Users and role collections via the MCP server: the origin key mistake

Why it's worth reading

Three admin tasks, each done twice: once in the SAP BTP cockpit and once through the MCP server for administration. Checking access, onboarding users, creating and assigning a role collection. The most instructive part is about the origin key: pick SAP ID Service by mistake when your users come in through an IAS trust, and you assign roles that never arrive. Without an error message, naturally.

This one has already cost projects hours. Here it is, explained in a handful of paragraphs.