SAP × Microsoft Copilot Studio — MCP Gateway guides

A step-by-step series on connecting Microsoft Copilot Studio to SAP through the MCP Gateway on SAP Integration Suite — one of two integration architectures explicitly endorsed by SAP in the SAP API Policy.

Each part builds on the previous one. In Parts 1–3 the MCP server stays the same (the public Star Wars API, same exposed tools) and what changes is how identity flows to SAP; Part 4 keeps that identity chain and swaps the backend for your own on-premise SAP system, running each call as the real ABAP user. Part 5 scales the Part 3 IAS pattern from one hand-built connector to all 21 SAP MCP Gateway connectors, created unattended. Part 6 takes a different, lighter architecture: the MCP server runs inside your ABAP system (the abap-ai/mcp2 SDK), fronted by the BTP Router app for the same SSO + principal-propagation chain.

The principal-propagation / SSO steps shown here aren't limited to the MCP Gateway — the same identity chain (SAP IAS → Cloud Connector → X.509 → real ABAP user) applies to any service running on SAP BTP that fronts an on-premise backend. Using SAP API Management (with the Integration Cell) instead of the MCP Gateway would be another obvious choice.

Where to start

• New here? Begin with Part 1 to build the MCP server, then follow the series in order.
• Already have the MCP server? Jump to Part 2 (Entra ID) or Part 3 (SAP IAS).
• Parts 2 and 3 give the same result at the gateway — user context — but only the IAS token (Part 3) can travel further into SAP for on-prem principal propagation.
• Want end-to-end user identity into your own SAP backend? Part 4 builds directly on Part 3 — same front door, real on-prem execution as the signed-in user.
• Want to run the MCP server inside ABAP instead? Part 6 uses the abap-ai/mcp2 SDK plus the BTP Router — a fast, lighter path for trials and PoCs that reuses the same identity chain.

Supporting artifacts

• swapi-openapi-301.yaml — the OpenAPI 3.0.1 spec used to generate the MCP server (Parts 1–3).
• custom-connector-script.csx — C# fix for the Content-Type: application/json; charset=utf-8 rejection in the auto-created custom connector (Parts 2–3).
• entra-id-auth.http — REST Client snippets for the Entra ID OAuth flow (Part 2).
• verify-step1-discovery.http · verify-step2-ias-token.http — REST Client snippets to verify the IAS flow (Part 3).
• api-business-partner-openapi.yaml — the OpenAPI subset used to generate the MCP tools for the on-prem API_BUSINESS_PARTNER backend (Part 4).
• principal-propagation.http — REST Client snippets to verify the backend (Basic-Auth foil) and the gateway calls (Part 4).
• Generate-Connectors.py — generates per-connector apiDefinition / apiProperties / settings files for all 21 endpoints (Part 5).
• Deploy-Connectors.ps1 — bulk pac connector create with -Only / -Area / -Solution and a secure IAS-secret prompt (Part 5).
• Collect-Redirects.ps1 — optional: list connector redirect URLs (Part 5).
• integration-packages/ — importable SAP Integration Suite content packages — example Sales / Finance / Procurement MCP Gateway flows, 1:1 with the 21 connectors (Part 5).
• architecture-pp-flow.svg — sequence diagram of the Part 4 end-to-end principal-propagation authentication flow.

The .http files ship with placeholders only — never commit real client secrets or authorization codes.

License

Licensed under the MIT License.