---
title: "Which Business Central version do you need for agents and MCP?"
canonical_url: "https://cognilium.ai/blogs/business-central-version-agents-mcp"
slug: "business-central-version-agents-mcp"
section: "blogs"
date_published: "2026-09-16"
date_modified: "2026-09-16"
word_count: 1289
reading_time_minutes: 6
author: "Mudassir Marwat"
author_identifier: "0009-0008-1927-2598"
person_same_as:
  - "https://www.linkedin.com/in/mudassir-marwat/"
  - "https://orcid.org/0009-0008-1927-2598"
  - "https://github.com/mudassirmarwat"
  - "https://medium.com/@mudassir-marwat"
  - "https://www.youtube.com/@mudassir-marwat"
  - "https://dev.to/mudassirmarwat"
  - "https://hashnode.com/@mudassirmarwat"
  - "https://huggingface.co/mudassirmarwat"
  - "https://bsky.app/profile/mudassir-marwat.bsky.social"
  - "https://substack.com/@mudassirmarwat"
  - "https://topmate.io/mudassirmarwat"
  - "https://fueler.io/mudassirmarwat"
  - "https://www.instagram.com/mudassirmarwat/"
  - "https://www.facebook.com/mudassir.marwat"
  - "https://www.reddit.com/user/mudassirmarwat/"
  - "https://www.f6s.com/member/mudassir-marwat"
  - "https://cognilium.ai/founder"
entities: []
related:
  - "https://cognilium.ai/blogs/sales-order-agent-business-central"
  - "https://cognilium.ai/blogs/expense-agent-business-central"
  - "https://cognilium.ai/blogs/business-central-agent-limitations"
---
# Which Business Central version do you need for agents and MCP?

Agents and the MCP server carry version and environment requirements. Which release you need, and which deployment types are excluded outright.

## Key takeaways

- The AI development toolkit is sandbox-only, from version 27.2; the Agent SDK for AL reaches production environments from version 28.1.
- The MCP Server configuration page states a deployment, not a release — Business Central online — so on-premises is simply outside what that page describes.
- Three permission sets matter, and the diagnostics one is what lets you see execution cost and the serialized page after something goes wrong.
- MCP access is read-only by default across all exposed API pages. Writing requires configuring it deliberately; the reach is broad from the start.
- The client imposes a tool ceiling, and Microsoft lists part-type API pages as not currently supported as tools. Both are published limits, not defects.

**There are three different answers, and one of them is not a version.** The Agent SDK for AL reaches production from version 28.1. The AI development toolkit needs a sandbox from version 27.2. **And Microsoft's MCP Server configuration page names no version at all** — its stated constraint is Business Central online.

## What does each piece actually require?

**Microsoft's own sentence covers two of the three in one line:**

> *"The AI development toolkit is available in **sandbox environments only**. The Agent SDK for AL is available in sandbox environments and, **starting from version 28.1, also in production environments**."*

**And the prerequisites list adds the floor for the sandbox itself:** *"A sandbox environment for testing and experimentation **from version 27.2** (can include customer data such as sandbox copies of production data)."*

**The parenthesis in that prerequisite is worth reading twice.** A sandbox *"can include customer data such as sandbox copies of production data"* — so the sandbox-only restriction limits where the agent runs, **not how real the data it runs against is.**

## Why does the MCP page name no version?

**Because its constraint is a deployment type, not a release.**

The configuration page opens with *"APPLIES TO: **Business Central online**"* and never names a version number anywhere in its prerequisites, which list exactly one item — a permission set.

> ### What this is, and what it is not  **It is a statement about that page**, read in full on 15 September 2026. **It is not a claim that no Microsoft page anywhere states a version for MCP.** Release plans and update pages are separate documentation sets, and this article has not searched them.

**What the online-only scope does settle is on-premises.** If your Business Central runs on your own servers, **the page that tells you how to configure the MCP Server does not describe your deployment**, and no amount of updating changes that — it is a different product line, not an older one.

## Which permissions do you need before any of it works?

**Three named permission sets, and they do different jobs.**

**The third one is the one people skip**, and it is the one you need at the worst moment. *Execution cost* and *the serialized page* are what you read when an agent did something you did not expect — and [the agent is driving pages rather than calling an API](/blogs/business-central-agent-drives-the-ui), so the serialized page is the closest thing to a trace of what it saw.

**Grant diagnostics at setup, not after the first surprise.**

## What else is a prerequisite besides a version?

**Three things, and none of them are a release number.**

**The capability has to be switched on.** *"Enable the **Custom Agent** capability in Business Central"* — and the design capability *"is listed under **Production ready previews**"* on the Copilot and agent capabilities page. **That is a status label doing real work**: production-ready preview is neither preview nor general availability, and the toolkit page carries its own prerelease notice — *"[This article is prerelease documentation and is subject to change.]"* and *"This is a preview feature."*

**Billing has to be set up.** *"Billing setup for agent capabilities in your tenant"* is listed as a prerequisite, not as an afterthought — [agents consume Copilot Credits as they work](/blogs/business-central-agent-copilot-credits).

**And the agent arrives switched off.** *"An agent is by default in the **Disabled** state. You must activate the agent to use it, but you can only activate it **after you have defined its purpose and tasks**."* **The platform will not let you enable an empty agent**, which is a small, sensible guard.

## What can an agent do through MCP by default?

**Read everything exposed, and change nothing.**

> *"**By default**, the MCP Server gives agents **read-only access to all exposed Business Central API pages**. This behavior means that without any extra setup in Business Central, agent makers can immediately create agents that read the data exposed by these APIs."*

**Writing is a deliberate act:** *"if you want to enable agents to create, modify, or delete entities and data, you must configure these operations on the MCP Server."*

**The switch that governs it is named, and its off position is absolute:** *Unblock Edit Tools* specifies whether tools *"can perform create, update, or delete operations… When turned off, **all these permissions are set to false making the tools read-only**."*

**Read that default carefully, though.** Read-only is safe for writes and says nothing about reach — the default exposes *all* API pages, so the first configuration decision is what an agent should be able to see, not only what it should be able to change.

## What catches people out?

**Two published constraints that look like bugs when you meet them cold.**

**There is a ceiling on tools, and it belongs to the client.** *"Copilot Studio currently has a limit of 70 tools. If you add all standard APIs as tools in the configuration, **only the first 70 are available** to agents you build in Copilot Studio."* Microsoft's answer is *Dynamic Tool Mode*, where *"agents search for tools within the configuration dynamically"* using three system tools — `bc_actions_search`, `bc_actions_describe` and `bc_actions_invoke`. **Silently getting the first seventy is a much worse failure than an error**, so check this before blaming a model.

**And not every API page can currently be a tool.** *"API pages of subtype **ListPart** and **CardPart** aren't currently supported as MCP tools. **Only top-level API pages** can be added to MCP Server configurations."* **If the data you want lives on a part, it needs a top-level API page first**, and that is [developer work rather than configuration](/blogs/agent-designer-business-central-limitations).

**About Cognilium** Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/

**Agentic ERP.** We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on **Azure OpenAI, Microsoft Fabric and Copilot Studio**. We build these on request, against your data and your environment.

**More on the boundary between what Copilot does and what you build:** [Agentic ERP on Dynamics 365](/erp-ai).

If you are scoping an agent against a specific environment, the version is the easy half — the permission sets and the default reach are where scopes go wrong. Bring your environment details to a 15-minute call.

## Sources

- [Configure Business Central MCP Server](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/ai/configure-mcp-server) · **fetched and read in full 2026-09-15** · page states *Last updated on 2026-05-03*
- [Create and activate an agent (preview)](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/ai/ai-development-toolkit-agent-create) · **fetched and read in full 2026-09-15** · page states *Last updated on 2026-05-03*

## Fact-check

**Tier summary:** 13 × T1 (all verbatim), 2 × T2 — **0 × T4.**

> ### ⚠️ Claim 4 is an absence, and Rule 2 binds it  *"The MCP Server page names no version"* is a claim about a page, **not about Microsoft's documentation**. The body states the bound in its own sentence — *read in full on 15 September 2026* — and explicitly declines the wider claim: **release plans and update pages are separate documentation sets and were not searched.**  **This is the failure shape that cost this repo two clusters**: an absence found by reading one documentation set and then written as if it covered all of them. **Bounded here on purpose, in the body and not only in the fact-check**, because the lifted blocks travel without this table.

**Status labels, and they are not interchangeable.** The toolkit page carries *"[This article is prerelease documentation and is subject to change.]"* **and** *"This is a preview feature"* **and** describes the design capability as listed under *"Production ready previews"*. **Three different status words on one page.** The MCP configuration page carries **no** preview notice — and this article therefore describes what that page shows rather than asserting a `[GA]` label of our own.

**🔴 No pricing.** Billing setup appears as a named prerequisite and nothing more. **No rate, no pack size, no currency.**

**Version numbers appear in the lifted blocks deliberately.** `27.2` and `28.1` are version numbers, on the importer's documented pass list alongside `10.0.46`. **For a lookup article whose entire subject is the version requirement, removing them would remove the answer.**

**No figures of ours.** No volume, no accuracy, no customer, no result.

**Rule 2b sweep — generated by `_audit/sweep.py`, not typed.** Case-insensitive, whole-word, over the published span (`--- DRAFT ---` → `## Fact-check`, both lifted blocks included): `only` ×15, `all` ×6, `no` ×5, `is not` ×4, `nothing` ×2, `every` ×2, `never` ×1, `cannot` ×1, `does not` ×1, `none` ×1, `can't` ×1, `aren't` ×1. **`description` carries:** `all`, `no` — swept against the body.

**One hit was repaired rather than explained**, per Rule 2c:

**Every remaining hit is bounded in its own sentence or is Microsoft's word.** *never names a version* is bounded to that page's prerequisites — **and the evidence is wider than the claim**: a programmatic scan of the whole page returns zero version strings. *none of them* is bounded to the three items listed beside it. *every exposed API page* restates Microsoft's *"all exposed Business Central API pages"*. *does not describe your deployment* is bounded to the page.

**`validate-voice` reports 24 AVOID hits, all of them `tool` or `tools`, and all are Microsoft's.** *MCP tools*, *Dynamic Tool Mode*, *Unblock Edit Tools* and *"a limit of 70 tools"* are Microsoft's own term of art for the MCP surface. **The lexicon bans calling a Cognilium product a tool; it does not ban naming Microsoft's feature** — permitted reason 1. **No sentence in this article describes anything of ours as a tool.**

## Frequently asked questions

### What does each piece actually require?

Microsoft's own sentence covers two of the three in one line:

### Why does the MCP page name no version?

The configuration page opens with "APPLIES TO: Business Central online" and never names a version number anywhere in its prerequisites, which list exactly one item — a permission set.

### Which permissions do you need before any of it works?

The third one is the one people skip, and it is the one you need at the worst moment. Execution cost and the serialized page are what you read when an agent did something you did not expect — and the agent is driving pages rather than calling an API, so the serialized page is the closest thing to a trace of what it saw.

### What else is a prerequisite besides a version?

The capability has to be switched on. "Enable the Custom Agent capability in Business Central" — and the design capability "is listed under Production ready previews" on the Copilot and agent capabilities page. That is a status label doing real work: production-ready preview is neither preview nor general availability, and the toolkit page carries its own prerelease notice — "[This article is prerelease documentation and is subject to change.]" and "This is a preview feature."

### What can an agent do through MCP by default?

Writing is a deliberate act: "if you want to enable agents to create, modify, or delete entities and data, you must configure these operations on the MCP Server."

### What catches people out?

Two published constraints that look like bugs when you meet them cold.

---

Canonical HTML: https://cognilium.ai/blogs/business-central-version-agents-mcp