BrowseSAP Business Technology Platform, also named SAP Business AI Platform
Everything in BTP/BAIP
47 of 835
Type
Domain: Security & Compliance
Origin
Signals: Last 12 months
Content
More
Group by: Capability
EntryBySignalsLast activity
Audit loggingSAP only
s4hana-hana-audit-policiess4hana-hana-audit-policiesSQL templates for the SAP HANA audit policies of the database tenant an SAP S/4HANA system uses, in four sets from the mandatory default policies to scenario examples.sap official, btp
SQL templates for HANA audit policies of an S/4HANA tenant
teched2022-XP260teched2022-XP260An SAP TechEd 2022 session on configuring SAP BTP services according to SAP's published security recommendations: a custom identity provider, multi-factor authentication, password policy and audit logs.sap official, btp
TechEd 2022 session on SAP BTP security recommendations
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
BTP Audit Log MCP Server: Security Monitoring with AI AssistantsBTP Audit Log MCP Server: Security Monitoring with AI AssistantsWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxy, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log service's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.published 2026-03-13
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP Audit Log Access Just Got Easier - Here’s What’s NewSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log service. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.AnisaTuscano, published 2026-03-10
AuthenticationSAP and community
@arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authThe client-to-server authentication stack for an MCP server on SAP BTP: an XSUAA OAuth proxy, dynamic client registration, a chained bearer verifier, and a separate entrypoint for per-user principal propagation.independent, btp
XSUAA authentication stack for an MCP server on SAP BTP
It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it.
@marianfoo/sap-mcp-auth@marianfoo/sap-mcp-authA shared browser-login and session module for SAP MCP servers: it drives a Playwright browser through SAP Identity Authentication, caches the session cookies and returns a cookie header an HTTP client can send.independent, btp
Browser login and session module for SAP MCP servers
The maintainer states it is unofficial, not endorsed by SAP, and that it automates authenticated SAP web endpoints and browser session cookies in ways SAP's terms of service or an organisation's own policies may restrict. Password login is confined to `accounts.sap.com` and the standard SAP Cloud Identity Services tenant domains: a custom IAS domain, or a login that conditional authentication delegates to a corporate identity provider, fails closed before the password is filled and has to be completed through an interactive login instead.
@sap/approuter@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp
SAP's Node.js application router in front of business applications
@saptools/cf-xsuaa@saptools/cf-xsuaaA command line and Node.js API that reads the XSUAA binding of a Cloud Foundry app and prints an OAuth2 client_credentials token for it, cached until it expires.independent, btp
OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding
btp-ui5-show-userinfobtp-ui5-show-userinfoA UI5 app that reads the signed-in user two ways, through the Fiori launchpad shell service and through the @sap/approuter User API, and records which environments each answers in.independent, ui5
UI5 app reading the signed-in user via launchpad and approuter
No license Neither the package manifest nor the repository tree declares a licence.
Functional boundary The repository publishes no licence, so reusing its code needs the author's permission.
teched2022-XP260teched2022-XP260An SAP TechEd 2022 session on configuring SAP BTP services according to SAP's published security recommendations: a custom identity provider, multi-factor authentication, password policy and audit logs.sap official, btp
TechEd 2022 session on SAP BTP security recommendations
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
SAP Joule implementation in an S/4HANA private cloud 3 system landscapeSAP Joule implementation in an S/4HANA private cloud 3 system landscapeWalks through enabling SAP Joule across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity Services tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud Connector into the production backend.Arunrajj, published 2026-01-21
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
AuthorizationSAP only
SAP-samples/ams-samples-javaSAP-samples/ams-samples-javaSample Java applications, on Javalin, Spring Boot and CAP Java, showing policy-based authorization through the Authorization Management Service on SAP BTP, with DCL policies checked against JWT tokens.sap official, btp
Java apps showing policy-based authorization with AMS on SAP BTP
SAP-samples/ams-samples-nodeSAP-samples/ams-samples-nodeSample Node.js applications, a CAP bookshop and an Express shopping app, showing policy-based authorization through the Authorization Management Service on SAP BTP with policies written in DCL.sap official, btp
Node.js apps showing policy-based authorization with AMS on SAP BTP
teched2023-XP185vteched2023-XP185vAn SAP hands-on session that applies SAP's published BTP security recommendations to a live trial account, from multi-factor authentication to the audit log and administrative authorizations.sap official, btp
Hands-on applying SAP BTP security recommendations to a trial account
Agentic AI on BTP: a Single Agent with LangGraphAgentic AI on BTP: a Single Agent with LangGraphA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI Core's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP servers — OData MCP Proxy, CI MCP Server, AI Core MCP Server, BTP MCP Server and BTP CF MCP Server — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.published 2026-05-03
Authorization management with OpenSearch's Document Level Security - SAP Cloud LoggingAuthorization management with OpenSearch's Document Level Security - SAP Cloud LoggingWhere the predecessor SAP Application Logging service reused CF space permissions for read-only access, SAP Cloud Logging integrates with SAP Cloud Identity Services (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.Hariharan-Gandhi, published 2025-11-24
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
Dynamic authorisation with user attributes in SAP CAP and AMSDynamic authorisation with user attributes in SAP CAP and AMSThe same argument as the XSUAA-to-AMS piece, opened from a concrete failure: an acquisition puts 500 users on sales data restricted by division, and role-based access control answers it with Sales_Manager_EMEA, Sales_Manager_APAC and so on until the roles multiply past managing. Attribute-based authorisation replaces the set with one policy carrying a restriction, and the post walks through defining it in AMS against Cloud Identity Services. The clearest statement of role explosion among the three AMS pieces here.pedro_iranzo, published 2026-05-04
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token RetrievalEffective June 30th 2026, the SAP Authorization and Trust Management service (XSUAA) deprecates the HTTP GET method for retrieving an OAuth access token from its /oauth/token endpoint, leaving only POST supported in line with RFC 6749. A client still requesting a token via GET with grant_type and credentials in the query string stops working after the cutover and must switch to a POST request with form-encoded body parameters.Yogananda, published 2026-06-14
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationFrom XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based AuthorizationWhy scope-based authorization runs out, argued from enterprise extension work rather than from the documentation: XSUAA handles roles well, but real requirements are business-context restrictions — country, company code, organisational unit — and expressing those as scopes does not scale. The migration to policy-based authorization is presented as an architectural move for S/4HANA extensions rather than a configuration change.Avinash Vaidya, published 2026-05-27
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesSAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based ApproachesTwo shapes of the same xs-security.json set against each other, with the resulting JWT printed for both. The consequence for application code is what makes it worth reading: under the attribute-based configuration a CAP handler reads req.user.attr.department, and under the authority-based one it does not, because the attribute is not there. Carries a migration guide between the two.rajeshkputumbaka, published 2026-02-18
Securing a CAP Node.js App with SAP AMS on BTP Cloud FoundrySecuring a CAP Node.js App with SAP AMS on BTP Cloud FoundryThe end-to-end version: a CAP Node.js project from cds init, role-based access through the Authorization Management Service and Identity Authentication Service, and an MTA deployment to Cloud Foundry. The prerequisite list is the useful part to read first — HANA Cloud, an IAS tenant and an AMS entitlement — because it says plainly what this path costs before you are three steps into it.Jacky Liu, published 2026-07-17
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
Data privacySAP only
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingSAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingOpens with the question compliance teams ask about Cloud Integration, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.AdarshRao, published 2026-05-25
What Happens to Your Data When You Enable SAP's AI Features?What Happens to Your Data When You Enable SAP's AI Features?Traces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI Core: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy Integration is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.jaripie, published 2026-04-23
Identity provisioningSAP only
analytics-cloud-scim-api-samplesanalytics-cloud-scim-api-samplesAround 45 Postman collections that call the SAP Analytics Cloud SCIM API to create, update and transport users and teams.sap official, btp
Postman collections for the SAP Analytics Cloud SCIM API
sap-concur-user-provisioning-service-apissap-concur-user-provisioning-service-apisA Postman collection whose requests demonstrate the SAP Concur User Provisioning Service APIs for creating users in bulk and assigning their approvers.sap official, btp
Postman collection for the SAP Concur User Provisioning Service APIs
SAP-samples/concur-joule-ips-jobsSAP-samples/concur-joule-ips-jobsPre-configured Identity Provisioning jobs that source users from SAP Concur and write the SAP Global ID back, the prerequisite for enabling Joule and Task Center.sap official, btp
Identity Provisioning jobs syncing SAP Concur users for Joule
teched2025-XP261teched2025-XP261An SAP TechEd on Tour hands-on session that integrates Cloud Identity Services with Microsoft Entra to provision users across cloud and on-premises SAP systems.sap official, btp
Hands-on integrating Cloud Identity Services with Microsoft Entra
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIAutomating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioning — getting a user out of every system that holds them once they leave — by chaining btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.shasankgupta024, published 2026-01-01
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Rate limitingSAP only
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
API Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition: Seamless Enterprise Data Access for Developers and AI AgentsAPI Composition (formerly Graph, a capability of API Management) curates business data graphs from existing SAP and non-SAP API providers, so a query can navigate and expand relationships across systems through one composed API rather than hand-written integration code. Palak walks through combining SAP S/4HANA warehouse-stock data with Everstream Analytics risk data into one API, then exposing that composed API as an MCP server so an AI agent calls it with the same semantic context — the scenario behind API Management's MCP servers coverage.published 2026-07-27
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourSAP API Management for Beginners – Part 1: What Is APIM & A Complete Features TourA features tour of SAP Integration Suite's API Management capability, opening a five-part beginner series: what a governed API proxy adds over calling a backend directly, and a walkthrough of API Providers, Proxy and Target Endpoints, the Policy Editor and Policy Templates, Products, the Developer Hub, and Key Value Maps. It names rate limiting's two complementary policies as APIM implements them: Spike Arrest, which caps requests per second or minute against bursts, and Quota, which caps total calls per day, week or month against overuse.Rudhra, published 2026-08-03
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSSAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSPart 4 of a five-part beginner series on API Management within SAP Integration Suite builds out a Northwind proxy's policy set: an OAuth 2.0 token server assembled from API Management's own OAuthV2 policy, a Key Value Map for backend credentials, JSON Threat Protection and CORS headers. It places Spike Arrest and Quota on the ProxyEndpoint PreFlow, each with its policy XML and a Postman test, distinguishing per-second burst throttling from a daily call cap read from the API Product's own limit.Rudhra, published 2026-08-24
Turn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialTurn SAP APIs into MCP Tools for AI Agents using SAP Integration Suite Free TrialWalks through building an MCP server on SAP Integration Suite's free trial from an existing API artifact — the Business Partner API against a public S/4HANA Cloud sandbox — rather than from an HTTP endpoint with an OpenAPI specification or from RFC-enabled function modules, the creation wizard's other two source types, left unexplained here. Covers the API artifact's Content Modifier policy that injects the Business Accelerator Hub API key before the backend call, and the "Trust Upstream MCP Authorization" setting that lets the MCP server delegate authorization checks to that source API instead of duplicating them. Ends by fetching an OAuth token from a Process Integration Runtime service key and pointing an MCP client at the deployed server over streamable HTTP.published 2026-07-13