> For the complete documentation index, see [llms.txt](https://docs.theconfigteam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.theconfigteam.com/prebilt-for-public-cloud/installation-guide/sap-systems-preparation.md).
# SAP systems preparation
Before you can activate PreBilt for Public Cloud you need to prepare your SAP system(s) to allow PreBilt to communicate with it.
From the Admin Portal, for a particular environment, you can follow the communications "Setup Guide" that can be accessed from the SAP System page (in the SAP Communication User section), which provides links to the relevant SAP transactions, or alternatively you can maintain each of the steps, as described here.
{% stepper %}
{% step %}
### Create a communication user
Open **Maintain Communication Users** and create a new user.
Enter the user name and description as shown:
Set a secure password using "**Propose Password"** or enter your own.
{% hint style="info" %}
**Note**
Copy this password — you will need it later to paste into the Admin Portal to make the connection.
{% endhint %}
{% endstep %}
{% step %}
### Create a communication system
Open **Communication Systems** and create a new entry.
Enter the system ID and system name as shown:
Tick the **Inbound Only** checkbox.
In the **Users for Inbound Communication** tab, add the communication user you created in step 1 (`PREBILT_ADMIN`).
Leave all other fields at their defaults and save.
{% endstep %}
{% step %}
### Create a communication arrangement
Open **Communication Arrangements** and create a new arrangement.
Select the scenario "SAP\_COM\_0A48" and enter an arrangement name by suffixing the communication name on the end, as shown below.
Select the already created Communication System from step 2, and this will also copy in the Inbound Communication User into the appropriate fields.
Check that the Authentication Method is set to "User ID and password" and save.
This links the scenario *Communication Management Integration* to your system and user. It's the minimum scope PreBilt's onboarding wizard needs to start. The wizard self-elevates with `SAP_COM_0889` afterwards.
{% endstep %}
{% step %}
### Configure CORS allowlist
The PreBilt mobile and admin apps call your SAP tenant directly from the browser. Add the PreBilt-hosted origins to the Cross-Origin Resource Sharing allowlist so the browser doesn't block them.
Open **Maintain Protection Allowlists** (Fiori app `F3195`), switch to the **Cross-Origin Resource Sharing** tab, and click **+** to add the allowed/trusted host names.
Complete the following and then select "Add".
{% hint style="info" %}
**Note**
The list of trusted host names must be entered as a single string separated by commas.
**For Production**: enter the following domains (as a minimum) as the trusted host names into the Trusted Host Name field:
* prebilt.cloud,prerelease.prebilt.cloud
**For non-production SAP systems:** enter the following complete list in the Trusted Host Name field to support testing and developments:
* prebilt.cloud,prerelease.prebilt.cloud,test.prebilt.cloud,\*.theconfigteam.workers.dev,localhost,127.0.0.1
{% endhint %}
* Enter the trusted host names (as shown above) as a string into **Trusted Host Name** field.
* Enter the following into **HTTP Service Path** field:
* /sap/
* Tick **all** nine boxes of the **Allowed Methods** (GET, POST, HEAD, PUT, PATCH, DELETE, TRACE, OPTIONS, CONNECT).
* Paste the following into the **Allowed Headers** field:
* origin,Authorization,x-requested-with,content-type,content-length,accept,x-csrf-token,allow-failure,if-match,odata-maxversion,odata-version
* Paste the following into the **Exposed Headers** field:
* x-csrf-token,etag,odata-version,sap-authenticated,sap-server,strict-transport-security,x-content-type-options,x-xss-protection
* Tick **Allow Credentials** and **Allow Private Network Access**.
* Leave **Maximum Age** blank.
{% endstep %}
{% step %}
### Save the communications password in the portal
In the Admin Portal, go to the SAP Communication User and save the password created in step 1.
Once the password is saved, you can then test the connection with the "**Test Connection**" button that will appear.
{% endstep %}
{% step %}
### Run the SAP automated onboarding script
Once you have a successful connection you can run the onboarding script which will check and activate all the relevant resources to allow communication between PreBilt and SAP.
Click "**Run automated setup"** to let PreBilt create everything you require for communication.
{% endstep %}
{% endstepper %}
