Phase 2: Diagnostic Investigation (Joule Administrator)
Based on the symptom category identified in Phase 1, follow the appropriate diagnostic path below.
Step 4a: Apply fixes if you would like self-resolvable.
- Follow the corresponding Path (A-F) below in sequence, please check the details steps for each path;
- Each step builds on the previous — do not skip steps
Step 5: Verify Fixes
- If resolved, verify with a transactional prompt (e.g. “Display Sales Order 911”);
- Run health checks;
- If not resolved after all steps, open SAP Support ticket with Correlation ID and traces together with step 4b to collect diagnostics
Step 4b: Collect Diagnostics with below necessary information
- Correlation ID from traces
- SAP Cloud Connector logs
- SAP BTP Destination test
- IPS job status
Step 6: Open SAP Support ticket with below necessary information
- Use correct component
- Attach traces & correlation ID
- Include system version & steps
Diagnostic Paths
Path A: SAP BTP Provisioning Issues
This path resolves: missing Joule entitlements; missing systems in the visible landscape; and subaccount creation issues.
|
Step |
Action |
What to Check |
|
A1 |
Verify Joule entitlements |
SAP BTP Global Account > Entitlements > Service Assignments > Search “Joule” |
|
A2 |
Verify system registration |
SAP BTP Global Account > System Landscape > Systems |
|
A3 |
Check data center compatibility |
Data Centers Supported by Joule |
|
A4 |
Validate subaccount configuration |
Ensure Cloud Foundry (CF) enabled, correct region selected |
Key SAP Notes:
Path B: Joule Booster / Activation Issues
This path resolves: booster execution failures; missing formation prerequisites; and subscription errors.
|
Step |
Action |
What to Check |
|
B1 |
Verify IAS tenant visibility |
SAP BTP Global Account > System Landscape > Systems (IAS should be listed) |
|
B2 |
Check IAS-Global Account linkage |
Ensure IAS tenant matches SAP BTP Global Account's customer ID |
|
B3 |
Verify SAP Build Work Zone subscription |
Must be a subscription (not just an instance) in the Joule subaccount |
|
B4 |
Trigger system sync |
Click “Refresh” button in System Landscape if systems are missing |
|
B5 |
Check formation type |
Ensure correct capabilities selected in booster Step 4 |
Common errors and fixes:
Path C: SAP Cloud Identity Services (IAS/IPS) Issues
This path resolves: single sign-on (SSO) issues; blank/empty login screens; mismatched user identities; and IPS synchronization failures.
|
Step |
Action |
What to Check |
|
C1 |
Verify IAS trust domain |
SAP BTP Joule Subaccount > Trust Configuration > Domain field must match SAP product domain |
|
C2 |
Check IAS is used as proxy |
SAP S/4HANA Fiori Launchpad must authenticate via IAS (not directly to corporate IDP) |
|
C3 |
Validate Global User ID |
Transaction SU01 > User > Goto > External User ID must match IAS Identity Directory Global User ID |
|
C4 |
Check domain consistency |
All systems must use same top-level domain (*.cloud.sap or *.ondemand.com) |
|
C5 |
Verify IPS jobs |
SAP Cloud Identity Services > Identity Provisioning > check job status and errors |
|
C6 |
Validate transformations |
Ensure IPS source/target transformations use latest version from SAP Help |
Key indicators:
Path D:Content Exposure & Role Issues
This path resolves: wrong Joule response type (informational/direct instead of transactional/navigational); and missing Joule capabilities.
This is the most common category of issues encountered in production. Follow these steps sequentially:
|
Step |
Action |
What to Check |
|
D1 |
Verify capability availability |
Joule in SAP S/4HANA Cloud Private Edition capabilities |
|
D2 |
Check system version support |
SAP 3523238 – Navigational and Transactional capabilities with Joule in SAP S/4HANA Cloud Private Ed… attachment, column F (minimum S/4HANA version per capability) |
|
D3 |
Identify required Semantic Objects & Actions |
SAP Note 3523238 attachment spreadsheet |
|
D4 |
Verify business role contains required catalogs |
Transaction PFCG > Role > Menu tab > Check business catalogs contain required Fiori App IDs |
|
D5 |
Check content exposure |
Transaction /UI2/CDM3_EXP_SCOPE > Verify role is exposed (V1 or V2) |
|
D6 |
Verify CDM content readable |
Test CDM URL directly: /sap/bc/http/ui2/flp_content_exposure/entities (V2) or /sap/bc/ui2/cdm3/entities (V1) |
|
D7 |
Refresh Channel Manager |
SAP Build Work Zone Admin > Channel Manager > Update/Refresh |
|
D8 |
Verify apps in Content Manager |
SAP Build Work Zone Admin > Content Manager > Find role > Check Semantic Objects & Actions |
|
D9 |
Check user role assignment in SAP Build Work Zone |
SAP Build Work Zone Admin > Settings > Identity Provisioning tab > Search user > Verify roles listed |
|
D10 |
Verify OData services activated |
Check APIs listed in SAP Note 3523238 are active (transaction SICF or /IWFND/MAINT_SERVICE) |
Important notes:
Path E: Connectivity & Principal Propagation Issues
This path resolves: “I'm having trouble connecting” errors; “backend not reachable” errors; and timeout errors.
|
Step |
Action |
What to Check |
|
E1 |
Test Principal Propagation |
Copy S4HANA_PCE_SSO destination as “authtest”, add HTML5.DynamicDestination=true, test CDM URL through SAP Build Work Zone |
|
E2 |
Check SAP Cloud Connector |
Verify system mapping, certificate validity, principal type = “X.509 certificate” |
|
E3 |
Enable SAP Cloud Connector logs |
Turn on tunnel trace and TLS trace for detailed error information |
|
E4 |
Check SAP BTP destinations |
Verify S4HANA_PCE_SSO destination configuration and connection test |
|
E5 |
Verify trusted domains |
Add SAP Fiori Launchpad URL to IAS Trusted Domains AND SAP BTP Security > Settings |
|
E6 |
Trace in backend |
Transaction /n/IWFND/TRACES for HTTP payload trace; SMICM for HTTP trace level 1 |
|
E7 |
Check CERTRULE |
Transaction CERTRULE for rule-based certificate mappings |
Troubleshooting resources:
Path F: UX / Icon Appearance Issues
This path resolves: Joule icon not visible; Joule icon displayed incorrectly; and Joule icon is visible but does not launch the Joule dialog.
|
Step |
Action |
What to Check |
|
F1 |
Check 3rd party cookies |
Ensure browser allows 3rd party cookies for the Joule/IAS domains |
|
F2 |
Verify SAPUI5 version |
Must be equal to or higher than minimum supported version. |
|
F3 |
Check user role for Joule plug-in |
Ensure user has a single role containing the SAP Fiori business catalogue for Joule |
|
F4 |
Clear caches |
Browser cache + server cache via program /UI2/INVALIDATE_GLOBAL_CACHES |
|
F5 |
Check SAP Fiori customizing conflicts |
Transaction /UI2/FLC – check “Configuration” first, then “Customizing” |
|
F6 |
Verify trusted domains |
Add URLs to IAS Tenant Settings > Trusted Domains AND SAP BTP subaccount > Security > Settings |
Continued with part4 on the issue summary and key takeways.



