Network Share (SMB)

Forward SAP documents to Windows SMB shares — writes directly to UNC paths. Best for on-prem environments with existing Windows file server infrastructure.

Reachability — the FileRelay connector must reach the SMB server on TCP 445. For Self-hosted and Managed on-prem this is automatic. For FileRelay-hosted, a site-to-site VPN or peering link is required so the dedicated environment can see your file servers.

Setup

1. Identify the share — UNC looks like \\fileserver\sap-archive.
2. Provision a service account with write at both share-level and NTFS-level.
3. Verify reachability from the connector host: net use \\fileserver\sap-archive /user:DOMAIN\username.
4. In FileRelay, add a Network Share (SMB) destination — server, share, credentials, optional subfolder.

REPLACE: Screenshot of the SMB destination form

How it works

SMB 2.x / 3.x with the provided credentials. Navigates to the configured path, creates subdirectories per routing rules, writes the document. Works on workgroup and AD-joined environments.

Path

\\{host}\{share}\{path}\{subfolder}\{doc_id}.{ext}

• path — optional subfolder within the share
• subfolder — auto-generated by routing (date, repository, flat)
• ext — derived from MIME type

Example: \\fileserver\sap-archive\SAP\Invoices\2026-04\4500012345.pdf. Missing directories are created if the user has the perms.

Authentication

Active Directory — domain + service-account username + password. Authenticates as DOMAIN\user. Use a dedicated service account, not a personal one.

Workgroup — set domain to WORKGROUP or leave empty.

Guest access — leave username and password empty. Not recommended for production (no access control or audit).

Permissions

The user needs writes at both layers:

Layer	Required	Purpose
Share	Change	Write files + create folders
NTFS	Write, Create folders / Append data	Files + subdirectories

"Access Denied" → check both. They're enforced independently.

Network requirements

Item	Details
Protocol	SMB 2.x or 3.x
Port	445/TCP (configurable)
Connectivity	Direct from connector host
DNS	Hostname must resolve (or use IP)
Firewall	445 open between connector host and server

Tips

• Service account — non-expiring password (or managed service account) to avoid disruption from password policy.
• SMB signing — supported transparently. No FileRelay-side config needed.
• DFS — use the DFS namespace path as the host + share (e.g. host: contoso.local, share: dfs/sap-documents).
• Antivirus — on-access scanning slows writes; exclude the FileRelay target folder if you see performance issues.
• Long paths — Windows defaults to 260 chars. Keep paths concise, or enable LongPathsEnabled (Server 2016+) for unlimited.
• SMB 3 encryption — supported when both ends speak SMB 3.0+.
• Monitoring — enable NTFS auditing on the target folder; the file server's Event Viewer tracks every FileRelay write.