Deploying a Copilot Agent to handle GL Assignment and posts to SAP

Have you ever thought about talking to SAP the same way you chat with ChatGPT? That’s the idea behind Cubis AI Accounting Clerk. This prototype shows how a Copilot agent can accept a vendor invoice PDF, decide the correct GL and submit the posting to SAP through a secure, auditable flow while keeping finance in control.

Summary

• Users upload a vendor invoice PDF or provide a SharePoint link to the Copilot agent and ask it to post the invoice to SAP.
• The agent determines the correct GL account by consulting a maintained Luxembourg Chart of Accounts stored in Excel.
• The agent triggers a trusted Power Automate flow that executes the SAP posting using the standard document posting interface (BAPI_ACC_DOCUMENT_POST).
• The solution can be surfaced inside Microsoft Teams or Copilot and accepts files uploaded directly or referenced via SharePoint.
• Postings are routed through an enterprise gateway between Microsoft and SAP to ensure secure, auditable transmission.

This post explains the prototype’s value, how GL assignment is governed, the integration and governance considerations we applied and the business outcomes we observed during the pilot.

Why did we build it?

Accounts payable is critical but often burdened by repetitive, low-value tasks. Manual invoice posting consumes finance capacity, introduces avoidable errors, and creates bottlenecks at month-end. The prototype sought to validate several objectives:

• Demonstrate how a Copilot agent can simplify invoice intake and posting for AP teams.
• Prove that finance-owned GL mapping can be integrated with AI decisioning while maintaining transparency.
• Show that secure, auditable posting to SAP can be orchestrated from a Copilot-driven front end.
• Measure time savings, error reduction, and user acceptance before any broader rollout.

We also wanted to understand first‑hand how complex it would be to build and operate a solution like this, the technical, governance, and change management effort required, so we could realistically assess effort, risks, and scalability.

User experience and workflow overview

1. Find Agent: Via Microsoft Teams or Copilot we can access to the agent, like a common chatbot.

Microsoft Teams: Agent

Microsoft 365 Copilot: Agent

2. Upload or link: A user uploads the vendor invoice PDF to the Copilot agent or provides a SharePoint link where the invoice resides. It can also be a folder with more then one Invoice, allowing for mass posting of vendor Invoices.

Upload Invoice file and Instruct agent

Invoice example used

3. Ask to post: The user tells the agent to post the invoice to SAP.

Upload Invoice file and Instruct agent

4. GL assignment: The agent consults a controlled LU CoA in Excel to determine the appropriate GL account for each posting line. The GL decision is presented to the user for confirmation before posting.

Posting format, with GL assignments for confirmation

5. Submit to SAP: With user confirmation, the agent triggers a power automated flow that posts the document to SAP and sends confirmation back to the chat. The end-to-end posting is recorded and traceable in SAP.

Response with document parked in SAP

View of document parked In SAP

The interface is intentionally minimal: upload, review, confirm, done. That simplicity drives adoption while preserving checkpoints for finance control and exception handling.

GL assignment approach that keeps finance in control

A fundamental design principle was that accounting rules must remain owned and controlled by finance. To meet that requirement we used a straightforward, maintainable design:

• Single source of mapping: GL mapping is maintained in a single Excel file representing the Luxembourg Chart of Accounts (LU CoA). Finance teams edit that file directly as accounting policies or chart changes arise.
• Transparent lookups: When the agent assigns a GL account it surfaces the mapping rationale to the user, including the LU CoA entry used. This makes assignments auditable and easily questioned when needed.
• Human-in-the-loop for exceptions: If the lookup cannot determine a confident GL or the invoice data is ambiguous, the agent flags the transaction and prompts for human review rather than posting automatically.
• Low-friction updates: Because the mapping lives in a spreadsheet, routine updates do not require engineering changes or code releases. This accelerates governance and reduces reliance on IT for everyday accounting changes.

This pattern balances automation with control: finance defines the rules, the agent enforces them consistently, and exceptions remain under human oversight.

Copilot Agent

Copilot is an assistant designed to follow user instructions precisely and surface useful, actionable knowledge. It balances doing tasks (execute instructions, generate content, guide processes) with making relevant information easy to act on.

Instructions

Instructions are the primary directions and parameters an agent follows. Agents rely on instructions to:

• determine which tool or knowledge source to call for a user query or autonomous trigger,
• populate tool inputs using the available context,
• generate the response delivered to the end user.

Agents cannot execute instructions that reference tools, knowledge sources, or topics that have not been configured for them. You must first provide the agent with the required tools and knowledge sources. For example, an instruction to search a website will only work if it’s added as a knowledge source. Make sure instructions given to an agent are grounded in the actions and knowledge you have configured for it.

Knowledge Sources

In Copilot Studio, knowledge sources work alongside generative answers. When added, these sources let agents access enterprise data from Power Platform, Dynamics 365, websites, and external systems so they can provide relevant information and insights to your customers.

Published agents that include knowledge use the configured sources to ground their responses. Knowledge can be incorporated at the agent level, on the Knowledge page, or at the topic level using a generative answers node within an agent topic. Sources may be attached during agent creation, added afterward, or linked directly to a generative answer’s topic node.

Copilot Agent configuration

Power Automate Flow

We connected our agent to a Power Automate flow that invokes SAP functions such as BAPI_ACC_DOCUMENT_POST so the agent can autonomously post financial documents when its instructions determine that action is required.

1. The agent sends a structured request to the flow with the extract data from the invoice and GL assignment for each line item.
2. Our flow will receive this data as input and by using another AI prompt he is able to transform the data into the exact fields the BAPI expects (company code, posting date, GL items, amounts, reference IDs, etc.).
3. The flow handles the SAP call, response parsing, and any downstream updates.

This separation keeps the agent focused on decisioning and orchestration while the flow encapsulates the SAP-specific payload mapping, authentication, and transport details.

Flow to send to SAP connect to the Copilot Agent

Integration pattern and secure connectivity

In many enterprises landscapes SAP runs in a protected network (on‑premises or in a private cloud) while Copilot, Power Automate, Teams, and SharePoint are cloud services.

The gateway acts as a controlled bridge so the cloud‑hosted automation can call SAP functions (for example BAPI_ACC_DOCUMENT_POST) without exposing the SAP system directly to the internet. In short, the gateway enables reliable RFC/BAPI access from cloud orchestration into SAP while respecting network and security boundaries. At high level the gateway provides:

• Secure bridging: a one‑way managed channel for trusted cloud services to reach SAP endpoints without opening broad inbound access to SAP.
• Protocol support allows the orchestration to use SAP‑native interfaces (RFC, BAPI, OData) through a supported connector.
• Credential isolation: credentials used to call SAP are stored and used by the gateway or controlled app context rather than being embedded in user devices or chat interactions.

SAP Authentication via Data Gateway setup for Cubis

Connection status for our flow that is assign to the agent

Overview cost

Plan for three main cost categories:

• Gateway infrastructure: the on‑premises or VNet‑hosted gateway requires at least one dedicated VM (or a small HA cluster) with OS licensing, patching, monitoring, backup and network/security effort; size and redundancy drive the compute and operational costs.
• Copilot and agent consumption: you’ll need appropriate Microsoft 365/Copilot seats or a premium extensibility tier plus potential metered charges for agent calls, connector usage, and API requests, budget both subscription seats and pay‑per‑use consumption that can rise with volume.
• SAP and cloud platform costs: ensure your account for SAP entitlements (service accounts, any connector licensing, and Basis/admin effort) and any Azure/Microsoft cloud services used for orchestration, storage, logging, secret management, and scaling. These platform costs are usage‑driven and vary by region and SLA.

Future Scope and Expanded Capabilities

We see Cubis AI Accounting Clerk as a foundation for a broader set of finance automations. Next steps include extending the agent to handle:

• customer invoices and accounts receivable workflows,
• upload and reconcile bank statements,
• support automated payment runs,
• manage open periods, etc…
• controlling account assignments,
• Integrate with MM and SD (Purchase Orders and Sales Orders).

Adding these capabilities would let the same conversational front end manage both sides of the ledger, reduce manual reconciliation, and accelerate cash application and collections.

Beyond transactional posting, we envision the agent supporting master‑data tasks that commonly slow finance and operations:

• controlled business partner creation and updates
• handling asset accounting master data,
• handling controlling master data, like profit centres and cost centres,
• internal order management.

Each new capability would retain the same design principles, finance ownership of rules, transparent decisioning, human‑in‑the‑loop for exceptions, and secure orchestration into SA, so teams gain more automation without sacrificing control or auditability.

Closing

Cubis AI Accounting Clerk shows that a Copilot agent can dramatically simplify a routine yet critical finance process while preserving control, security, and auditability. The prototype combined a finance-owned LU CoA lookup, an intuitive user experience, and secure orchestration into SAP to deliver measurable efficiency and accuracy gains.

Written by