SAP Business One Security: Keep Current and Strengthen Access

Keep SAP Business One Current and Strengthen Access Security

Your business relies on SAP Business One to process orders, manage stock and maintain financial records. Keeping it current helps protect those operations and gives you access to stronger security controls.

Whether your system runs on premises, in a data centre or in a hosted cloud environment, security maintenance must cover the application, database, operating systems and integrations. A system can continue working normally while still containing a known vulnerability.

SAP Business One’s Identity and Authentication Management (IAM) also provides a practical reason to review older installations: corporate sign-in, single sign-on and two-factor authentication are available through supported configurations. [11] [13]

Bring Cloud Factory and your IT team together to confirm what is installed, which controls are active and what needs updating. The outcome should be a clear plan covering security priorities, compatibility, responsibilities and planned downtime.

Stronger Sign In Security with SAP Business One IAM

IAM allows SAP Business One to use identities managed through providers such as Microsoft Entra ID. With the appropriate setup, users can sign in with their existing corporate identity and benefit from the provider’s authentication controls. [11]

If your business requires MFA for Microsoft 365, it is worth checking whether access to your ERP receives comparable protection. Review the actual sign-in arrangements, including remote access, before deciding what needs to change.

• Corporate sign-in and single sign-on: reduce reliance on separate credentials and make access easier to manage across supported applications.
• Two-factor authentication: require an additional factor so a stolen password alone is insufficient to complete the configured sign-in process. SAP also provides 2FA for eligible users of its own authentication service.
• Central user management: manage bound users across SAP company databases more consistently, including activation and deactivation.

The options depend on the identity provider, SAP release and deployment. Passwords may still form part of the sign-in process; the security gain comes from the additional controls and how they are enforced. [11] [13]

An Established Capability That Continues to Improve

• FP 2208 introduced IAM for SAP Business One and SAP Business One, version for SAP HANA. [14]
• FP 2305 expanded the options, including native authentication-service 2FA and additional identity providers. [15]
• FP 2602 improved everyday administration, including company selection, superuser visibility and assignment, and user binding and unbinding. These enhancements make IAM easier to manage; IAM itself was introduced earlier. [12]

Deployments managed through SAP Business One Cloud Control Center have corresponding cloud-version requirements. Confirm those with your hosting provider when planning the work. [16]

Configure the Controls as Part of the Upgrade

An upgrade makes capabilities available; the security benefit depends on configuration. Identity providers must be set up and activated, users mapped to their SAP company accounts, and the intended authentication policy enforced and tested. SAP recommends testing the setup with a small number of users before wider rollout. [17]

Single sign-on is not the same as MFA. SAP permissions, administrator and recovery access, add-ons and unattended integrations also need review. Your IT team and Cloud Factory should check compatibility and validate these access paths together. [13] [17]

For an older installation, this is a concrete reason to plan an upgrade. If your release already supports IAM, first establish whether its controls are enabled and whether the required security corrections have been applied.

Security Covers the Complete Environment

A review should cover the full SAP Business One landscape, including the devices people use to access it and the connections that exchange data with other applications.

Antivirus and Security Patches Have Different Jobs

Antivirus and endpoint detection and response help detect and contain malicious activity. Security patches repair weaknesses in software. Both need ongoing attention.

Updating malware definitions does not install SAP application fixes. Windows updates do not automatically update B1if or Service Layer. A current security agent also does not establish that the operating system or database underneath it remains supported.

Australian Signals Directorate guidance treats application patching and operating system patching as core security measures. These controls work alongside access restrictions, monitoring and recovery arrangements. [1] [9]

Hosting Does Not Remove the Need for Application Maintenance

A hosting agreement may cover infrastructure without covering SAP upgrades, add-ons or integration code. Your IT team, hosting provider and Cloud Factory should agree who maintains each layer, who approves changes and who responds to security alerts. Include identity management and integration services in that agreement.

The useful question is: who is responsible for each component, and how do we confirm that the required updates have been applied?

Why SAP Application Updates Matter

SAP publishes security corrections for Business One components alongside functional improvements. Its public security bulletins include the following examples, showing why the application and its supporting services belong in the patching programme. [3] [4]

These are examples of published issues, not a finding that a particular customer is vulnerable. Check applicability, affected builds, corrective versions and required configuration changes against the current SAP Security Note. Detailed notes may require an SAP support login.

Support Must Cover the Complete Platform

A supported deployment uses compatible software versions that remain within the relevant vendors’ support arrangements, together with applicable security fixes. Check SAP’s Platform Support Matrix alongside its current availability information, administration guides and the compatibility requirements of your add-on suppliers. [2] [10]

SAP’s matrix dated 28 August 2026 identifies SAP Business One 10.0 as in maintenance and versions 9.0 through 9.3 as out of maintenance. However, the description “version 10” alone does not establish whether an installation contains the required security corrections. The exact feature package, support package, patch or hotfix level matters. [2] [3]

A maintenance entitlement makes updates available. It does not demonstrate that those updates have been installed.

Security Updates Still Matter When You Do Not Need New Features

Your business may have no immediate need for new functionality and still require an update for security or platform compatibility. An upgrade review is also an opportunity to enable stronger identity controls and select useful workflow improvements for your team. Agree a tested release baseline and maintenance window, with a faster route for urgent corrections.

Where an add-on prevents an essential update, agree a resolution with its supplier and time-limited protective measures while the dependency is addressed. Keep the update on an agreed completion plan. [1]

The Security Case for Reviewing B1if Integrations

Integrations extend the value of SAP Business One across eCommerce, warehousing, reporting and other business applications. They also introduce services, accounts and software dependencies that need ongoing maintenance.

B1if and Service Layer serve different roles. B1if is an integration framework; Service Layer provides APIs for accessing SAP Business One data and services. B1if can itself use Service Layer, so using the API does not necessarily mean that B1if has been removed. [5] [6]

At Cloud Factory, we recommend assessing whether Service Layer can support a simpler, more controlled integration design. The benefits below are opportunities to evaluate against the existing solution; they are not a blanket SAP claim that one component is always more secure.

Encrypted connections, restricted permissions and good credential management are not exclusive to Service Layer. The strongest migration case is a demonstrable reduction in exposed services, excessive access or maintenance complexity in your actual environment.

Migration Needs a Functional and Security Assessment

Service Layer is not a drop-in replacement for every B1if scenario. Check API coverage, event handling, scheduling, transformations, retries, monitoring and dependent SAP or third-party solutions. Any replacement middleware or custom integration also needs an owner and ongoing maintenance.

Service Layer still needs security updates. SAP’s March 2025 authentication correction is direct evidence of this. Restrict access to its endpoints, avoid shared superuser accounts and validate authentication and authorisation for each connection. Enabling MFA for human users does not automatically protect unattended integrations. [3] [7]

Once a replacement is proven, retire unused endpoints, accounts, credentials and services. Where B1if remains necessary, keep it supported, patched, restricted and monitored. A migration project should not delay an urgent correction to the existing environment.

A Practical Maintenance Standard for Customers

Cloud Factory recommends making the following responsibilities explicit within every SAP Business One support and hosting arrangement. The implementation should reflect your environment, exposure and business needs.

1. Maintain a Complete Version and Ownership Record

Record the exact SAP build, database and operating system versions, installed services, add-ons and integration runtimes. Include workstations, remote desktop hosts and test systems. Name the party responsible for updates, alert review and escalation for each component.

2. Review Advisories and Act According to Risk

Review SAP Security Notes and relevant vendor advisories regularly, with alerts for urgent issues between scheduled reviews. Prioritise by severity, exposure and evidence of exploitation. ASD’s Essential Eight includes accelerated treatment of critical or exploited vulnerabilities in online services; an annual upgrade alone is not an adequate response process. [1] [9]

3. Use Supported Update and Testing Procedures

Confirm compatibility with SAP, the database vendor and add-on suppliers. Use SAP-supported procedures for bundled components such as Java, Tomcat and web servers; check supportability before independently replacing dependencies. Test key transactions, reports, integrations and authentication, with a backup and rollback plan.

4. Secure Access as Well as Software Versions

Apply least privilege, remove unused accounts and protect administrative and remote access with MFA where supported. Keep database and administration interfaces private. Use valid, trusted certificates and monitor expiry. Restrict integration endpoints to their intended callers and protect stored credentials and tokens. Include IAM and the intended MFA policy in the review, and verify the configured controls after an upgrade.

5. Keep Protection Active and Prove Recovery

Maintain supported antivirus or endpoint protection, including agent and engine updates as well as malware intelligence. Monitor alerts and review exclusions. Protect backups of databases and the configuration, integration logic and recovery material needed to rebuild the environment. Test restoration against agreed business recovery requirements.

6. Document Exceptions and Their End Dates

When a required update must be deferred, record the reason, risk owner, temporary controls and target completion date. Review those controls regularly and keep the work needed to restore a supported environment on the agreed schedule.

Plan Updates with Cloud Factory and Your IT Team

Security maintenance works best when the people responsible for SAP, infrastructure and identity management plan it together. Include your internal IT team or managed service provider, your hosting provider and Cloud Factory in the same review.

The review should give you a practical basis for deciding what to do next:

• Current position: installed versions, vendor support status and applicable security corrections.
• Access and integrations: IAM and MFA configuration, account permissions, and B1if, Service Layer and add-on dependencies.
• Recommended work: prioritised updates and configuration changes, with the scope, estimated cost and planned downtime agreed before implementation.
• Delivery and ownership: compatibility checks, business testing, backup and rollback arrangements, and a named owner for ongoing maintenance.

The appropriate next step may be an application or platform upgrade, a targeted security correction, or enabling controls your current release already supports. Agree the work against the actual environment and business requirements.

Sources and Further Reading

This article draws on SAP and Australian Signals Directorate guidance. Support status and remediation details can change, so check the current vendor material when planning work. The examples are not an assessment of an individual installation or a claim of Essential Eight maturity.

1. Australian Signals Directorate — Patching applications and operating systems
2. SAP — SAP Business One Platform Support Matrix
   Version 1.39, dated 28 August 2026. Read alongside current availability information and administration guides.
3. SAP — Security Patch Day Bulletins 2025
   March: Note 3561045. June: Note 3594258. August: Note 3625403.
4. SAP — Security Patch Day February 2026
   Note 3679346 on Business One client memory dump files.
5. SAP — Working with SAP Business One Service Layer
6. SAP — Integration Framework Company SLD Configuration
   Used for the architectural distinction between connection types, not as a current support matrix.
7. SAP — Identity and Authentication Management Walkthrough for Daemon Service
   Technical-user token flow; check availability for the target version and configuration.
8. SAP — Administrator Guide Service Layer communication security
9. Australian Signals Directorate — Essential Eight maturity model
10. SAP — SAP Business One version for SAP HANA Platform Support Matrix
    Use the corresponding platform matrix for SAP HANA deployments.
11. SAP — Identity and Authentication Management introduction
    Corporate identity providers, single sign-on and central user management.
12. SAP — Latest Identity and Authentication Management features in SAP Business One 10.0 FP 2602
    Published 20 April 2026. Company selection, role visibility and user-binding improvements.
13. SAP — Two-Factor Authentication for SAP Business One Authentication Server Users
    Native 2FA applies to eligible authentication-server users; the documented B1SiteUser exception requires separate consideration.
14. SAP — Installing Version 10.0 FP 2208 or Later
    Confirms the introduction of IAM in FP 2208.
15. SAP — IAM Change Log 10.0 FP 2305
    2FA and additional identity-provider capabilities.
16. SAP — Identity and Authentication Management in SAP Business One Cloud
    Check the corresponding Cloud Control Center and SAP Business One versions.
17. SAP — Configuring Identity and Authentication Management in the SLD
    Provider setup, users, binding, activation and initial testing.