Skip to Content
Technical Articles
Author's profile photo Avijit Paul

Analysis for office 2.8 – Insecure Connection

Hello everyone!! This is my first blog post on SAP Portal. Here, let me discuss on the most common feedback we are facing post upgrade of Analysis office 2.8 version – The “Insecure Connection” warning message, every time users open Analysis for office report.

Yes, we have got lot of users feedback on what is this insecure connection and why it is not removed. I know, lot of us are still facing similar questions. Let’s discuss on this bit more on how to resolve this in a quick time using multiple possible Approaches. Here is the warning message…

Source: SAP

Cause: In Analysis for Office 2.8, SAP has introduced the additional warning message to the end user to warn if user is agreed to use connection insecurely. If user clicks to continue then only the related connection will be used, otherwise, it will not refresh any data.

Solution Approaches:

There are potential 2 ways this warning message can be dealt with.

Approach 1:

Quick change for individual user

This approach is done using the settings provided in the graphical interface of Analysis for office settings. So individual user need to go to the setting and change the setting based on the requirement.

Below are the steps to follow to implement this quick change:

Step 1. Open AO report, go to File->Analysis

Step 2. Go to Technical configuration and select Settings option

Step 3. Find AllowInsecureConnections. In dropdown there will be 3 options

    1. Prompt: Default settings which prompts for the insecure connection. You can continue or cancel based on your choice
    2. No: It will prohibit insecure connection, user will not be able to continue with the warning msg.
    3. Yes: It allows insecure connection. User will not get any warning.

                     Source: SAP

Step 4. Based on the requirement select options from step 3. It will be yes if the prompt is not required.

Step 5. Proceed and restart AO.

Next time onwards the Insecure Connection prompt will not be appearing.

Approach 2:

Change in AO_App.config file

This approach is very useful when IT team pushes the Analysis for Office packaged file to the users system, because user will not have to do anything in system. This will automatically remove the warning message without doing any changes in user’s system. Also, this can be done by individual also if user has the right to change the config file.

Below are the steps to follow to change the AO_App.Config file

Step 1. Open AO_App.config file residing in ( C://ProgamData/SAP/Cof) using Notepad or any other text editor.

Step 2. Search for AllowInsecureConnections, if it is not modified, by default below text will be there without any value <AllowInsecureConnections />

Step 3. As mentioned in earlier approach there can be 3 values (Yes, No, Prompt), based on the requirement modify the line to <AllowInsecureConnections Value=”Yes” />  which will not prompt the warning.

Step 4. Save the file.

Step 5. Restart Analysis for Office, The warning msg will not pop-up.

For the packaged file, save the packaged file with the changed AO_App.config file and Push it to user’s system.



This “Insecure Connection” provides users the flexibility to choose if they are willing to continue with the “Insecure Connection”. However, if the organization agrees with removing the warning, it would be better to communicate to users on the solution or it should be fixed in the package before the Analysis for Office 2.8 is pushed to the end user.

I am looking forward to read your comments in the comment section below and in case you have questions, you can post them directly in Q&A:



Avijit Paul

BI Reporting and Visualization

Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Michelle Crapo
      Michelle Crapo

      I know my business customers will be very happy to get rid of that warning.   Actually so will I.

      Nice one!

      Author's profile photo Anri Esemann
      Anri Esemann


      what needs to be done to secure the connection?

      Thank you!

      Author's profile photo Juliet Canner
      Juliet Canner


      With regards to the SNC message - we have prevented our users from connecting insecurely and therefore do not let them change the warning message - why would you want users to use an insecure connection?

      The better solution is to setup AFO in technical settings to replace connections with SAPUILandscape  SNC connection details. This works if you have setup SNC connections to your BW Landscape in the SAP Logon.

      I have set this up for both direct BW connections as well as BICs connections through BO



      Author's profile photo Sameer Lonkar
      Sameer Lonkar

      Hi Juliet,

      Thanks for your view that rather suppressing the message, we should make sure that we are connecting securely. Do you mean, it is possible by ticking the option you mentioned?


      Author's profile photo Juliet Canner
      Juliet Canner


      What you want to do is to get AFO to use the SNC connections from the SAPLandscape.xml. You need to ensure you select the following options:

      AllowInsecureConnections = No

      EnablewarningforFailedSNC = ✔

      UseLocalSNCInfoForRemoteConnections =✔

      If using AFO 2.8 or prior then for BW direct connections:

      UseSapUILandscapeComAPI =  ✔

      If using BO BICs connection ensure the systems details on the BICs connection match the SAPLanscape.xml details


      What the above will do is get AFO to match the BW system name in the sapaox file or the BO Bics connection to the BW system in the SAPLanscape.xml and replace the connection details with the snc enabled connection in the SAPLandscape.xml.


      Also ensure that your VPN or firewall rule settings enables traffic on port 4800(secure) and disable port 3300 (insecure)

      Let me know if you need anymore help.



      Author's profile photo Klaus Reiner
      Klaus Reiner

      Hi Juliet,

      I am totally with you that allowing insecure connections is not the correct way.
      Better way is to ensure that AfO accepts the connections as secure, if the are.

      Currently have a customer who accesses AfO-Workbooks via SAP-GUI in the
      BW-System directly, means not via BO-Server or any OLAP-Connection.

      They already do have SNC in use and SSO normally works fine. So I am thinking,
      that the SNC maybe needs to be setup differently for AfO or the SCN quality level
      is maybe not high enough. At least AfO does not accept it in all cases.

      So can you further explain what you mean or what need to be done to achieve
      what you have written here:

      "The better solution is to setup AFO in technical settings to replace connections
      with SAPUILandscape  SNC connection details. This works if you have setup SNC
      connections to your BW Landscape in the SAP Logon."

      Thank you, that would help a lot!

      Kind regards,

      Author's profile photo Juliet Canner
      Juliet Canner


      I have replied above.

      Let me know if you need further info



      Author's profile photo Alexander Stephan
      Alexander Stephan

      Dear all,

      After the update we have for particular colleagues the message "Couldn't establish a secure connection".  This cannot be solved with the proposed solution to enable the item AllowInsecureConnections with selection Yes.

      How can this be solved please =)? Thanks a lot for your suppor.t



      Author's profile photo Michael Molla
      Michael Molla

      Hi Stephan,

      You can remove that prompt by going to the Start menu and Run the Analysis for Office as an Administrator. Then go to the technical configuration and search for the "EnableWarningforFailedSnc" and unselect the checkbox. After that restart your Analysis and you should not see that prompt again! 🙂



      Author's profile photo Mario Panzenboeck
      Mario Panzenboeck


      well this is working fine - but how to provide that setting with the file configuration? My users access AFO in an citrix environment and they don´t have admin rights there.


      Is there also a parameter in the ao_user_config file (or any other file)?



      Author's profile photo Michael Molla
      Michael Molla

      Hi Mario,


      Yes, there is a way to configure this through the ao_app.config file (not ao_user_config which you mentioned).

      You'll have to change the parameter below to False.


      <!--default of 'EnableWarningForFailedSnc': value="True" -->
      <EnableWarningForFailedSnc />


      After (The bold font needs to be added):

      <!--default of 'EnableWarningForFailedSnc': value="True" -->
      <EnableWarningForFailedSnc value="False" />