Enable Microsoft Copilot and Teams to Pass Requests to Joule

[MichaelShea]

This blog shows you how to integrate Joule with Microsoft Copilot and Teams so that your users can have conversational interactions that include content about integrated SAP systems. With the previous blog, we established the technical infrastructure so that Microsoft and SAP systems trust each other and exchange any required tokens for the two systems to interact. In the next steps, we add SAP's Teams Bot, add the required API permissions, then expose those APIs. In the final step, you add M365 Copilot for Joule to your landscape to complete the integration.

The following figure shows our target architecture.

Prerequisites

• You've configured your tenants SAP Cloud Identity Services and Microsoft Entra ID to trust each other. 
  You need the TenantId which you noted down during the registration of your federation app in Microsoft Entra ID.
  Note: Joule maintains a 1:1 relationship with a Microsoft Entra ID tenant. A single Entra ID tenant can't be used for configuring multiple Joule environments. For example:  Your DEV and PRD tenants can't use the same Microsoft Entra ID tenant. Therefore, to create a test environment for the Copilot integration, we recommend using a dedicated M365 tenant for testing purposes.
• You've set up conditional authentication for Joule.

For details, see our previous blog Configuring SAP Cloud Identity Services and Microsoft Entra ID for Joule.

Configure Your Microsoft Entra ID Tenant

Go to the Entra ID Admin Center with the admin user role.

Add the SAP Teams-Bot Application

1. Open a text editor and copy this URL:
   https://login.microsoftonline.com/<tenant_id>/v2.0/adminconsent?client_id=2cf32c47-cb71-49f6-a648-d8fe234042f8&scope=2cf32c47-cb71-49f6-a648-d8fe234042f8/.default
2. Replace <tenant_id> with the directory (tenant) ID which you noted down during the registration of your federation app in Microsoft Entra ID in our previous blog Configuring SAP Cloud Identity Services and Microsoft Entra ID for Joule.
3. Open a browser, paste the URL and execute the request.
4. Log on with a user with the admin user role.
   A consent dialog appears.
5. Give your consent (accept).
   You can ignore error messages displayed in the browser.
   

Configure API Permissions

1. Go to Home > Identity > Applications > App registrations.
2. Choose your federation app.
3. Choose API permissions.
4. Choose Add a permission.
5. Choose APIs my organization uses.
6. Choose svc-ai-joule-prod.
   
7. Choose Delegated Permissions (default).
8. Enable the access_as_user permission.
9. Choose Add permissions.
   
   Notice the new entry for svc-ai-joule-prod. Permissions aren't granted yet.
   
10. Choose Grant admin consent for {Entra_ID_Tenant_Name} and choose Yes.
    
11. Verify that the status for svc-ai-joule-prod has changed to Granted.

Expose APIs

1. Go to Home > Identity > Applications > App registrations.
2. Choose your federation app.
3. Choose Expose an API.
4. Validate that you have already added the Application ID URI as described in our previous blog Configuring SAP Cloud Identity Services and Microsoft Entra ID for Joule.
   
5. Choose Add client application and add the following client applications:
   • 2cf32c47-cb71-49f6-a648-d8fe234042f8 (SAP Teams-Bot application)
   • 1fec8e78-bce4-4aaf-ab1b-5451cc387264 (Teams Desktop Application)
   • 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 (Teams Mobile Application)
6. Enable any Authorized scopes.
   
7. Choose Add application.
8. Verify that all three applications are listed under Authorized client applications.
   

Enable the Joule Application for Microsoft Copilot and Teams

Add a system of type Microsoft 365 Copilot for SAP Joule to your system landscape and add this system to your Joule formation.

• If you have already onboarded your tenant with the booster and you are using the same tenant for Teams integration, add a system of type Microsoft365 Copilot for SAP Joule to the existing formation.
  For more information, see Include or Exclude a System in the Joule Formation.
• If you are setting up a tenant for the first time, use the Joule booster.
  For more information, see Run the Joule Booster in the Joule Documentation.

See also Enabling Joule in the SAP BTP Documentation.

Give it a Go

If everything is configured correctly, you can open the Joule application in Microsoft Copilot or Microsoft Teams and say, "Hello". Joule should answer back. If Joule doesn't answer, you might have made a mistake in following these blogs or we may have a bug to iron out. Go carefully through this setup and make sure you have it right. If you are still having trouble, our support team will be happy to help you. Please book a session with the Joule Readiness Service via the Booking Tool.

Conclusion

Your landscape is configured to pass on conversations started in a Joule application in Microsoft Copilot and Teams to a Joule agent, which in turn queries further Joule agents integrated with the landscape.