.svg)
SAP Note 3255746 has attracted significant attention because it defines how data can be securely extracted and replicated from SAP systems in the future. With the updated Version 11 released on April 21, 2026, and the upcoming security patch in June 2026, SAP is significantly tightening the rules. In this article, you will learn what has changed, which actions are now required, and how companies that previously relied on RFC-based ODP integrations can adjust their processes in line with SAP compliance.
Key Takeaways
- SAP Note 3255746 was last updated on April 21, 2026 (Version 11).
- ODP-RFC is prohibited for SAP-to-non-SAP scenarios, both on-premises and in private cloud environments.
- SAP Note 3439624 provides a self-assessment tool to audit existing ODP-RFC usage in your system landscape.
- From June 2026, a security patch will technically block unauthorized ODP-RFC calls.
- Important clarification: Only ODP via RFC is affected, not RFC as a protocol in general. Table extractions, BAPIs, function modules, and other RFC-based components remain fully usable and SAP-compliant.
- SAP-recommended alternatives: SAP Business Data Cloud (BDC) or ODP OData for data access outside SAP systems.
- Theobald Software alternatives: Table (including CDS View), Table CDC, DeltaQ, and BW Cube are preferred migration paths depending on the use case. ODP OData is also available as an option.
What SAP Note 3255746 (Version 11, April 2026) Actually States (Update)
On April 21, 2026, SAP released Version 11 of Note 3255746. The wording was clarified and the restrictions on ODP-RFC usage were significantly tightened:
- The RFC modules of the ODP Data Replication API (ODP-RFC) are exclusively designed for data transfer between SAP applications.
- Any use of ODP-RFC by customer or third-party applications to access SAP ABAP systems, whether on-premises or in private cloud, is prohibited.
- Issues resulting from non-compliant use of ODP-RFC are the sole responsibility of the customer.
SAP Note 3255746: Why ODP-RFC Is Prohibited for Non-SAP Systems
SAP Note 3255746 is relevant for anyone transferring data from SAP systems to third-party applications or analytics platforms. According to SAP, previously used RFC-based ODP integrations are no longer permitted, requiring companies to adapt their data integration processes.
The goal of the note is to ensure that only SAP-compliant data extraction methods are used. This applies to on-premises systems as well as cloud systems (private edition) and SAP sources such as S/4HANA, BW, and ECC.
SAP’s security team has assessed the interface and classified the risk as medium. To support customers in analyzing existing usage, SAP provides an automated self-assessment tool via Note 3439624. This allows full auditing of ODP-RFC usage across the system landscape and is the recommended first step for affected organizations.
A common misunderstanding: SAP Note 3255746 does not prohibit RFC as a communication protocol. RFC remains fully usable, for example for table/CDS view extractions, DeltaQ, BAPIs, or function modules. Only the use of the ODP Data Replication API via RFC in SAP-to-non-SAP scenarios is restricted. If you are not using ODP-RFC, you are not affected by the note.
ODP-RFC Alternatives 2026: Staying SAP-Compliant in Data Integration
For external data access outside SAP systems, SAP recommends SAP Business Data Cloud (BDC), a zero-copy architecture based on data products, as well as ODP OData.
Since the publication of the note, Theobald Software has further developed its Xtract products to provide the right migration path for every scenario. This enables you to:
- Use Table with CDS View when your extraction is based on ABAP CDS views
- Use Table CDC for efficient, incremental table-based replication without CDS view dependency
- Use BW Cube for BW-based extractions
- Use DeltaQ for datasources and extractors
- Use ODP OData as a SAP-compliant alternative for ODP usage when none of the above fits your scenario
This means your SAP data can continue to be replicated efficiently, reliably, and in compliance with SAP standards.
SAP-Compliant Data Extraction: Recommended ODP-RFC Alternatives
For companies that previously used RFC-based ODP, we recommend:
1. Perform a Self-Assessment (If Xtract Universal Is Not in Use)
Install SAP Note 3439624 and use the included self-assessment tool to analyze the extent of ODP-RFC usage in your system landscape. Without this baseline, migration needs cannot be reliably determined.
2. Identify Non-Compliant Extractions in Xtract Universal
Xtract Universal includes a built-in compliance feature that shows all extractions still using ODP. Open the Compliance function (F6) to get a full overview of non-compliant extractions in your environment and take immediate action without manually reviewing configurations.
3. Choose the Right Migration Path
Not every ODP extraction requires the same successor. The correct component depends on your specific use case:
Need CDS Views? If your extraction is based on ABAP CDS views, use the Table component with CDS View support. It provides native access to CDS views without ODP-RFC, including support for CDS views with parameters and CDS view entities.
No CDS View Requirement? Use Table CDC. This enables efficient incremental replication at table level and is the most performant alternative for most SAP-to-non-SAP scenarios.
Working with Datasources/Extractors? In this case, DeltaQ is the correct option. It is specifically designed for SAP datasource replication and is not affected by the note.
None of the Above Fits? Only if Table, Table CDC, and DeltaQ are not suitable, ODP OData is recommended as a SAP-compliant fallback via the ODP framework.
ODP-RFC Alternatives in Xtract Universal: Supported Components
Only ODP via RFC is affected by SAP Note 3255746. All other components – Table, Table CDC, BW Cube, DeltaQ, OHS, BW Hierarchy, BAPI, and Query – are not affected and can continue to be used without restriction. For customers, this means: if you are not using ODP-RFC, no action is required.
Conclusion
- SAP Note 3255746 (Version 11) has been in effect since April 21, 2026 and affects all organizations using ODP-RFC for SAP-to-non-SAP data integration.
- From June 2026, SAP will technically block non-compliant ODP-RFC calls – action is required now.
- With SAP Note 3439624, the current state of ODP-RFC usage can be analyzed immediately.
- The SAP interfaces from Theobald Software continue to enable reliable, compliant, and flexible SAP data replication.
- Companies should evaluate migrating RFC-based ODP scenarios to OData.
- Alternative components such as Table, Table CDC, DeltaQ, or BW Cube ensure efficiency and flexibility in data integration.
These measures keep SAP data integration efficient, high-performing, and future-proof under current SAP guidelines. More information about all Theobald Xtract products can be found on our website.
