# SAP S/4HANA Create Account Failure – Password Cannot Start with “?” or “!”

**URL:** <https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321>\
**Category:** IIQ Discussion and Questions\
**Tags:** provisioning, password-management, identityiq\
**Created:** [June 2, 2026, 10:32am UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321 "2026-06-02T10:32:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nbidwai1987](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@nbidwai1987](https://developer.sailpoint.com/discuss/u/nbidwai1987)\
**Post date:** [June 2, 2026, 10:32am UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321/1 "2026-06-02T10:32:21Z")

</div>

Hello team!

We are facing an issue during SAP S/4HANA account creation via SailPoint IdentityIQ provisioning. we have configured the password policy at application level.

The create account operation is failing with the following error from SAP BAPI:

> _“New password cannot begin with ‘?’ or ‘!’”_

### Observation:

- The issue occurs when the generated password includes a special character in the **first position**

- SAP S/4HANA does not accept `?` or `!` as the initial character of the password.

Need help on the below

1. Whether there is a recommended configuration in IdentityIQ password policy to prevent specific characters (`?`, `!`) from being used in the first position
2. Or if we need to enforce a custom password generation rule to handle SAP-specific constraints

regards

Nitin

---

<div class="post-metadata">

**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\
**Post date:** [June 2, 2026, 1:12pm UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321/2 "2026-06-02T13:12:05Z")

</div>

I think the easiest solution would be to create a SAP\_PasswordGeneration\_Rule. use something line below which ensures the the first character is never ‘?’ or ‘!’ as SAP BAPI rejects such passwords.

You will have a password attribute in the create **Provisioning Policy** at the **password attribute level** using a `Generation Rule` on that field itself. Use the below rule:

```auto
import java.util.Random;

    String firstCharPool = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
    String remainingCharPool = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@#$%^&*()-_=+[]{}|;:,.<>";

    int passwordLength = 12;
    Random random = new Random();
    StringBuilder password = new StringBuilder();

    // First char — never '?' or '!'
    password.append(firstCharPool.charAt(random.nextInt(firstCharPool.length())));

    // Remaining chars
    for (int i = 1; i < passwordLength; i++) {
        password.append(remainingCharPool.charAt(random.nextInt(remainingCharPool.length())));
    }

    return password.toString();

```

this should fix your issue, as It fires **precisely when the `password` field is being populated** before the BAPI call

---

<div class="post-metadata">

**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\
**Post date:** [June 2, 2026, 2:54pm UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321/3 "2026-06-02T14:54:23Z")

</div>

@nbidwai1987 Where are you generating this password? Is this in a field value rule or in Change Password page or somewhere else?

---

<div class="post-metadata">

**Author:** ![jchinnapareddy](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jchinnapareddy/32/38628_2.png) [@jchinnapareddy](https://developer.sailpoint.com/discuss/u/jchinnapareddy)\
**Post date:** [June 2, 2026, 9:43pm UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321/4 "2026-06-02T21:43:13Z")

</div>

Hi , Please Implement a custom Password Generation Rule and associate it with the SAP application’s password policy.

import sailpoint.object.PasswordPolicy;  
import sailpoint.tools.Util;  
import java.util.Random;

Random random = new Random();

// Get password policy  
PasswordPolicy policy = passwordPolicy;

// Read configured password length  
int length = policy.getPasswordMinLength();

// Allowed character sets  
String upper = “ABCDEFGHIJKLMNOPQRSTUVWXYZ”;  
String lower = “abcdefghijklmnopqrstuvwxyz”;  
String numeric = “0123456789”;  
String special = “@#$%^&\*()-\_=+{}”;

// First character cannot be ? or !  
String firstCharSet = upper + lower + numeric;

// Build password  
StringBuilder pwd = new StringBuilder();

// First character  
pwd.append(firstCharSet.charAt(random.nextInt(firstCharSet.length())));

// Remaining characters  
String allChars = upper + lower + numeric + special;

while (pwd.length() \< length) {  
pwd.append(allChars.charAt(random.nextInt(allChars.length())));  
}

return pwd.toString();

or

**sudo code**

String password = generatePasswordFromPolicy();

while (password.startsWith(“?”) ||  
password.startsWith(“!”)) {

```auto
password = generatePasswordFromPolicy();

```

}

return password;

---

<div class="post-metadata">

**Author:** ![sukarande](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@sukarande](https://developer.sailpoint.com/discuss/u/sukarande)\
**Post date:** [June 3, 2026, 12:09am UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321/5 "2026-06-03T00:09:57Z")

</div>

@nbidwai1987

You can use a custom password generation rule.

After introducing it, add some loggers, as it may fail in other cases. Adjust all the logic within it.

Even if the password policy changes in the future, you can easily adjust your rule.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 2, 2026, 12:10am UTC](https://developer.sailpoint.com/discuss/t/sap-s-4hana-create-account-failure-password-cannot-start-with-or/211321/6 "2026-08-02T00:10:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.