system, BasicAuthentication is acceptable.

Avoid BasicAuthentication for production: it stores static credentials at rest on the destination and provides no per-user audit trail in SAP.
s4-destination configured in the BTP cockpit

Step 5 (on-premise only): Configure the SAP backend #

If your S/4HANA system runs on-premise (Private Cloud, S/4 on-prem, ECC, BW/4HANA, and so on), the SAP system itself needs configuration before the destination will return data. See On-Premise SAP Configuration for the steps inside SAP: technical user, OData service activation, PFCG role, business authorizations.

Step 6: Open the connector and verify the install #

In Subaccount → Instances and Subscriptions, click the powerbi-connector subscription and choose Go to Application. You land on the Data Sources page.

Go to Application from the subscription

From there, mint an access token and create a small data source to confirm the install works end to end. For the step-by-step walkthrough, see Quickstart — from Zero to a Power BI Report.

What you’ll need next #

Updated on June 2, 2026