I’m providing a complete solution addressing Excel Add-In version compatibility, SAML metadata synchronization, and SSO configuration alignment:
1. Excel Add-In Version Verification and Update:
Your current version (2.8.1) has known limitations with SHA-256 SAML signatures. Upgrade to version 2.9.2 or later:
- Download the latest Excel Add-In from SAP Support Portal (search for “SAP IBP Excel Add-In 2.9.2”)
- Deploy using group policy or SCCM to all demand planning users
- Minimum required version for si-2308 with SHA-256: 2.9.0
- Recommended version for best compatibility: 2.9.2 (released March 2024)
Verify installation by checking: Excel > IBP Add-In > About > Version should show 2.9.2.x
2. SAML Metadata Synchronization:
The metadata exchange between Azure AD and IBP needs refresh after Azure AD changes:
Step A - Export updated metadata from Azure AD:
- Navigate to Azure AD > Enterprise Applications > SAP IBP Application
- Go to Single Sign-On > SAML Signing Certificate
- Download “Federation Metadata XML” (this contains the new SHA-256 certificate)
Step B - Update IBP tenant configuration:
- Log into SAP IBP Admin Console (https://[tenant].sapibp.cloud/admin)
- Navigate to Security > Identity Provider Configuration
- Upload the new Federation Metadata XML from Azure AD
- Click “Validate Metadata” to ensure proper parsing
- Save and activate the configuration
Step C - Verify certificate chain:
- In IBP Admin Console, check that the certificate thumbprint matches Azure AD
- Confirm validity dates (should be valid for 1-3 years from Azure AD update date)
- Ensure intermediate certificates are included in the metadata
3. SSO Compatibility Configuration:
Align Azure AD SAML assertions with Excel Add-In requirements:
NameID Format Fix:
In Azure AD > Enterprise Applications > SAP IBP > Single Sign-On:
- User Attributes & Claims section
- Edit “Unique User Identifier (Name ID)”
- Source attribute: user.mail
- Name identifier format: Email address (critical for Excel Add-In)
- Save changes
Required Claims Configuration:
Ensure these claims are present:
- email: user.mail
- givenname: user.givenname
- surname: user.surname
- name: user.userprincipalname
Excel Add-In specifically requires the ‘email’ claim for user identification.
Signature Algorithm Verification:
- Azure AD > Enterprise Applications > SAP IBP > Single Sign-On
- SAML Signing Certificate section
- Signing Option: “Sign SAML response and assertion” (recommended)
- Signing Algorithm: SHA-256 (confirm this is set)
4. Trust Certificate Distribution:
For Windows-based Excel Add-In authentication:
Option A - Group Policy Distribution:
- Export the new Azure AD signing certificate (Base-64 encoded)
- Create GPO to import certificate into: Computer\Trusted Root Certification Authorities
- Apply to all demand planning user machines
- Force GPO update: gpupdate /force
Option B - Manual Import (for testing):
- Download certificate from Azure AD SAML configuration
- On user machine: Run > certmgr.msc
- Import to Trusted Root Certification Authorities > Certificates
- Restart Excel and test Add-In connection
5. Testing and Validation:
Systematic testing approach:
Test 1 - Single User Validation:
- Select one demand planner for pilot testing
- Upgrade Excel Add-In to 2.9.2
- Import certificate manually
- Test connection to IBP demand-planning planning area
- Verify ability to load and save forecast data
Test 2 - SAML Response Inspection:
- Use browser developer tools (F12) during Excel Add-In login
- Capture SAML response in Network tab
- Decode Base64 SAML assertion
- Verify NameID format is email
- Confirm signature algorithm is SHA-256
- Check all required claims are present
Test 3 - Certificate Chain Validation:
- Use OpenSSL to verify certificate chain: openssl verify -CAfile azure_chain.pem user_cert.pem
- Ensure no “unable to get local issuer certificate” errors
Test 4 - Rollout to Team:
- After successful single-user test, deploy to 3-5 users
- Monitor for any authentication errors
- Full team deployment after 48-hour validation period
6. Troubleshooting Steps if Issues Persist:
If SSO still fails after above steps:
a) Enable detailed logging in Excel Add-In:
- Excel > IBP Add-In > Settings > Enable Debug Logging
- Reproduce login failure
- Check logs at: %APPDATA%\SAP\IBP Excel Add-In\Logs
- Look for SAML validation errors with specific claim names
b) Verify Azure AD token lifetime:
- Azure AD might have reduced token lifetime during update
- Check: Azure AD > Enterprise Applications > SAP IBP > Token Configuration
- Ensure “Access token lifetime” is at least 60 minutes
c) Clear Excel Add-In cache:
- Close Excel completely
- Delete: %LOCALAPPDATA%\SAP\IBP Excel Add-In\Cache
- Restart Excel and retry login
d) Network proxy considerations:
- If using corporate proxy, verify proxy.pac file allows direct access to *.sapibp.cloud
- Excel Add-In authentication can fail if proxy intercepts SAML traffic
7. Ongoing Monitoring:
Implement these checks to prevent future issues:
- Set calendar reminder 30 days before Azure AD certificate expiration
- Monitor IBP Admin Console for SAML authentication failure alerts
- Create test user account for monthly Excel Add-In connectivity validation
- Document the complete Azure AD > IBP SAML configuration for future updates
This comprehensive approach addresses all three critical areas: Excel Add-In version compatibility with SHA-256, proper SAML metadata synchronization between Azure AD and IBP, and correct SSO configuration that satisfies Excel Add-In’s specific authentication requirements. The key is ensuring the entire authentication chain (client certificate trust, SAML assertion format, and IBP metadata) is aligned after the Azure AD update.