Author · SAP consultant and IT auditor (CISA) · Hammerherren GmbH

Siegfried Zeilinger

Siegfried Zeilinger is a freelancer and managing director of a small management consultancy. His turf: authorizations and identity management for SAP, plus security audits of IT systems – wherever "it has always worked so far" doesn't count as an argument. His consulting ranges from SAP architecture and development strategies for ABAP, Java and the cloud to SAP identity management. He has been a certified IT auditor (CISA) since 2016. Most recently he has worked mainly in the pharmaceutical industry and the public sector – two fields where an audit is never just a formality.

Before going freelance in 2011, he worked for SAP Austria as an SAP NetWeaver and portal consultant on large international projects. Today he regularly teaches SAP courses on authorizations, SAP in the cloud and SAP NetWeaver. From 2003 to 2019 he supervised theses at the Vienna University of Technology and the University of Applied Sciences Wiener Neustadt and taught various SAP courses.

Get in touch

Posts by Sigi

Picked up · Cloud

SAP Cloud ALM: the ITSM Console shows every call to the ticketing system

Ticket not created, alert not raised, mapping empty. With SAP Cloud ALM connected to ServiceNow or Jira Service Management, that used to mean digging through logs, matching timestamps and, when in doubt, opening a support case with SAP. The new ITSM Console under External API Management now shows …

community.sap.com ↗picked up by SigiDEEN Picked up · SAP BTP

Joule Studio and NVIDIA OpenShell: how SAP plans to keep AI agents on a leash

An AI agent that gets things done in your ERP needs two minders. One who knows what it is allowed to do, and one who makes sure it doesn’t slip its leash. That is exactly how SAP and NVIDIA split the work: Joule Studio checks authorisations, roles and …

news.sap.com ↗picked up by SigiDEEN Picked up · SAP BTP

Terraform and entitlements: where depends_on belongs

How do you make sure Terraform creates the service instance only after the entitlement? The accepted answer: depends_on belongs on the data source for the service plan, not on the instance. From provider 1.22.0 onwards, it also works directly via offering and plan names.

github.com ↗picked up by SigiDEEN Picked up · Authorization

Users and role collections via the MCP server: the origin key mistake

Three admin tasks, each done twice: once in the SAP BTP cockpit and once through the MCP server for administration. Checking access, onboarding users, creating and assigning a role collection. The most instructive part is about the origin key: pick SAP ID Service by mistake when your users …

community.sap.com ↗picked up by SigiDEEN Picked up · Integration

n8n or SAP Integration Suite? A view from SAP

Sooner or later, someone in a meeting says: ‘n8n could do that in ten minutes.’ Quite right. Automation done, APIs wired up, an AI workflow bolted on, all in ten minutes. And when an order fails to arrive?

community.sap.com ↗picked up by SigiDEEN Picked up · SAP BTP

CAP in September 2026: services as AI agents, and the MCP adapter

The September release of CAP is all about AI. Nobody could have seen that coming. CAP services can now be built as AI agents, the MCP adapter (in beta since June) opens existing services up to agents, and vector embeddings have arrived for CAP Node.js too.

community.sap.com ↗picked up by SigiDEEN Picked up · Cloud

Neo ends in 2028: AI skills to help with the move to Cloud Foundry

Neo reaches end of life for external customers in 2028. That sounds a long way off. It isn’t.

community.sap.com ↗picked up by SigiDEEN Picked up · SAP BTP

Running SAP BTP in plain English: the MCP server for administration

SAP now runs an MCP server for SAP BTP administration. Instead of clicking through the cockpit, you ask an AI client: which entitlements are there, who holds which role, and could we have another subaccount just like Staging, please. Sign-in goes through SAP ID Service, and the agent …

community.sap.com ↗picked up by SigiDEEN Picked up · Authorization

Mapping Entra groups to role collections: the Identity Federation trap

At sign-in, Microsoft Entra ID is generous with groups. Very generous. Some SAP applications then turn those groups into role collections.

community.sap.com ↗picked up by SigiDEEN Picked up · Integration

MCP Gateway: SAP’s official way in for AI agents

AI agents want a way into SAP systems. The only question is which door. SAP’s answer is unambiguous: the MCP Gateway in SAP Integration Suite.

community.sap.com ↗picked up by SigiDEEN Picked up · Identity

Technical users and inactivity rules: the Q2 updates for identity and security

The quarter brings technical users to SAP Cloud Identity Services: at last, a user type of their own for interfaces and jobs, instead of machines posing as employees. Add to that blocking and deleting inactive users, new Identity Provisioning tenants for Neo customers (created automatically from 10 June …

community.sap.com ↗picked up by SigiDEEN Picked up · SAP BTP

Making SAP AI Core costs visible: an open-source dashboard from SAP

Generative AI apps are quick to build. The invoice still turns up at the end of the month. An open-source dashboard from SAP-samples makes SAP AI Core consumption visible: tokens by model and use case, converted into capacity units, with notifications before it starts to hurt.Cost control for …

community.sap.com ↗picked up by SigiDEEN

Picked up by Sigi

community.sap.comSAP Cloud ALM: the ITSM Console shows every call to the ticketing system news.sap.comJoule Studio and NVIDIA OpenShell: how SAP plans to keep AI agents on a leash github.comTerraform and entitlements: where depends_on belongs community.sap.comUsers and role collections via the MCP server: the origin key mistake community.sap.comn8n or SAP Integration Suite? A view from SAP