- Home
- DevOps
- SAP Basis
SAP Basis: the engine room, explained for everyone else
What Basis does, how an SAP system is built, what to check before you open a ticket, and the small facts Basis people know by heart and almost nobody else does.
- Monitoring
- Users and authorizations
- Transports
- Jobs
- SAP HANA
- RISE with SAP
| No | Type | Status | Time | Program |
|---|---|---|---|---|
| 0 | DIA | Running | 1 | SAPMF05A |
| 1 | DIA | Waiting | ||
| 2 | UPD | Waiting | ||
| 3 | BTC | Running | 412 | RFFOBR_A |
| 4 | SPO | Waiting |
An illustrative view of the work processes that serve every user. A background job may run for hours; a dialog step is stopped after a time limit.
What is SAP Basis?
SAP Basis is the technical foundation under every SAP system, and the name of the team that runs it. Basis installs and upgrades systems, applies support packages and kernel patches, looks after users and roles, imports transports, schedules jobs, watches performance and keeps the database healthy. The functional consultant decides what the system does; Basis makes sure it runs.
The name comes from SAP R/3, where the technical layer below the business applications was called the Basis system. SAP has renamed the technology several times since, to SAP Web Application Server in 2001, SAP NetWeaver in 2004 and ABAP Platform for SAP S/4HANA, but the job title stuck. It still shows in every SAP Note: application components that start with BC belong to Basis.
This page is for everyone who is not Basis: users who want to solve small problems on their own, and consultants who want to reach Basis with the right facts in the first message.
Basis in four numbers
- 3
characters in a system ID, such as PRD. Some, like SAP, SQL and SYS, are reserved and cannot be used.
- 600
seconds, ten minutes, is the default limit for one dialog step. Then the program ends with a TIME_OUT dump; background jobs have no limit.
- 16
SAP GUI sessions per user in current releases. Systems older than ABAP Platform 2020 stop at 6 by default.
- 3299
is the SAProuter port: the door SAP Support uses when you open a service connection for them.
Architecture
How an SAP system is built
Four layers, from your screen down to the database. Pick one to see what it does, what Basis looks after there and a fact most users never hear.
Layer 1 of 4
Presentation layer
Where people work: SAP GUI for Windows, SAP GUI for HTML, the SAP Fiori launchpad in a browser and SAP Business Client. No business logic runs here; the screen only shows what the application server sends.
Basis looks after
- Roll out SAP GUI and keep it patched
- Share one central SAP Logon system list with every PC
- Run the SAP Fiori front-end server, its caches and the app index
Where to look
SAP Logon/UI2/FLPSMICM/UI5/APP_INDEX_CALCULATE
Did you know? Since SAP GUI 7.40, SAP Logon keeps its system list in an XML file, SAPUILandscape.xml. Basis can point every PC to one central copy, so a new system shows up for everyone at the same time.
Layer 2 of 4
ABAP application server
One or more instances: the primary application server and any additional ones. Each has a dispatcher that queues requests and hands them to work processes, the ICM for HTTP traffic such as SAP Fiori and OData, and a gateway for RFC.
Basis looks after
- Size the work processes: dialog, background, update, spool
- Set profile parameters for memory, time limits and security
- Spread users across servers with logon groups
Where to look
SM50SM66SM51SMLGRZ10RZ11SMGW
Did you know? A dialog work process is not yours for the whole session. It serves you for one dialog step, usually well under a second, then rolls your context out and serves the next user. That is how a few dozen processes serve hundreds of people.
Layer 3 of 4
ABAP central services (ASCS)
The message server knows every application server of the system and balances logons between them. The enqueue server holds the lock table for the whole system, so two people never change the same document at once.
Basis looks after
- Make central services highly available
- Replicate the lock table to a second host
- Watch the size of the lock table and very old locks
Where to look
SM12SMMSSMLG
Did you know? Locks live in the enqueue server’s memory, not in a database table. That is why high-availability setups replicate the lock table to a second host: losing it would mean losing every lock in the system at once.
Layer 4 of 4
Database
SAP HANA for SAP S/4HANA; SAP ERP (ECC) can also run on Oracle, IBM Db2, Microsoft SQL Server, SAP ASE or SAP MaxDB. Business data, customizing and even the ABAP programs themselves are stored here.
Basis looks after
- Back up data and logs, and test the restore
- Watch memory, disk and the biggest tables
- Apply database revisions, with the DBA where there is one
Where to look
DBACOCKPITDB02ST04SAP HANA cockpit
Did you know? SAP HANA keeps data in memory but writes it to disk at savepoints, every five minutes by default. In between, the redo log protects every committed change, and log backups run every fifteen minutes by default.
Read an instance name: DVEBMGS00
Classic systems name the central instance after the services it runs, one letter each, followed by the instance number. New installations since SAP NetWeaver 7.50 call the primary application server D00 and move the message and enqueue servers to ASCS01; upgraded systems keep the old name. The letters still name what you see in SM50.
- DDialogScreens and online work of users
- VUpdateVerbuchung: writes postings to the database
- EEnqueueThe lock table
- BBackgroundBatch jobs scheduled in SM36
- MMessage serverKnows all servers, balances logons
- GGatewayRFC connections to other systems
- SSpoolPrinting and output requests
- 00Instance numberTwo digits, also in every port
For users and consultants
Before you call Basis: a symptom finder
Pick what you see on the screen. You get what is really going on, where to look, what you can do yourself and what to send Basis so they can act at the first message.
You see
A posting showed “Document 1900001234 was posted”, yet FB03 cannot find it, or you got an express message saying the update was terminated.
What is going on
SAP saves in two steps. The dialog step checks the data, takes a document number and shows it to you; then an update work process writes the data to the database a moment later. If that update fails, nothing is saved, the number is gone and you get an express message “Update was terminated”.
Where to look
SM13ST22FB03
You can do
- Check FB03 before posting again, so you do not post twice
- Write down the time, the transaction and the document number
Send to Basis
- The SM13 entry for your user with status Error
- The short dump from ST22 at the same minute, if there is one
Insider tip. After the cause is fixed, Basis can repeat the update from SM13. Terminated updates are also one reason for gaps in document numbers; number range buffering is another, explained for FI documents in SAP Note 1398444.
You see
“Material 4711 is locked by user JSILVA” or “Vendor 100025 is being processed by you” in another session.
What is going on
Before changing an object, SAP sets a lock in the enqueue server so nobody else changes it at the same time. The lock is released when the other user saves or leaves the transaction. Sometimes the other user is you, in another session.
Where to look
SM12SM04AL08
You can do
- Close your own other sessions on the same object
- Ask the named user to leave the transaction
- Look the lock up in SM12 to see since when it exists
Send to Basis
- The object, the lock owner and the time from SM12
- Whether the owner is still logged on (SM04 or AL08)
Insider tip. Deleting a lock in SM12 is a Basis decision. If the owner is still working, two people may then change the same data and leave it inconsistent.
You see
“You are not authorized to use transaction FB50” or “No authorization for company code 1000”.
What is going on
Every transaction and many fields are protected by authorization objects. Your roles carry the values you are allowed. The message only tells you that a check failed, not which one.
Where to look
SU53SU56SUIM
You can do
- Run SU53 right after the error, in the same session
- Take a screenshot of the object, fields and values shown
Send to Basis
- The SU53 screenshot and the transaction you were running
- The business reason, so the right role can be extended
Insider tip. When SU53 is not enough, for example with background jobs or RFC users, the security team can record every check with the system-wide trace STAUTHTRACE.
You see
“Password logon no longer possible – too many failed attempts” or “User is locked. Please notify the person responsible”.
What is going on
After a number of wrong passwords, five by default in current releases, SAP locks the user. Since release 7.0 such locks are no longer lifted automatically at midnight, so someone has to unlock you. An administrator can also lock users on purpose, for example during a period-end close.
Where to look
SU01SU10
You can do
- Use your company’s password self-service, if there is one
- Check you are logging on to the right system and client
Send to Basis
- Your user ID, the system and the client
- The exact message: a failed-logon lock and an administrator lock are different
Insider tip. Users exist per client. Locked in client 100 does not mean locked in client 200 of the same system, and a new password in one client changes nothing in the other.
You see
A grey screen titled “Runtime Errors” with a name in capitals, such as TIME_OUT, MESSAGE_TYPE_X or TSV_TNEW_PAGE_ALLOC_FAILED.
What is going on
The program ended abnormally. ST22 keeps a full record: what happened, where in the code, the user, the server and the values in memory. The dump name alone often finds the SAP Note that fixes it.
Where to look
ST22SM21
You can do
- Open ST22, find your dump and read “What happened” and “Error analysis”
- Search SAP Notes with the dump name and the program name
Send to Basis
- The dump name, date and time
- What you did just before, and whether it happens again
Insider tip. Dumps are deleted automatically after four weeks. In ST22, mark an important one with Keep so it is still there when somebody gets to it.
You see
A long report or query ends with the dump TIME_OUT, always after roughly the same time.
What is going on
A dialog step may run only for a limited time, ten minutes by default, so one user cannot block a dialog work process for everyone. Background jobs run at low priority with no time limit.
Where to look
ST22SM37SP01
You can do
- Run it in the background: Program › Execute in Background (F9)
- Fill key fields such as company code and fiscal year to read less data
- Need to give up on a running screen? The window menu, the icon at the top left of the SAP GUI title bar, has Stop Transaction
Send to Basis
- The program, the variant and how long it ran
- Only if the background run is slow too
Insider tip. Basis can raise the limit, but it applies to every user on the server. Running heavy reports in the background is almost always the better answer.
You see
The job you scheduled has no output, or SM37 shows it in an unexpected status.
What is going on
SM37 tells you exactly where it stopped. Scheduled means it has no start condition yet. Released means it is waiting for its start time. Ready means it is waiting for a free background process. Canceled means it started and failed.
Where to look
SM37SM36SP01
You can do
- Open the job log in SM37: the last messages say why it failed
- Check the job’s spool for the output
Send to Basis
- Job name, user, status and the job log
- If many jobs sit in Ready, Basis needs to look at background capacity
Insider tip. A job runs with the authorizations of its step user, not of the person who scheduled it. A job that works for you can fail when it runs under another user.
You see
A payment advice, a dunning letter or a purchase order sent by e-mail never reached the recipient.
What is going on
SAP first stores the message as a send request, then a SAPconnect job sends the queue at intervals. The request can be waiting, failed or sent without the recipient’s server accepting it.
Where to look
SOSTSCOT
You can do
- Look the message up in SOST to see its status and error text
- Check the e-mail address in the business partner or vendor
Send to Basis
- The SOST entry with status and time
- In a test system, ask first: sending is often switched off on purpose
Insider tip. Quality systems often have outbound e-mail disabled after a refresh, so nothing reaches real customers. A missing e-mail in QA may be the system working as intended.
You see
You printed and nothing came out of the printer, or you need the output as a PDF.
What is going on
Printing creates a spool request first, then an output request to the device. Either step can wait or fail, and the spool keeps the content for a while, so it can be printed again.
Where to look
SP02SP01SPAD
You can do
- Open SP02, find your request and check its status
- Print again from the spool, or to another device
- Save the output as a PDF with report RSTXPDFT4 in SA38
Send to Basis
- The spool number and output device
- The error text shown on the output request
Insider tip. The spool is not an archive. Old requests are deleted by a standard cleanup job, so save what you need to keep.
You see
An order, an invoice or a bank file did not arrive in the other system, or arrived twice.
What is going on
SAP interfaces queue their work. IDocs have a status, RFC calls that failed wait in tRFC or qRFC queues, and a single blocked queue entry can hold up everything behind it.
Where to look
WE02BD87SM58SMQ1SMQ2SM59
You can do
- Find the IDoc in WE02 and read its status records
- Reprocess it with BD87 once the cause is fixed, if you are allowed to
Send to Basis
- IDoc numbers or the queue name, with status and error text
- Whether the partner system is reachable: SM59 has a connection test
Insider tip. Reprocess with BD87, not with the test tool WE19, in production. And never resend a payment or invoice IDoc before checking the partner side: the second run is a real second payment or invoice.
You see
You saved a customizing change, it works for you, but a colleague on another application server still gets the old behaviour.
What is going on
Many customizing tables are buffered in the memory of each application server. The servers exchange changes every two minutes by default, so for a short while different servers can answer differently.
Where to look
ST02SM51
You can do
- Wait a couple of minutes and test again
- Check System › Status to see which server each of you is on
Send to Basis
- Only if the difference lasts: transaction, table and the two servers
Insider tip. The commands /$TAB and /$SYNC reset the table buffers or all buffers, but only on the server you are logged on to, and SAP warns they load the system heavily while the buffers refill. They need a Basis authorization for good reason.
You see
A tile shows “Failed to load data”, an app still shows the old layout after a transport, or texts are missing.
What is going on
A Fiori app calls OData services on the server, and several caches sit in between: in the browser, on the front-end server and for OData metadata. Errors from the services are logged on the server, not on your screen.
Where to look
/IWFND/ERROR_LOG/IWBEP/ERROR_LOG/UI2/INVALIDATE_GLOBAL_CACHES
You can do
- Clear your browser cache, or try a private window
- Note the app name, the time and the exact message
Send to Basis
- The entry in /IWFND/ERROR_LOG for your user and time
- Whether it fails for everyone or only for you
Insider tip. After a transport of Fiori content, Basis often has to invalidate the caches and recalculate the UI5 app index before users see the new version.
You see
Every screen takes seconds, in several transactions at once, for many users.
What is going on
When all work processes are busy, new requests wait in the dispatcher queue. The cause can be a heavy job, a database problem, a blocked update or an interface flooding the system.
Where to look
SM66SM50ST03NSTAD
You can do
- Note the time, the transactions and how long a screen takes
- Check whether colleagues on other servers have the same problem
Send to Basis
- Times, transactions and response times
- Anything unusual that started just before: a mass run, an import, a period-end job
Insider tip. STAD keeps a statistics record for every dialog step: who ran which transaction, when and how long the database and the CPU took. With exact times, Basis can find the cause long after the user has given up.
Toolbox
The Basis toolbox
The transactions Basis lives in, by area, with who normally has access. Your own roles decide what you can open: if a transaction is blocked, that is the authorization concept working, not a bug.
| Transaction | What it does | Area | Usually for |
|---|---|---|---|
SM04 | Users logged on to this application server, with their sessions and transactions | Monitoring | Consultants |
AL08 | Users logged on to all application servers of the system | Monitoring | Consultants |
SM50 | Work processes of one server: what each runs, for whom and for how long | Monitoring | Consultants |
SM66 | Work processes across all servers of the system | Monitoring | Consultants |
SM12 | Lock entries: who is locking which object, and since when | Monitoring | Consultants |
SM13 | Update requests, including failed ones with status Error | Monitoring | Consultants |
ST22 | ABAP short dumps, with error analysis and the line of code | Monitoring | Consultants |
SM21 | System log: server-level errors, terminations and warnings | Monitoring | Basis |
SLG1 | Application log written by business programs, such as MRP or bank statements | Monitoring | Consultants |
SU3 | Your own defaults, parameters, date and decimal formats | Users and security | Everyone |
SU53 | The last failed authorization check, with object, fields and values | Users and security | Everyone |
SU56 | The authorizations currently in your user buffer | Users and security | Everyone |
RKSE16N_CD_DISPLAY | Report showing changes made to table data with SE16N: who, when, old and new values | Users and security | Basis |
SU01 | Create, change, lock and unlock users | Users and security | Basis |
SU10 | Mass changes to users: lock, unlock, add or remove roles, validity | Users and security | Basis |
PFCG | Roles and the authorizations they carry | Users and security | Basis |
SUIM | User information system: who has transaction X, which roles hold an authorization | Users and security | Consultants |
STAUTHTRACE | System-wide authorization trace, across all application servers | Users and security | Basis |
RSAU_READ_LOG | Security audit log: logons, transaction starts, critical changes | Users and security | Basis |
SM01_DEV | Lock and unlock transactions for the whole system (SM01_CUS: per client) | Users and security | Basis |
SM36 | Define and schedule background jobs | Jobs, print, e-mail | Consultants |
SM37 | Job overview: status, job log and output | Jobs, print, e-mail | Everyone |
SJOBREPO | Technical jobs that SAP S/4HANA schedules by itself | Jobs, print, e-mail | Basis |
SP02 | Your own spool requests | Jobs, print, e-mail | Everyone |
SP01 | All spool and output requests | Jobs, print, e-mail | Consultants |
SPAD | Printers and output devices | Jobs, print, e-mail | Basis |
SOST | Outgoing e-mails and other send requests, with status | Jobs, print, e-mail | Consultants |
SCOT | SAPconnect: how SAP sends e-mail | Jobs, print, e-mail | Basis |
SE09 | Transport organizer: your requests and tasks (SE10 is the same) | Transports | Consultants |
SE01 | Extended transport organizer, including transports of copies | Transports | Consultants |
SE03 | Transport tools, such as finding which requests contain an object | Transports | Consultants |
STMS | Transport Management System: import queues, routes, approvals | Transports | Basis |
SCC1 | Copy customizing from a transport request into another client of the same system | Transports | Consultants |
SCC4 | Client settings: role, and whether changes and transports are allowed | Transports | Basis |
SE06 | System change option: what may be changed at all in this system | Transports | Basis |
SCU3 | Change logs of customizing tables, where table logging is on | Transports | Consultants |
SM59 | RFC destinations, with connection and authorization tests | Interfaces | Basis |
SM58 | Transactional RFC calls that failed and wait to be sent again | Interfaces | Consultants |
SMQ1 | Outbound qRFC queues (SMQ2: inbound) | Interfaces | Consultants |
WE02 | IDoc list with status records and data (WE05 is the same) | Interfaces | Consultants |
BD87 | Status monitor to reprocess IDocs | Interfaces | Consultants |
WE19 | IDoc test tool: copy an IDoc, change it and process it again; not for production | Interfaces | Consultants |
SICF | HTTP services such as OData, SAP Fiori and web services | Interfaces | Basis |
/IWFND/ERROR_LOG | SAP Gateway error log for OData calls from SAP Fiori apps | Interfaces | Consultants |
STAD | Statistics records: response time of each dialog step, per user and transaction | Performance | Basis |
ST03N | Workload analysis: top transactions, users and response times | Performance | Basis |
ST05 | SQL trace: every database call of a user or program | Performance | Consultants |
SAT | ABAP runtime analysis: where a program spends its time | Performance | Consultants |
ST02 | Buffers and memory of an application server | Performance | Basis |
ST06 | Operating system monitor: CPU, memory and disks | Performance | Basis |
DBACOCKPIT | Database monitoring and administration | Performance | Basis |
SM51 | Application servers of the system, and which one you are on | System | Consultants |
SMLG | Logon groups that spread users across servers | System | Basis |
RZ10 | Maintain profile parameters; changes apply at the next restart | System | Basis |
RZ11 | Display one parameter; change dynamic ones until the next restart | System | Basis |
SMICM | Internet Communication Manager: HTTP, HTTPS and the server cache | System | Basis |
SNOTE | Implement the code corrections of SAP Notes | System | Basis |
SPAM | Import support packages (SAINT: add-ons) | System | Basis |
STZAC | System time zone | System | Basis |
SE93 | See which program sits behind a transaction code | System | Consultants |
SLICENSE | SAP license keys of the system | System | Basis |
No transaction matches. Try a shorter word, or pick All.
Command field tricks such as /n, /o and /nex are on SAP optimization; the transactions behind the launchpad are on SAP Fiori.
Network
Ports, instance numbers and system IDs
Every SAP port is built from the instance number. Know the instance number and you know which ports the network team has to open, a question that comes up in every new interface.
Instance number
00 to 97 · SAP Logon shows it as “Instance Number”
Shown for instance 00
- 3200SAP GUI (dispatcher)
32NN - 3300Gateway (RFC)
33NN - 4800Gateway with SNC
48NN - 3600Message server
36NN - 8100Message server HTTP
81NN - 8000ICM HTTP (SAP Fiori, OData)
80NN - 44300ICM HTTPS
443NN - 50013SAP start service
5NN13 - 50014SAP start service HTTPS
5NN14 - 30013SAP HANA system database SQL
3NN13 · HANA instance - 30041SAP HANA first tenant SQL
3NN41 · HANA instance - 3299SAProuter
Fixed, no instance number
SAP’s default port numbers. SAP HANA has its own instance number, often different from the application server’s. Basis can change some ports, and the firewall decides which are reachable.
System ID (SID) rules
- Exactly three characters, unique in your landscape.
- Upper-case letters and digits; the first must be a letter.
- Reserved words cannot be used. A few of them:
SAPSQLSYSSIDADDALLANDANYENDFORKEYLOGNOTSETTMPUSR
The full list is in SAP Note 1979280. Changing a SID later means a system rename, so it pays to choose well.
Clients worth knowing
000- SAP’s reference client. Never work in it, and never delete it.
001- A copy of 000. If nobody uses it, it can be removed the same way as 066.
066- The old EarlyWatch client, no longer needed. SAP Note 1749142 explains how to remove it.
Change management
Transports: the rules nobody explains
Every configuration change and every line of custom code travels from development to production in a transport request. These are the parts consultants usually learn the hard way.
- DEV
Change, save to a request, release. Customizing client, often a separate unit test client.
- /usr/sap/trans
Release writes two files: the cofile K900123.DEV and the data file R900123.DEV.
- QAS
Imported through STMS, tested by the business with production-like data.
- PRD
Imported in the same order, usually in an agreed window. Locked against direct changes.
DEVK900123 reads: source system DEV, K for a request, then a running number. The files take the number and the system ID the other way round.Cross-clientSome changes hit every client at once
Most customizing belongs to one client. Programs, tables and some settings are cross-client: change them in your customizing client and the unit test client sees it immediately, before any transport. SCC4 says whether a client may change them.
SCC1Copy settings between clients without a transport
In development, SCC1 copies the content of a request from the customizing client to the test client of the same system. You test before releasing anything, and the request stays open for corrections.
Transport of copiesTest in QA without releasing your request
A transport of copies, created in SE01, carries the current state of objects to the quality system and does not import into production. The original request stays open, so you can go on changing and copy again.
SequenceOrder matters more than people think
Requests are imported in the order they were released. Import an older request after a newer one for the same table entry and the older version wins. Mark dependencies and send related requests together.
Current settingsSome customizing is meant to be done in production
A few activities, such as opening posting periods or entering exchange rates, are current settings: they can be maintained directly in a production client without a request, even when the client is locked against changes.
SE06 and SCC4Why production says “not modifiable”
Two locks protect production: the system change option in SE06 for the whole system, and the client settings in SCC4 for each client. Basis opens them only briefly and only for a documented reason, and the opening is logged.
System copy
After a system refresh: why QA acts strange
A refresh copies production over the quality system so tests run on real data. The copy brings everything with it: production’s logical system names, RFC destinations, printers, e-mail settings and scheduled jobs.
Until Basis finishes the post-copy steps, a quality system can send payment files, e-mails or IDocs to real partners. That is why QA is often closed for a day or two after a refresh, and why some interfaces stay off afterwards.
Your progress
of 10 done
Tick the steps as you go, or use the list to ask Basis what is still open.
Basis today
Basis in the SAP S/4HANA and RISE era
The job has not gone away; it has moved. Less hardware and operating system, more database, cloud connections, security and automation.
Database
The database moved to the centre
SAP S/4HANA runs only on SAP HANA, so database work is now everyday Basis work: memory sizing, savepoints and log backups, tenant databases, revisions. SAP HANA studio is deprecated; administration happens in the SAP HANA cockpit and its database explorer.
SAP HANA cockpitDBACOCKPITUpgrades
Planned online, run by SUM
Maintenance Planner, which SAP requires in every scenario, works out the target stack and the files. Software Update Manager runs upgrades and conversions to SAP S/4HANA; its Database Migration Option moves the database in the same run. SPAM and SAINT still import support packages and add-ons.
Maintenance PlannerSUMSPAMRelease rhythm
A new SAP S/4HANA release every two years
Since release 2023, SAP ships a new on-premise and private cloud release every two years, each with seven years of mainstream maintenance and feature packs in between. Release 2025 is sold as SAP Cloud ERP Private.
Feature packsSAP for MeMonitoring
From Solution Manager to SAP Cloud ALM
SAP Solution Manager 7.2 leaves mainstream maintenance at the end of 2027. SAP Cloud ALM, included with SAP Enterprise Support, takes over operations and implementation, and in June 2026 SAP asked customers to finish the move before then.
SAP Cloud ALMSecurity
Patch Day, every second Tuesday
SAP publishes its security notes on the second Tuesday of every month. Basis reviews them, plans the patches and keeps the security audit log configured, since release 7.50 in RSAU_CONFIG instead of SM19.
Security notesRSAU_CONFIGCloud connections
SAP BTP reaches in through the Cloud Connector
Apps on SAP BTP reach on-premise systems through the Cloud Connector, a reverse invoke proxy installed in your own network. Because it connects outwards, no inbound firewall port has to be opened.
Cloud ConnectorSM59
RISE with SAP: who does the Basis work?
In SAP S/4HANA Cloud Private Edition, SAP Enterprise Cloud Services runs the technical layers. A summary of SAP’s roles and responsibilities document of July 2025: customers get no privileged access to the operating system, and restores they request are limited to twelve per system per contract year. Your contract has the final word.
| Task | SAP (ECS) | Your team |
|---|---|---|
| Data centre, hardware and network | Runs it | — |
| Operating system and database operations | Runs it | No OS access |
| Backups, and restores on request | Runs it | Requests |
| Technical monitoring | Runs it | — |
| Support packages, kernel and upgrades | Executes | Plans and tests |
| Transport system set-up | Runs it | — |
| Importing transports | — | Runs it |
| Business users, roles and authorizations | — | Runs it |
| Application jobs, interfaces and their monitoring | — | Runs it |
| Disaster recovery | If contracted | Decides |
Maintenance
Dates to plan for
Maintenance dates drive most Basis projects. These are the ones that matter for SAP ERP and SAP S/4HANA customers, as published by SAP in October 2026.
- 202731 DecemberSAP ERP 6.0: end of mainstream maintenanceMainstream maintenance for SAP ERP 6.0 and SAP Business Suite 7 ends. Customer-specific maintenance starts on 1 January 2028.
- 202731 DecemberSAP Solution Manager 7.2: end of mainstream maintenanceSelected functions, such as ChaRM and Test Suite, get optional extended maintenance until 2030; SAP Cloud ALM is the successor.
- 2027End of yearSAP NetWeaver 7.5 and Process OrchestrationMainstream maintenance ends, extended to the end of 2030. SAP Integration Suite is the target for interfaces running on SAP PO.
- 2028AprilSAP HANA 2.0 SPS07 leaves maintenanceFrom SPS08, SAP plans a new SPS every two years, each maintained for four years.
- 203031 DecemberEnd of optional extended maintenanceExtended maintenance for SAP ERP 6.0 ends, as do the extended functions of SAP Solution Manager 7.2.
- 2033+RISE with SAPSAP ERP, private edition, transition optionFor SAP ERP moved to RISE with SAP, maintenance from 2031 to the end of 2033. On 13 October 2026 SAP added that subscriptions may run until 31 December 2035, with further prerequisites (SAP Note 3591251).
Quiz
Myth or fact?
Nine statements heard in project rooms. Basis people answer them without thinking; most others guess.
Frequently asked questions
What does an SAP Basis consultant do?
Installs, upgrades and patches SAP systems; manages users, roles and security settings, often with a separate security team; imports transports; schedules and monitors jobs; tunes performance; plans backups and disaster recovery; and connects SAP to other systems and to SAP BTP. On projects, Basis sizes and builds the landscape and runs system copies and conversions to SAP S/4HANA.
Is SAP Basis still needed with RISE with SAP?
Yes, in a different shape. SAP takes over infrastructure, operating system, database operations, backups and technical patching, but customers still own users and roles, transports and releases, business jobs, interfaces, Fiori content, security decisions and the coordination with SAP. Many teams call this role a technical or platform architect.
How do I find out why I am not authorized?
Run SU53 right after the error message, in the same session. It shows the authorization object, the fields and the values that were checked and failed. Send a screenshot to your security team: it tells them exactly which role is missing what, instead of “I can’t do my job”. Current releases keep a short history of failed checks, and the security team can open it for your user with Other User.
What is a client in SAP?
A self-contained area within one SAP system, with its own master data, transactions, users and most customizing, identified by a three-digit number. Programs and some settings are cross-client: change them in one client and every client of that system sees the change.
What is the difference between a transport request and a task?
A request is the container that moves between systems; each person working on it gets a task inside it. Tasks are released first, then the request. Only a released request is exported to the transport directory and can be imported into quality and production.
How can I learn SAP Basis?
SAP Learning has free learning journeys on system administration and on SAP HANA, and SAP offers trial systems to practise on. Pair that with the SAP Help Portal for SAP NetWeaver and ABAP Platform administration, and with SAP Notes under the BC components.
Related pages
References
Checked in October 2026. Knowledge base articles need an SAP for Me login.
- Ports of the ABAP application serverSAP Help Portal
- Knowledge base article 2360614Instance name of the primary application server · SAP for Me
- Changed profile parameter defaults in ABAP Platform 2020SAP Help Portal
- Knowledge base article 2129291Runtime limits of work processes · SAP for Me
- Knowledge base article 2558404Table buffer synchronization · SAP for Me
- Resetting buffersSAP Help Portal
- Statistics records and filesSAP Help Portal
- ABAP dump analysis (ST22)SAP Help Portal
- Update requests (SM13)SAP Help Portal
- Troubleshooting authorization checksSAP Learning
- Converting spool requests to PDFSAP Help Portal
- SAP Fiori cache maintenanceSAP Community, 2024
- Transport of copiesSAP Help Portal
- Client control and current settingsSAP Help Portal
- System change option and client change optionsSAP Learning
- Converting logical system names (BDLS)SAP Help Portal
- Suspending jobs after a system copy (BTCTRNS1)SAP Help Portal
- How to remove unused clients, including 001 and 066SAP Community, 2013
- Release strategy and maintenance datesSAP Support Portal
- SAP ERP, private edition, transition option: updatesSAP News, August 2025
- SAP Cloud ALM and Solution Manager FAQSAP Support Portal
- New SAP S/4HANA release and maintenance strategySAP News, September 2022
- SAP NetWeaver maintenance strategySAP Community
- RISE with SAP: roles and responsibilities, July 2025SAP agreements
- Security notes and Patch DaySAP Support Portal
- SAP HANA administration toolsSAP Learning
- Configuring log backups in SAP HANASAP Learning
- SAP Solution Manager and Maintenance PlannerSAP Learning
- Secure connectivity in SAP BTP: Cloud ConnectorSAP Learning
- Goodbye SAP ONE Support Launchpad, welcome SAP for MeSAP Community, 2023