Feature
Microsoft
Microsoft removes the container images for the containerized (agent-based) SAP data connector in Microsoft Sentinel on 14 October 2026, after retiring the connector itself on 14 September 2026; customers must migrate to the agentless SAP data connector
departs 14 Oct 2026
Quick answers
- Is it true that Microsoft Sentinel removes the containerized SAP data connector images on 14 October 2026 — migrate to the agentless SAP data connector?
- Yes. Microsoft has officially announced it, effective 14 Oct 2026. If you ingest SAP logs into Microsoft Sentinel through the containerized (agent-based) SAP data connector, the plumbing is being pulled out from under it in two steps.
- When does it take effect?
- 14 Oct 2026. Verified against the vendor's own announcement.
- What should I use instead?
- Move to the agentless SAP data connector in Microsoft Sentinel, which is the supported replacement and needs no container host.
What this means for you
If you ingest SAP logs into Microsoft Sentinel through the containerized (agent-based) SAP data connector, the plumbing is being pulled out from under it in two steps. The connector itself retired on 14 September 2026 — it is now unsupported and unmaintained — and on 14 October 2026 Microsoft removes its container images. Once the images are gone you can no longer pull, install, redeploy, scale, replace, or disaster-recover the agent container: an existing running agent that is TLS-compliant may keep sending logs through the (also-retired) HTTP Data Collector API, but you have no supported way to stand a new one up or recover a failed one. In practice that means any Sentinel SAP monitoring still built on the container agent becomes a single point of failure with no rebuild path after 14 October.
Where to go
Move to the agentless SAP data connector in Microsoft Sentinel, which is the supported replacement and needs no container host. Microsoft's guidance is to complete the migration before 14 October 2026, when the container images are removed: review your existing containerized deployment and configuration, stand up the agentless connector, confirm log ingestion, then decommission the container agent. Note a naming detail from Microsoft's own doc — the legacy "SAPCon" prefix came from analytic rules that have been dropped for clarity, so don't treat its disappearance as missing functionality.
- Microsoft Sentinel agentless SAP data connector — the supported, host-free replacement for the containerized agent
Microsoft is finishing the retirement of the containerized (agent-based) SAP data connector in Microsoft Sentinel by removing its container images. Per Microsoft’s official migration guide on Microsoft Learn, the containerized data connector agent for SAP retired on 14 September 2026 and is now unsupported and unmaintained, and on 14 October 2026 the container images will be removed.
Two steps, and the second is the hard one
- 14 September 2026 — connector retired. The containerized agent is unsupported and unmaintained. An existing TLS-compliant agent may keep sending logs through the (also-retired) HTTP Data Collector API, but no fixes are coming.
- 14 October 2026 — container images removed. This “prevents new pulls, installation, redeployment, scaling, replacement, and disaster recovery.” A running agent might limp on, but you lose every supported way to rebuild, scale, or recover one.
The second date is the one that bites: after it, a failed or unprovisioned container agent has no rebuild path.
What to do
Migrate to the agentless SAP data connector, Microsoft’s supported replacement, which does not need a container host. Microsoft’s direction is to finish before the images are removed on 14 October 2026:
- Assess your existing containerized deployment and configuration.
- Deploy the agentless connector.
- Confirm SAP logs are ingesting into Sentinel.
- Decommission the container agent.
One naming note from Microsoft’s own doc so it isn’t mistaken for lost functionality: the legacy “SAPCon” prefix came from analytic rules that were dropped for clarity — its absence is cosmetic, not a missing feature.
Entry changelog
- — last reviewed.
- — Entry created from Microsoft's official migration guide on Microsoft Learn (server-rendered) and cross-checked against the Azure release-communications notice (id 571342): containerized SAP data connector retired 14 September 2026, container images removed 14 October 2026, migrate to the agentless SAP data connector. sunsetDate set to 2026-10-14 (the dated image-removal event this entry counts to). No detect: fingerprint — the primary does not name an exact container image reference, and guessing one would violate the primary-source-only rule; "SAPCon" in the doc is an analytic-rule prefix, not an image name.
Put this countdown in your README
Building on Microsoft? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/microsoft-sentinel-sap-container-connector-removed)Spot an error or a changed date? Tell us and it’s corrected the same night.