Achieving Single-Sign-On Agentic access to SAP with AWS for SAP MCP Server

This article explains how to achieve single sign-on agentic access to SAP using AWS for SAP MCP Server with Microsoft Entra ID and On-Behalf-Of (OBO) token exchange, enabling AI agents to access SAP while preserving individual user identity and authorization.

• Full identity propagation carries each user's identity through authentication to SAP, enabling per-user authorization and audit logging instead of shared service accounts
• On-Behalf-Of token exchange (RFC 8693) exchanges user tokens for downstream tokens scoped to SAP without requiring second login prompts
• Architecture uses three Entra ID app registrations: Amazon Quick client, inbound resource app, and outbound SAP access app
• Implementation involves creating Entra ID apps, configuring permission chains, deploying MCP Server via CloudFormation, and setting up SAP OIDC trust with email-based user mapping
• Key design principle: OBO client credentials must match the token audience to prevent authentication failures
• SAP Security Audit Log records actions against individual users, not service accounts, with no shared SAP credentials stored

This solution delivers secure, per-user AI agent access to SAP with full audit trails, least-privilege enforcement, and no shared credentials.