TL;DR
Agents and the MCP server carry version and environment requirements. Which release you need, and which deployment types are excluded outright.
There are three different answers, and one of them is not a version. The Agent SDK for AL reaches production from version 28.1. The AI development toolkit needs a sandbox from version 27.2. And Microsoft's MCP Server configuration page names no version at all — its stated constraint is Business Central online.
What does each piece actually require?
Microsoft's own sentence covers two of the three in one line:
"The AI development toolkit is available in sandbox environments only. The Agent SDK for AL is available in sandbox environments and, starting from version 28.1, also in production environments."
And the prerequisites list adds the floor for the sandbox itself: "A sandbox environment for testing and experimentation from version 27.2 (can include customer data such as sandbox copies of production data)."
| What you want to do | What Microsoft requires |
|---|---|
| Design an agent in the toolkit | A sandbox environment from version 27.2 — "sandbox environments only" |
| Run a coded agent in production | The Agent SDK for AL, in production "starting from version 28.1" |
| Connect an AI client over MCP | No version is stated. The page says "APPLIES TO: Business Central online" |
The parenthesis in that prerequisite is worth reading twice. A sandbox "can include customer data such as sandbox copies of production data" — so the sandbox-only restriction limits where the agent runs, not how real the data it runs against is.
Why does the MCP page name no version?
Because its constraint is a deployment type, not a release.
The configuration page opens with "APPLIES TO: Business Central online" and never names a version number anywhere in its prerequisites, which list exactly one item — a permission set.
### What this is, and what it is not It is a statement about that page, read in full on 15 September 2026. It is not a claim that no Microsoft page anywhere states a version for MCP. Release plans and update pages are separate documentation sets, and this article has not searched them.
What the online-only scope does settle is on-premises. If your Business Central runs on your own servers, the page that tells you how to configure the MCP Server does not describe your deployment, and no amount of updating changes that — it is a different product line, not an older one.
Which permissions do you need before any of it works?
Three named permission sets, and they do different jobs.
| Set | Microsoft's description |
|---|---|
| MCP - ADMIN | "You have at least the MCP - ADMIN permission set or equivalent permissions" — the MCP page's sole prerequisite |
| AGENT - ADMIN | "gives you permission to design agents" |
| AGENT - DIAGNOSTICS | "gives you access to see the execution cost and the serialized page in the agent task log entries" |
The third one is the one people skip, and it is the one you need at the worst moment. Execution cost and the serialized page are what you read when an agent did something you did not expect — and the agent is driving pages rather than calling an API, so the serialized page is the closest thing to a trace of what it saw.
Grant diagnostics at setup, not after the first surprise.
What else is a prerequisite besides a version?
Three things, and none of them are a release number.
The capability has to be switched on. "Enable the Custom Agent capability in Business Central" — and the design capability "is listed under Production ready previews" on the Copilot and agent capabilities page. That is a status label doing real work: production-ready preview is neither preview nor general availability, and the toolkit page carries its own prerelease notice — "[This article is prerelease documentation and is subject to change.]" and "This is a preview feature."
Billing has to be set up. "Billing setup for agent capabilities in your tenant" is listed as a prerequisite, not as an afterthought — agents consume Copilot Credits as they work.
And the agent arrives switched off. "An agent is by default in the Disabled state. You must activate the agent to use it, but you can only activate it after you have defined its purpose and tasks." The platform will not let you enable an empty agent, which is a small, sensible guard.
What can an agent do through MCP by default?
Read everything exposed, and change nothing.
"By default, the MCP Server gives agents read-only access to all exposed Business Central API pages. This behavior means that without any extra setup in Business Central, agent makers can immediately create agents that read the data exposed by these APIs."
Writing is a deliberate act: "if you want to enable agents to create, modify, or delete entities and data, you must configure these operations on the MCP Server."
The switch that governs it is named, and its off position is absolute: Unblock Edit Tools specifies whether tools "can perform create, update, or delete operations… When turned off, all these permissions are set to false making the tools read-only."
Read that default carefully, though. Read-only is safe for writes and says nothing about reach — the default exposes all API pages, so the first configuration decision is what an agent should be able to see, not only what it should be able to change.
What catches people out?
Two published constraints that look like bugs when you meet them cold.
There is a ceiling on tools, and it belongs to the client. "Copilot Studio currently has a limit of 70 tools. If you add all standard APIs as tools in the configuration, only the first 70 are available to agents you build in Copilot Studio." Microsoft's answer is Dynamic Tool Mode, where "agents search for tools within the configuration dynamically" using three system tools — bc_actions_search, bc_actions_describe and bc_actions_invoke. Silently getting the first seventy is a much worse failure than an error, so check this before blaming a model.
And not every API page can currently be a tool. "API pages of subtype ListPart and CardPart aren't currently supported as MCP tools. Only top-level API pages can be added to MCP Server configurations." If the data you want lives on a part, it needs a top-level API page first, and that is developer work rather than configuration.
About Cognilium Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/
Agentic ERP. We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on Azure OpenAI, Microsoft Fabric and Copilot Studio. We build these on request, against your data and your environment.
More on the boundary between what Copilot does and what you build: Agentic ERP on Dynamics 365.
If you are scoping an agent against a specific environment, the version is the easy half — the permission sets and the default reach are where scopes go wrong. Bring your environment details to a 15-minute call.
Sources
- Configure Business Central MCP Server · fetched and read in full 2026-09-15 · page states Last updated on 2026-05-03
- Create and activate an agent (preview) · fetched and read in full 2026-09-15 · page states Last updated on 2026-05-03
Sources and fact-check
| # | § | Claim | Tier | Primary source | Verdict |
|---|---|---|---|---|---|
| 1 | 1 | "available in sandbox environments only"; "starting from version 28.1, also in production environments" | T1 — verbatim | ai-development-toolkit-agent-create | PASS |
| 2 | 1 | "A sandbox environment for testing and experimentation from version 27.2 (can include customer data such as sandbox copies of production data)" | T1 — verbatim, including the parenthesis | Same page, Prerequisites | PASS — 27.2 is not published in any article we have written |
| 3 | 1 | Sandbox-only limits where it runs, not how real the data is | T2 — ours, read directly off the parenthesis in claim 2 | — | PASS |
| 4 | 2 | "APPLIES TO: Business Central online", and no version stated on that page | T1 for the quotation; the absence is BOUNDED in the body to that one page, read in full on 2026-09-15 | configure-mcp-server | PASS — see the bounding note |
| 5 | 3 | "You have at least the MCP - ADMIN permission set or equivalent permissions" | T1 — verbatim, the MCP page's only prerequisite | configure-mcp-server | PASS |
| 6 | 3 | AGENT - ADMIN "gives you permission to design agents"; AGENT - DIAGNOSTICS "gives you access to see the execution cost and the serialized page in the agent task log entries" | T1 — verbatim ×2 | ai-development-toolkit-agent-create | PASS |
| 7 | 4 | "Enable the Custom Agent capability"; "listed under Production ready previews"; the prerelease and preview notices | T1 — verbatim ×4 | Same page | PASS |
| 8 | 4 | "Billing setup for agent capabilities in your tenant" is a listed prerequisite | T1 — verbatim | Same page | PASS |
| 9 | 4 | "An agent is by default in the Disabled state… only activate it after you have defined its purpose and tasks" | T1 — verbatim | Same page | PASS |
| 10 | 5 | "By default, the MCP Server gives agents read-only access to all exposed Business Central API pages" and the follow-on sentence | T1 — verbatim | configure-mcp-server | PASS |
| 11 | 5 | Unblock Edit Tools — "When turned off, all these permissions are set to false making the tools read-only" | T1 — verbatim, switch name character-exact | Same page | PASS |
| 12 | 5 | Read-only is not the same as narrow | T2 — ours, a consequence of claim 10's "all exposed" | — | PASS |
| 13 | 6 | "Copilot Studio currently has a limit of 70 tools… only the first 70 are available" | T1 — verbatim. *Note currently — a statement of present scope, not a permanent design* | Same page | PASS |
| 14 | 6 | Dynamic Tool Mode and the three system tools bc_actions_search, bc_actions_describe, bc_actions_invoke | T1 — verbatim, names character-exact, lowercase with underscores as Microsoft writes them | Same page | PASS |
| 15 | 6 | "API pages of subtype ListPart and CardPart aren't currently supported as MCP tools. Only top-level API pages can be added" | T1 — verbatim | Same page, Note | PASS |
Tier summary: 13 × T1 (all verbatim), 2 × T2 — 0 × T4.
### ⚠️ Claim 4 is an absence, and Rule 2 binds it "The MCP Server page names no version" is a claim about a page, not about Microsoft's documentation. The body states the bound in its own sentence — read in full on 15 September 2026 — and explicitly declines the wider claim: release plans and update pages are separate documentation sets and were not searched. This is the failure shape that cost this repo two clusters: an absence found by reading one documentation set and then written as if it covered all of them. Bounded here on purpose, in the body and not only in the fact-check, because the lifted blocks travel without this table.
Status labels, and they are not interchangeable. The toolkit page carries "[This article is prerelease documentation and is subject to change.]" and "This is a preview feature" and describes the design capability as listed under "Production ready previews". Three different status words on one page. The MCP configuration page carries no preview notice — and this article therefore describes what that page shows rather than asserting a [GA] label of our own.
🔴 No pricing. Billing setup appears as a named prerequisite and nothing more. No rate, no pack size, no currency.
Version numbers appear in the lifted blocks deliberately. 27.2 and 28.1 are version numbers, on the importer's documented pass list alongside 10.0.46. For a lookup article whose entire subject is the version requirement, removing them would remove the answer.
No figures of ours. No volume, no accuracy, no customer, no result.
Rule 2b sweep — generated by `_audit/sweep.py`, not typed. Case-insensitive, whole-word, over the published span (--- DRAFT --- → ## Fact-check, both lifted blocks included): only ×15, all ×6, no ×5, is not ×4, nothing ×2, every ×2, never ×1, cannot ×1, does not ×1, none ×1, can't ×1, aren't ×1. `description` carries: all, no — swept against the body.
One hit was repaired rather than explained, per Rule 2c:
| hit | was | now |
|---|---|---|
| cannot | takeaway: "part-type API pages cannot be tools at all" | "Microsoft lists part-type API pages as not currently supported as tools" — Microsoft's sentence says "aren't currently supported". A statement of present scope had become a permanent one inside a lifted block, which is the exact drift Rule 2b exists to catch. The body sentence was tightened the same way |
Every remaining hit is bounded in its own sentence or is Microsoft's word. never names a version is bounded to that page's prerequisites — and the evidence is wider than the claim: a programmatic scan of the whole page returns zero version strings. none of them is bounded to the three items listed beside it. every exposed API page restates Microsoft's "all exposed Business Central API pages". does not describe your deployment is bounded to the page.
`validate-voice` reports 24 AVOID hits, all of them `tool` or `tools`, and all are Microsoft's. MCP tools, Dynamic Tool Mode, Unblock Edit Tools and "a limit of 70 tools" are Microsoft's own term of art for the MCP surface. The lexicon bans calling a Cognilium product a tool; it does not ban naming Microsoft's feature — permitted reason 1. No sentence in this article describes anything of ours as a tool.
Share this article
What Microsoft ships, what it does not, and the layer we build where a general assistant runs out.
