A manufacturing company wants to integrate their SAP S/4HANA system with a Copilot Studio agent so employees can query production order status through natural language. The SAP system exposes OData APIs and is hosted on-premises behind the corporate firewall. The company does not want to expose SAP APIs directly to the internet. Which integration architecture enables the agent to securely access SAP data without direct internet exposure of the SAP endpoint?
Select an answer to reveal the explanation.
Short Explanation
Connecting your Copilot Studio agent to on-premises SAP is like using a secure internal courier instead of the public mail — the on-premises data gateway routes requests from Power Platform into the corporate network without opening public ports. You put the SAP connector behind a gateway connection and call it through a Power Automate flow from the agent topic.
Full Explanation
When SAP S/4HANA is hosted on-premises and the organization does not want to expose its OData APIs to the internet, the on-premises data gateway is the correct connectivity solution within the Power Platform ecosystem. The gateway acts as a secure bridge between cloud services (Power Platform, Copilot Studio) and on-premises data sources without requiring inbound firewall rules.
The corporate-network gateway with custom connector and Power Automate flow approach is correct because it follows the proper on-premises integration pattern. The on-premises data gateway is installed on a corporate network server that has network access to the SAP system. A custom connector is then created in Power Platform, configured to reference the SAP OData endpoint. The connector uses a gateway connection to route its HTTP calls through the on-premises data gateway rather than directly to the internet. Because Copilot Studio actions cannot directly invoke custom connectors that require gateway connections without a flow intermediary in all scenarios, a Power Automate flow wraps the connector calls and is invoked from the agent topic. This is the end-to-end supported pattern for on-premises connectivity.
The port-forwarding custom connector approach is incorrect because it configures a connector using the SAP OData base URL and forwards the SAP server through the corporate firewall, which is exactly what the question prohibits — it exposes the SAP endpoint to internet traffic, creating a significant security risk. Direct exposure of internal OData APIs to the public internet violates the stated requirement.
The Azure API Management with virtual network, private endpoint, ExpressRoute or site-to-site VPN, public APIM endpoint, and APIM policies handling SAP authentication approach is incorrect in principle. Using Azure API Management with virtual network integration and ExpressRoute is a valid enterprise pattern, but it routes traffic from the cloud to on-premises through Azure rather than using the Power Platform's native gateway solution. This approach is significantly more complex, requires Azure networking expertise, and introduces additional infrastructure cost. It also exposes a public APIM endpoint, which partially contradicts the goal of not exposing SAP APIs to the internet, even if APIM adds a protection layer. For this exam, the on-premises data gateway is the canonical Power Platform answer for this scenario.
The perimeter-server gateway approach is wrong because it places the on-premises data gateway on a perimeter server and exposes it on a public HTTPS listener for Copilot Studio to call directly. That reintroduces an internet-facing entry point and does not follow the supported pattern of keeping the gateway on a corporate network server with connectivity to SAP. It also conflicts with the flow-based invocation pattern: custom connectors that use gateway connections are invoked through Power Automate flows, not directly as agent actions, because direct connector support in agent actions has specific limitations. The gateway-plus-flow approach is more complete and architecturally precise.
Exam tip: The on-premises data gateway is the Power Platform answer for connecting to any on-premises system, such as SAP, SQL Server, or file shares, without public internet exposure. The pattern is always: gateway installed on-premises, custom connector configured with gateway connection, Power Automate flow wraps the connector, and agent topic invokes the flow. SAP's OData API surface makes it compatible with standard OData custom connectors.