There Is No Box in SAP's Launchpad for Your Azure OpenAI Key
We're two PhD students behind SAP AI Lab — one of us does ML systems, the other enterprise information systems; independent blog, endorsed by neither vendor. Wiring Azure OpenAI into SAP BTP is the most common "first AI project" for SAP architects in 2026, and we watched two attempts fail the same way before we got it right ourselves. Verified as of 2026-11-08.
Both teams started with the same sentence in their design doc: "register our Azure OpenAI endpoint in SAP AI Launchpad." There is no such registration. The Launchpad has no form where you paste your own *.openai.azure.com URL and API key. What actually exists are two genuinely different paths, and confusing them is the single biggest source of failed setups.
Path A: SAP-managed capacity — your keys are never involved
The Generative AI hub in SAP AI Core offers Azure OpenAI models (gpt-4o, gpt-4o-mini, the gpt-4.1 family) through the azure-openai executable, running on SAP-managed Azure capacity. Your application authenticates with a BTP service key; SAP's Azure credentials never surface to you, and there is nothing to grant on your Azure subscription. This is the fast, well-trodden path — billed through your SAP AI Core subscription.
Except it's gated by one line item nobody reads: the hub and its foundation-models/orchestration scenarios are not available in the Free or Standard service plans — you need the AI Core extended plan. Every time a colleague posts "the Generative AI hub is missing from my Launchpad," the answer is the service plan, not a bug, not a permission. If you're setting up a subaccount and identity layer first, our BTP subaccount + Entra SSO walkthrough covers that hour.
Path B: bring your own — call your own resource, directly
If the requirement is "inference must run on our subscription, quota, and region" — billing against your own enterprise agreement — the path is REST from your BTP application straight to your Azure OpenAI deployment. The API key works, but the production answer is Entra ID with a data-plane role: Cognitive Services OpenAI User (role ID 5e0bd9bd-7b93-4f28-af87-19fc36ad61bd) permits inference but not key reading or deployment management, with a token scoped to https://cognitiveservices.azure.com/.default. One trap, straight from our incident log: management-plane roles govern the resource; if you assigned only those, chat/completions still 401s until the data-plane assignment exists. And the second-most-common 404 on this endpoint is semantic: the URL takes the deployment name, not the model name — two very different strings.
The orchestration layer most teams skip and shouldn't
On Path A, the orchestration executable gives you a pipeline you'd otherwise rebuild badly in app code: grounding → templating → masking → input/output filtering → model configuration, invoked as one POST to /v2/completion. Our favorite two features: a masking module with SAP Data Privacy Integration that anonymizes entities (emails, phone numbers) before the prompt reaches the model and re-substitutes on the way out; and turning modules from an object into an array converts the call into a fallback chain — gpt-4o degrading to gpt-4o-mini when the first fails. Small API honesty note: max_tokens is deprecated in the current spec — use max_completion_tokens, and if a parameter is silently dropped, the X-Orchestration-Dropped-Model-Params response header tells you which.
Two residency caveats before your compliance meeting: in SAP's model-availability matrix, Yes* means a model may be served cross-region for load balancing — pin regions and check the matrix before promising EU-only processing. And no, Cloud Connector is not your egress proxy: it tunnels to private networks behind it; it does not proxy arbitrary outbound REST to Azure's public endpoint.
The full walkthrough with all the pricing sources and checklists is on our site: Connect Azure OpenAI to SAP BTP: Generative AI Orchestrator Setup — the complete CLI sequence, the Launchpad role collection, the working masking payload, and the error-by-error troubleshooting table. For what the same model layer means for Joule users, see our Joule + M365 Copilot guide.