Copilot Borrows Joule's Eyes: How the SAP–Microsoft Integration Actually Gates Your Data

We're two PhD students who run SAP AI Lab — one of us researches ML systems, the other enterprise information systems. Independent blog, no endorsement from SAP or Microsoft, and we like asking the questions enterprise architects ask at 2 a.m.

Ours, this autumn: a friend managing a mixed SAP/M365 estate said "we bought Copilot licenses, so SAP data is in Copilot now, right?" It isn't, and the reason why it isn't turned out to be the most interesting part.

The mental model that makes everything else click

The managed integration between SAP Joule and Microsoft 365 Copilot — generally available since February 2026 (SAP News DE listing, 2026-02-09, "Allgemeine Verfügbarkeit"; Microsoft's operational doc last updated 2026-09-11; our verification pass as of 2026-11-08) — is bidirectional. In Teams, a buyer types @Joule Show me open purchase orders that are past their expected delivery dates and the answer comes back into the chat. Inside Joule, the same user can ask for their own emails and Teams chats. Reversibility is the point: neither copilot owns the user.

But here's the governance shape: Copilot borrows Joule's eyes, and Joule sees only what the mapped SAP user is permitted to see. The request path is Entra ID authenticating the Microsoft 365 user → SAP Cloud Identity Services mapping that identity to their SAP user → Joule executing against S/4HANA under that SAP identity, with the same OData-level permissions they'd have in Fiori. SAP's documentation says Joule use cases "follow the same configurations and permissions as those on the Web." Nobody is opening a side door into your ERP; the division of labor is explicit — SAP does the natural-language processing for SAP tasks, Microsoft owns the Copilot/Teams experience, and the join between them is an identity trust, nothing more.

Which explains the most confusing support ticket in this whole area: when a supported question returns "no data" for user B but works for user A, that is expected behavior, not a bug. Either user B lacks the SAP-side role, or their Entra→SAP provisioning was never completed — the #1 documented failure mode. Check SAP roles first, IAS mapping second.

Licensing has teeth on both sides

Buying one side buys you an icon that returns nothing. You need Microsoft 365 Copilot seats and the SAP entitlements for Joule. On the SAP side, Business AI activation is entitlement-driven through the AI Activation Dashboard in SAP for Me, on the new AI Unit SKU 8019164 (released 2025-05-20); the legacy SKU 8018592 still activates individual features but not through the new package flow. Mark two dates in the planner: the simplified activation flow arrived April 1, 2026, and the legacy IAS-based activation path started deprecating May 1, 2026. Teams still on the old path hit walls and need their SAP account engineer to migrate SKUs.

Where Azure OpenAI actually sits

Every Azure architect asks this, so we'll be precise about what the sources support. Documented: Joule runs on SAP BTP, whose model-serving layer is the generative AI hub in SAP AI Core, and SAP's AI Core documentation explicitly lists Azure OpenAI models — "additional selected models from OpenAI are supported via Azure," with Azure Content Safety and Prompt Shield in the hub's safety layer. Inferred: the GPT models behind Joule scenarios are served through Azure OpenAI infrastructure. Not documented: that every prompt lands on an Azure OpenAI model — the hub is deliberately multi-provider (Claude, Gemini, Llama are in the catalog), and some GPT-4 endpoints are deprecated in favor of GPT-4.1 per SAP Note 3437766. For a compliance review, ask which model serves your scenarios.

Also be honest about the boundaries we verified: standard Joule and Copilot scenarios only — custom Copilot Studio agents do not ride this bridge (that's a different track with its own connector licensing), and the integration can't answer what Joule itself can't do. Our own gaps list, which we'd rather admit than smooth over: no English-language SAP press item pins the GA date, and prompt-retention specifics across the Copilot→Joule boundary aren't documented in the sources we could reach.

The full walkthrough with all the pricing sources and checklists is on our site: SAP Joule + M365 Copilot on Azure: How It Actually Works, including the worked request trace and the seven rollout pitfalls. If the managed bridge's "standard scenarios only" is where you chafe, the open-protocol path is our A2A integration guide, and the vocabulary cleanup is the Business AI terminology map.