MCP Servers can now be built and deployed on SAP Integration Suite, turning existing OData services and other SAP APIs into tools that MCP-capable clients can discover and invoke.
Once your MCP Server is running, the next question is inevitable: how does the identity of the calling user reach the backend? For on-premise (or private cloud) SAP systems reachable via SAP Cloud Connector, the answer is Principal Propagation — the same mechanism used by every other BTP-to-on-premise integration scenario.
This post covers the end-to-end setup for the generic case: any MCP client (MCP Inspector, Joule Work Desktop, etc.) authenticating against SAP Default or IAS IdP, calling an MCP Server artifact on SAP Integration Suite, which then reaches S/4HANA on-premise through Cloud Connector as the real calling user.
