NewSAP Business Technology Platform, also named SAP Business AI Platform
17 changes
Mon 19
Building Code-Based AI Agents on the BAIPpublishedA Devtoberfest 2026 session on writing the agent yourself rather than configuring one, which is the agent toolingAgent toolingBuilding an agent into your own application — the tools it may call, the state it keeps between turns, and the framework it runs in. Distinct from MCP servers, which expose an application to somebody else's agent, and from agent guidance, which is knowledge handed to a coding agent.SAP and community, unassessed edge: an agent is a model with tools, skills, memory and context around it, and the session reads the code of one built in CAP as a LangGraph state graph, with an agent node that calls the model, a tools node holding the MCP clients, and the edge between them looping until no tool is needed. It then shows the shorter route, a CDS service annotated for the agent protocol with its instructions and skills in an agent.md file. SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp carries both, with the CAP service in front of it as middleware so the credentials never reach the browser, and that is what cap-agent-ui5-webuicap-agent-ui5-webuiGives a CAP agent a UI5 web interface out of the box, so an agent built in the service has somewhere to be talked to without a separate frontend project.independent, cap is demonstrated against: added as a dependency, it gives the annotated service a UI5 chat interface that can be deployed rather than only previewed. A Python multi-agent application on Cloud Foundry, where an orchestrator delegates to per-stack specialists so no single model sees every tool, closes the session.Agent tooling
Tue 13
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixpublishedWritten after the SAPwned disclosure in SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry RuntimeSAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp and SAP BTP, Kyma runtimeSAP BTP, Kyma runtimeA fully managed Kubernetes runtime on SAP BTP, based on the open-source project Kyma, where extensions to SAP solutions run as containerised microservices and serverless Functions.sap official, btp app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.Audit logging
Mon 12
Microsoft Sentinel for SAP goes agentlesspublishedExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp setup together with SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed maintenance view, with a user authorised to call them (RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.SAP and community, narrow by design). It also covers calling the audit logAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.Audit logging
Tue 29
Agentic AI on BTP: a Multi‑Agent App with Pydantic AIpublishedSplits a single CAP/TypeScript agent that had grown to juggle five BTP MCP servers behind one bloated tool list into btp-multiagent-app, a Python and Pydantic AI rewrite where the Cloud Foundry and BTP Core MCP serversServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design each get a dedicated specialist agent, with an audit log specialist scaffolded but left disabled, behind an orchestrator whose only tools are delegation calls to those specialists, which is the agent-toolingAgent toolingBuilding an agent into your own application — the tools it may call, the state it keeps between turns, and the framework it runs in. Distinct from MCP servers, which expose an application to somebody else's agent, and from agent guidance, which is knowledge handed to a coding agent.SAP and community, unassessed pattern the piece works through. Each specialist authenticates to its MCP server over Streamable HTTP with OAuth 2.1, and a shared module centralises the SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp GenAI Hub model setup behind two credential layouts, one for local runs and one for the Cloud Foundry service binding, the LLM integrationLLM integrationCalling a language model from application code with the tenant, destination and credential handling already solved instead using an SDK call with a hand-rolled key.SAP and community, narrow by design side of the rewrite. Tool lists per agent drop from well over a hundred to a dozen or two, and routing failures become separable from tool-misuse failures by reading the trace.Serve your application over MCP
Agentic AI on BTP: a Single Agent with LangGraphpublishedA CAP TypeScript agent puts a LangGraph StateGraph in front of AzureOpenAiChatClient from @sap-ai-sdk/langchain, reaching SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp's Generative AI Hub, and lets its tool-calling loop draw on five deployed MCP serversServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design — OData MCP Proxyodata-mcp-proxyA config-driven proxy that turns OData and REST endpoints into MCP tools from a JSON file — no code — and runs on BTP Cloud Foundry against BTP Destinations.independent, btp, CI MCP ServerCI MCP ServerAn MCP server that exposes SAP Cloud Integration's OData APIs as tools, defined entirely in one JSON config file, so an assistant works integration content, logs and configurations in natural language.independent, btp, AI Core MCP ServerAI Core MCP ServerAn MCP server that exposes SAP AI Core's APIs as tools, defined entirely in one JSON config file for a proxy, so deployments, configurations and scenarios are managed through an assistant.independent, btp, BTP MCP ServerBTP MCP ServerBTP Core Services as MCP tools, and the only server in this corner that renders dashboards inside the chat — a subaccount overview with drill-down, a geomap of data-centre locations, consumption and users.independent, btp and BTP CF MCP ServerBTP CF MCP ServerThe Cloud Foundry V3 API on SAP BTP as MCP tools — apps, orgs, spaces, services, routes and quotas — declared in one JSON config file and run by odata-mcp-proxy.independent, btp — through @langchain/mcp-adapters' MultiServerMCPClient. Because agent, servers and APIs share one XSUAA tenant, the chat service forwards the signed-in user's own JWT instead of a service account, so each downstream server enforces that user's own authorizations. Past roughly a hundred combined tools the single prompt slows down and stops separating concerns, which is why the author's next post splits it into one specialist agent per MCP server behind an orchestrator.Serve your application over MCP
BTP Audit Log MCP Server: Security Monitoring with AI AssistantspublishedWouter Lemaire builds an MCP server over SAP BTP's Audit Log Retrieval API using odata-mcp-proxyodata-mcp-proxyA config-driven proxy that turns OData and REST endpoints into MCP tools from a JSON file — no code — and runs on BTP Cloud Foundry against BTP Destinations.independent, btp, with a single entity set and zero custom code, so an AI assistant can answer natural-language questions like "Were there any configuration changes yesterday?" by calling AuditLogRecords_list against a BTP destination authenticated with the Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp's service key. It covers the destination setup, the entity-set configuration that maps the PascalCase entity name to a lowercase auditlogrecords path, and handling the API's 500-record pagination limit.Serve your application over MCP
Sun 27
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!publishedWalks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.Authentication
Wed 23
UI for the BTP Application Vulnerability ReportpublishedAn open-source SAPUI5 front end for SAP's Application Vulnerability Report API, backed by a CAP Node.js service that projects the external findings as an ODataODataExposing data and operations through OData, including the service model, metadata and protocol versions clients require. Version differences affect which clients can consume a service and which query features they can use.SAP and community, narrow by design V4 entity and forwards each query with api.run(req.query). The CAP service reaches that API through a Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp instance configured with OAuth2ClientCredentials authentication from a service key, so the address and credentials stay out of the application code.OData
Tue 22
Hey ABAP Cloud please let me save my data export to Azure Storage please🥺🙏- part 4publishedWalks through reaching Azure Blob Storage from ABAP Cloud without an intermediary Cloud Foundry app: an OAuth2 client credentials flow against Microsoft Entra ID, driven either through
cl_http_destination_provider and the SAP Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp at subaccount or Cloud Foundry-space level, or through the SAP_COM_0276 communication scenario and Communication Management. Notes that SAP marks the destination-service route deprecated for ABAP Cloud even though it alone offers management APIs and cross-tenant reuse, and closes on automating the resulting client-secret rotation with Azure Key Vault.DestinationsSat 19
BTP Cloud Foundry MCP Server: Managing CF Environments with AIpublishedWalks through a server built on odata-mcp-proxyodata-mcp-proxyA config-driven proxy that turns OData and REST endpoints into MCP tools from a JSON file — no code — and runs on BTP Cloud Foundry against BTP Destinations.independent, btp that exposes the Cloud FoundrySAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp V3 API's 28 entity sets — apps, orgs, spaces, services, networking, quotas — as MCP tools from a JSON config with no application code. It shows the config shape that bridges the API's snake_case paths to PascalCase tool names via a
urlPath field, and the OAuth2 client-credentials destination setup an assistant needs to reach a CF landscape.Serve your application over MCPSun 13
Understanding and Developing Fiori Plugins with Extension API & TypeScriptpublishedDescribes a launchpad plugin as a UI5 component without views that the shell loads for every app, SAPUI5 only, and compares extending the shell through the renderer with the
Extension service from 1.120 and FrameBoundExtension from 1.124, down to the placement options each allows. It builds fiori-fullscreen-pluginfiori-fullscreen-pluginA SAP Fiori launchpad plugin in TypeScript that adds one header button, created through the Extension API, which toggles the browser's fullscreen mode; it needs SAPUI5 above 1.120.independent, ui5 as the sample, and ends with activation: globally through /UI2/FLP_CONF_DEF and /UI2/FLP_CUS_CONF or per role through a Shell-plugin target mapping on an ABAP launchpad, and as an HTML5 app assigned to a role in SAP Build Work Zone.Launchpad pluginsTue 8
CAP multitenancy with Work ZonepublishedA gap in the tooling and the manual edit that closes it.
cds add portal wires the Portal service, which is deprecated; Work Zone supports multitenancy but has no equivalent command. The author runs the portal command anyway and then rewrites the resource and module config in mta.yaml to point at Work Zone. Short, and honest that it is a workaround rather than a supported path.MultitenancyExtend Upload Set to Fiori Elements and utilize Document Management ServicepublishedWritten two months before there was an official plugin, and the author has left the record of that in the page: an update dated 2024-04-04 noting the CAP team released @cap-js/attachments@cap-js/attachmentsAn official CAP Node.js plugin for attachment handling, with local database storage and AWS S3, Azure Blob or GCP Object Store integration.sap official, cap, and another dated 2024-05-21 saying they tested it and wrote up the Object Store variant separately. The hand-built version underneath is still the answer when the plugin's storage choices do not fit.Attachments
Extend Upload Set with Table to Fiori Elements and utilize Object StorepublishedThe Object Store variant of the author's earlier Document Management post, written after testing @cap-js/attachments@cap-js/attachmentsAn official CAP Node.js plugin for attachment handling, with local database storage and AWS S3, Azure Blob or GCP Object Store integration.sap official, cap — a sample managing text and file information together, and offered as something for people new to BTP rather than as a pattern.Fiori annotations
Sharing SAP HANA Cloud instance to multiple subaccounts and creating HDI containerspublishedOne HANA Cloud instance, several subaccounts, an HDI container created from each — the arrangement that keeps a landscape from paying for a database per subaccount. Written against a CAP project, so the container mapping is shown from the side that has to consume it.Database connectors
Mon 7
Testing SAP Build Process Automation task UI in SAP Business Application StudiopublishedA task UI built from the Workflow Task UI template cannot be run in Business Application Studio: it expects the task model and the inbox API as startup parameters, and without them it fails before the view renders. The post shows the error, explains why it happens, and supplies a wrapper that provides the missing context locally, so the alternative to deploying on every change is not deploying on every change.Task and approval UIs
Tips for running CAP nodejs in SAP BTPpublishedDeliberately not a summary of capire: the author says up front that nothing here repeats the documented best practices, and the subject is configuration for running cloud-natively rather than correctly. Examples target Cloud Foundry, with the claim that they hold for Kyma too.Deployment