Over the last weeks I have been working on a tutorial series that shows how to connect Microsoft Copilot Studio with SAP through the MCP Gateway on SAP Integration Suite.
The goal of the series is simple: start with a working MCP server, connect it to Copilot Studio, and then gradually move from a technical demo setup to a more realistic enterprise scenario with user authentication, SAP IAS, principal propagation, and finally read/write access to SAP business data.
The full tutorial series is available here:
https://github.com/hobru/sap-mcp-gateway-copilot-studio
Why this series?
MCP is becoming an important pattern for connecting AI agents and enterprise systems. SAP has also documented the MCP Gateway on SAP Integration Suite as one of the supported architectural options for exposing SAP capabilities to AI clients.
For me, the interesting question was not only: “Can Copilot Studio call an MCP server?”
The more important questions were:
- How do we secure this properly?
- How does user identity flow from Microsoft Entra ID to SAP?
- Can we use SAP IAS as the SAP-native identity layer?
- Can we reach an on-premise SAP backend through Cloud Connector?
- Can the call run as the real ABAP user?
- And finally: can we go beyond read-only scenarios and update SAP data safely?
That is what the tutorial series walks through step by step.
Tutorial series overview
Part Topic What it covers Video
| 1 | MCP Gateway on SAP Integration Suite | Build the first MCP server and connect via Azure API Management using client credentials | Watch |
| 2 | User authentication with Microsoft Entra ID | Use OAuth 2.0 authorization code flow and connect directly from Copilot Studio | Watch |
| 3 | User authentication with SAP IAS | Federate Entra ID into SAP IAS and issue SAP-native tokens | Watch |
| 4 | On-prem principal propagation | Connect to an on-prem SAP backend via Cloud Connector and execute as the real ABAP user | Watch |
| 5 | Bulk connector automation | Generate and deploy Copilot Studio connectors for all SAP MCP Gateway endpoints | — |
| 6 | ABAP MCP server via BTP Router | Alternative architecture using abap-ai/mcp2 inside ABAP, fronted by the BTP Router |
Watch |
| 7 | Updating SAP data | Add a write scenario using an OData API artifact, stored backend credentials, and CSRF-token handling | Watch |
The latest part: updating SAP data
The latest video in the series focuses on the missing piece in many demos: updating information in SAP, not just reading it.
In this part, the scenario returns to SAP Integration Suite MCP Gateway and adds an OData API artifact that calls API_BUSINESS_PARTNER.
The interesting part here is the split between:
- the user-facing authentication from Copilot Studio into the MCP Gateway, using the previously established IAS setup, and
- the backend authentication from Integration Suite into SAP, using a dedicated SAP communication user stored securely in Integration Suite security material.
This means the MCP client does not need to handle SAP credentials, cookies, or CSRF tokens directly. Integration Suite takes care of the backend communication, including the CSRF-token exchange required for PATCH operations.
The tutorial proves the flow by:
- Reading a Business Partner through the API.
- Updating selected information through a PATCH request.
- Reading the Business Partner again to confirm the change.
- Exposing the read and update operations as MCP tools for Copilot Studio.
What I learned while building this
One important takeaway is that the identity and integration choices matter early.
For example, Parts 2 and 3 both give us a real user at the MCP Gateway level. But if the goal is to continue that identity into SAP through Cloud Connector and principal propagation, the SAP IAS-based setup from Part 3 becomes the more relevant foundation.
Another takeaway is that read scenarios and write scenarios have different requirements. Reading data through an MCP tool is already powerful, but updating SAP data requires more discipline around authorization, API scope, CSRF handling, backend credentials, and which operations should actually be exposed to an AI agent.
That is why the repository includes focused OpenAPI definitions and .http files with placeholders only, rather than exposing broad SAP APIs without review.
When to use which part
If you are new to the topic, I recommend starting with Part 1 and then following the sequence.
If you already have an MCP Gateway setup and mainly care about authentication, start with Part 2 or Part 3.
If your target is an on-premise SAP backend with real user context, Part 4 is the key one.
If you want to automate connector creation at scale, look at Part 5.
If you prefer running the MCP server inside ABAP, Part 6 shows a lighter alternative using the ABAP MCP SDK and the BTP Router.
And if you want to move from read-only scenarios to actual SAP updates, Part 7 is the one to watch.
Links
GitHub repository:
https://github.com/hobru/sap-mcp-gateway-copilot-studio
Videos:
- Part 1: MCP Gateway on SAP Integration Suite
- Part 2: User authentication with Microsoft Entra ID
- Part 3: User authentication with SAP IAS
- Part 4: On-prem principal propagation
- Part 6: ABAP MCP server via BTP Router
- Part 7: Updating SAP data through the MCP Gateway
Closing paragraph
I hope this series helps others who are looking at SAP Integration Suite, MCP Gateway, and Microsoft Copilot Studio together. The individual parts can be used independently, but together they show a path from a simple first connection all the way to authenticated, enterprise-ready SAP integration scenarios — including updating SAP data through the MCP Gateway.
Read More Technology Blog Posts by Members articles
#abap