SAP Note 3255746

Any tool that built SAP CDC or extraction capabilities on the ODP RFC API is affected. This includes tools that enterprises have deployed in production, integrated into their data pipelines, and relied on for operational analytics.

On April 25, 2024, a Microsoft moderator on Microsoft Learn responded to customer concerns about the impact of Note 3255746 on Azure Data Factory's SAP CDC connector.

In the same response, Microsoft promised a public statement "in the following weeks." Multiple enterprise customers followed up over the next six months — named individuals from named companies, requesting the promised statement. As of the most recent follow-up in October 2024, the statement was never delivered. No ETA for an OData-based replacement was ever provided. The SAP Tables connector impact was asked about twice and never answered.

As of the last visible activity on the thread, no public statement had been delivered and no ETA for a replacement had been provided. We haven't found a response from Microsoft since.

SAP's recommended path forward is SAP Datasphere Replication Flow — SAP's own paid data replication service. The progression is deliberate: restrict the tools customers were using, then position SAP's own service as the mandated alternative.

Datasphere adds licensing cost on top of the SAP license customers already pay. It imposes data egress costs and concurrent replication thread caps that create adoption barriers for high-volume customers. It is positioned for specific deployment models, not the full installed base.

For the ECC majority — approximately 300,000 of SAP's 425,000 customers who haven't migrated to S/4HANA — the path forward is unclear. BDC partnerships with Snowflake, Databricks, Google, and Microsoft cover specific S/4HANA deployment models. ECC customers are not served by any of these partnerships.

The result: enterprise customers running production-scale SAP data extraction have a shrinking set of options. The tools they were using are being blocked. The recommended alternative is slower and more expensive. The ECC majority has no clear path at all.

Approximately 300,000 of SAP's 425,000 customers are still running ECC. They haven't migrated to S/4HANA. Most won't for years. Their operational data — the financial history, supply chain records, procurement decisions, and manufacturing runs that constitute the actual activity of their business — lives in ECC systems today.

These are the customers who were using the third-party extraction tools that Note 3255746 just blocked. Azure Data Factory, Qlik Replicate, SNP Glue — tools their IT teams selected, budgeted for, deployed in production, and built data pipelines around. Those tools are now non-compliant, and the blocking patch deploying in June 2026 will technically break them.

SAP's recommended alternative is Datasphere Replication Flow. While Datasphere technically lists ECC as a supported source, the practical reality for an ECC customer is:

The practical situation for an ECC customer: the tools they were using are being blocked. The replacement SAP offers costs more, performs differently, and requires adopting a new cloud service. The BDC partnerships don't reach them. And migration to S/4HANA — the path that would open up more options — is years away. These companies need their data now. They have always needed their data. The tools they had found to access it are being taken away.

SAP Note 3439624 provides an automated self-assessment tool that identifies all ODP RFC usage across a system landscape. Organizations can run it themselves — and SAP reserves the right to run it for them.

The June 2026 security patch validates incoming ODP RFC calls against allowed subscriber types and blocks unauthorized calls. This is not a contractual restriction. It is a technical enforcement mechanism that will cause non-compliant integrations to fail.

Organizations that have been told by their ETL vendors that their SAP extraction is compliant should verify that claim against the specific scope of Note 3255746. The audit tool exists. The blocking patch is deploying. The enforcement is no longer theoretical.

The restriction is specific. ODP Data Replication API via RFC is what's prohibited. RFC as a general protocol remains fully supported. Table extractions via standard ABAP, BAPIs, function modules, and other RFC-based components are unaffected.

SAP drew this boundary explicitly in Version 11. Their own documentation defines the safe-harbor line: ODP-RFC is restricted. Everything else in the standard ABAP framework is not. SAP's recommended migration paths and their favored partners' sanctioned alternatives all depend on the same primitives that sit inside that safe harbor. Moving the boundary would break their own ecosystem.

Note 3255746 was enforceable because ODP-RFC is a discrete, nameable surface — a specific set of function modules that SAP owns, ships, and can therefore fence. That's why the June 2026 blocking patch is technically possible: there's a defined call to validate against a subscriber type and reject. A program that uses cursor-based SELECT through the standard ABAP database interface and reads CDHDR/CDPOS gives SAP nothing to fence. There is no proprietary entry point to revoke, no API to deprecate, no call to validate. You cannot patch SELECT. It's the language, not an interface.

A common assumption is that SAP extraction tools use RFC_READ_TABLE. SAP themselves flagged RFC_READ_TABLE as not for productive use in SAP Note 382318 — it's dialog-bound, width-limited, and slow. DataXover doesn't use it. It uses native cursor-based reads in background work processes. The same architectural decision that makes it fast is the one that keeps it entirely off any restricted or discouraged API surface.

Companies running SAP own their data. How they access, extract, and use that data has always been their decision. Note 3255746 narrows the tools available to make that decision — not because the tools were technically harmful, but because SAP has chosen to restrict the interfaces those tools depended on.

The market response is already visible. Vendors are deprecating connectors. Customers are re-evaluating pipelines. The audit tool is live. The blocking patch is deploying. The tools that served the market for twenty years are being systematically removed from the landscape.

What remains are two paths: SAP's own paid service with its performance and cost limitations, or native ABAP extraction that operates within SAP's supported framework and doesn't depend on the interfaces being restricted.

The data was always there. The question has always been how to get to it. That question just got more urgent for 425,000 companies.

• SAP Note 3255746, Version 11 (April 21, 2026) — SAP Support Portal (requires SAP credentials): me.sap.com/notes/3255746
• SAP Note 3439624 — Automated self-assessment/audit tool for ODP RFC usage: SAP Support Portal
• Theobald Software — Technical walkthrough of Version 11 and June 2026 blocking patch: theobald-software.com
• Databricks Community — Analysis of unsupported → unpermitted → Datasphere progression: community.databricks.com
• Simplement — Audit risk and technical inoperability analysis: simplement.us
• Microsoft Learn Q&A — Customer thread documenting 10x slower OData admission and unfulfilled public statement promise: learn.microsoft.com
• BryteFlow — Vendor response and migration guidance: bryteflow.com