TL;DR
Three words used interchangeably that mean three different things in Business Central. The distinction is the permission boundary, not the marketing.
Sort them by two questions: where does the thing run, and whose identity does it use? Copilot runs inside Business Central as you. An agent runs inside Business Central as itself. A Copilot Studio agent runs outside and reaches in. Everything else is vocabulary.
What are the two questions that sort them?
Where it runs, and whose identity it acts under. Those two answers place the products in this space and predict much of what matters about them — who can start it, what it can reach, what the audit trail says, and who has to review its output.
They are better questions than "how autonomous is it?" because autonomy has no agreed measure, while location and identity are facts a vendor documents. Both of ours are documented.
Which of these actually exist as named products?
Three, and Microsoft names and documents each one.
| Thing | Where it runs | Whose identity |
|---|---|---|
| Copilot in Business Central | inside Business Central, in your session | yours — "inherits their data permissions" |
| A Business Central agent | inside Business Central, in the background | its own — "considered as a user… assigned permission sets", capped at its creator's |
| A Copilot Studio agent | outside Business Central, reaching in | yours, over MCP — "All operations are performed with your user identity and permissions" |
The third row is the one people have not internalised. A Copilot Studio agent is not a Business Central feature that happens to be configured elsewhere. It is a separate application that connects to your environment, and Microsoft documents it as such.
What is a Copilot Studio agent, exactly?
Microsoft's own description is refreshingly unmystical:
"Copilot Studio is a graphical, low-code tool for building agents and agent flows. You can use it to create conversational agents that understand and act on your business processes and data model in Business Central."
What those agents can do is stated plainly too: they "present Business Central data (customers, orders, invoices, and inventory) and business logic to users via natural language", and they "can automate tasks such as creating sales orders, checking credit, or posting payments, and trigger approvals or flows."
And crucially, where they end up:
"After you create an agent, you can publish agents into multiple platforms or channels, like live websites and Microsoft Copilot, or messaging platforms like Teams and Facebook."
Read that last item and the architecture explains itself. A thing that can be published to Facebook is not running inside your ERP. It is an application that talks to your ERP — which is exactly why its identity question resolves to yours, over a connection, rather than to an assigned permission set.
Connector or MCP — how does it reach in?
Two documented routes, and Microsoft gives a one-line rule for choosing.
"Business Central provides two model-aware tools that agents can use to interact directly with Business Central environments: Business Central MCP (Model Context Protocol) server and Business Central Connector for Power Platform."
| Business Central Connector | Business Central MCP Server | |
|---|---|---|
| What it is | "part of the Power Platform framework", a "simplified, low-code interface" | "access to Business Central through standard and custom API pages" |
| Suits | "simple CRUD… using predefined actions while acting as the user (respecting their Business Central permissions)" | "coordinate multiple AI-driven steps… into one seamless, automated workflow (AI orchestration)" |
| Trade-off | "abstracts away many of the API details, making it easier to use but less flexible" | "performance, scalability, or security policies require direct API management" |
Microsoft's summary is four words long each way:
"Connector: For standard integration and automation MCP server: For AI agents only"
And you are not required to pick one. The page says explicitly that "You can also use both options together" — which is the sensible answer more often than either column alone.
Where does "agentic workflow" fit?
It is industry vocabulary, and it is worth saying so.
### Whose word is this? Across the nine pages behind this cluster, the phrase "agentic workflow" appears on none of them. Microsoft's nearest named things are agent flows in Copilot Studio and what it calls AI orchestration — "coordinate multiple AI-driven steps… into one seamless, automated workflow".
So when someone says "agentic workflow", ask the two questions. Usually they mean AI orchestration: several steps, chosen at run time rather than hard-coded, with a model deciding the order. That is a real thing and Microsoft describes it — it simply is not a product name.
The distinction that survives is the honest one. A workflow with a model in it is still a workflow; what makes it agentic is that the sequence is decided as it runs, which is precisely the property Microsoft contrasts with "static workflows or hard-coded AL logic."
How do you sort something you have not seen before?
Ask the two questions, in order.
- Where does it run? Inside the ERP, or outside it reaching in? That settles who administers it, where its logs live, and which team owns the incident.
- Whose identity does it act under? Yours, or its own? That settles the security review, the audit trail, and what happens when the person who set it up leaves.
If a vendor cannot answer both in one sentence each, the product is not ready for a security review, whatever it is called. And if they can, the name stops mattering — you already know how to reason about it.
About Cognilium Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/
Agentic ERP. We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on Azure OpenAI, Microsoft Fabric and Copilot Studio. We build these on request, against your data and your environment.
More on the boundary between what Copilot does and what you build: Agentic ERP on Dynamics 365.
If you have a proposal in front of you and cannot tell which of these it is, bring it to a 15-minute call and we will place it in two questions.
Sources
- Create agents in Copilot Studio that connect to Business Central · fetched and read in full 2026-09-15
- Model Context Protocol (MCP) in Business Central overview · fetched and read in full 2026-09-15 · Last updated on 2026-06-17
- Copilot FAQ — Business Central · fetched and read in full 2026-09-15
- Create and activate an agent (preview) — Business Central · fetched and read in full 2026-09-15
Sources and fact-check
| # | § | Claim | Tier | Primary source | Verdict |
|---|---|---|---|---|---|
| 1 | 1 | The two sorting questions | T2 — ours, a method. Presented as a way to reason, not as a Microsoft framework | — | PASS |
| 2 | 2 | Copilot "inherits their data permissions" | T1 — verbatim | Copilot FAQ | PASS |
| 3 | 2 | An agent "considered as a user… assigned permission sets" | T1 — verbatim | Toolkit agent page | PASS |
| 4 | 2 | Over MCP, "All operations are performed with your user identity and permissions" | T1 — verbatim | mcp-overview | PASS |
| 5 | 3 | "Copilot Studio is a graphical, low-code tool for building agents and agent flows…" | T1 — verbatim | Copilot Studio page | PASS |
| 6 | 3 | What those agents present and do — data, business logic, sales orders, credit checks, posting payments | T1 — verbatim ×2 | Copilot Studio page | PASS |
| 7 | 3 | "publish agents into multiple platforms or channels, like live websites and Microsoft Copilot, or messaging platforms like Teams and Facebook" | T1 — verbatim | Copilot Studio page | PASS |
| 8 | 3 | A thing publishable to Facebook is not running inside the ERP | T2 — ours, an inference from claim 7, and it reads as reasoning | — | PASS |
| 9 | 4 | "two model-aware tools" — MCP server and the Power Platform connector | T1 — verbatim, with one typographic normalisation recorded below | Copilot Studio page | PASS |
| 10 | 4 | The comparison rows, each cell quoted | T1 — verbatim ×5 | Copilot Studio page | PASS |
| 11 | 4 | "Connector: For standard integration and automation / MCP server: For AI agents only" | T1 — verbatim | Copilot Studio page | PASS |
| 12 | 4 | "You can also use both options together" | T1 — verbatim | Copilot Studio page | PASS |
| 13 | 5 | "Agentic workflow" appears on none of the nine pages behind this cluster | T1 for the test that ran, BOUNDED to those nine pages and stated so in the body. Programmatic search across all nine fetched sources | All cluster sources | PASS — see the bounding note |
| 14 | 5 | Microsoft's nearest terms are agent flows and AI orchestration | T1 — verbatim ×2 | Copilot Studio page | PASS |
| 15 | 5 | "static workflows or hard-coded AL logic" as the contrast | T1 — verbatim | Release plan, re-read 2026-09-15 | PASS |
| 16 | 6 | The two questions as a procurement test | T2 — ours, advice | — | PASS |
Tier summary: 12 × T1 (all verbatim), 4 × T2 — 0 × T4.
### ⚠️ Claim 13 is an absence and is bounded twice "Agentic workflow is not Microsoft's phrase" would be refuted by one link. The body says "across the nine pages behind this cluster", which is the search that actually ran — every Microsoft and protocol page fetched for this cluster, checked programmatically rather than by recollection. It is not a claim that Microsoft has never used the phrase. The bound is in the body and not only in this table, because the lifted blocks travel without the table. This is the second CITE article in this cluster to run that check — ch17 ran it for "agentic ERP" — and running it costs one command.
One typographic normalisation, recorded rather than silently made. Microsoft's page spells it model‑aware with a non-breaking hyphen (U+2011), not an ASCII hyphen. This article uses the ASCII hyphen so the text imports and searches predictably. The wording is unchanged; only the hyphen character differs, and the verbatim check was re-run with that single substitution so nothing else could hide behind it.
No competitor is named or knocked. The comparison in §4 is between two of Microsoft's own routes into its own product, quoted from Microsoft's own page, including Microsoft's own recommendation to use both.
🔴 No pricing. No rate, pack, total or currency anywhere.
No figures of ours. No volume, no accuracy, no customer, no result.
Rule 2b sweep — generated by `_audit/sweep.py`, not typed. Case-insensitive, whole-word, over the published span (--- DRAFT --- → ## Fact-check, both lifted blocks included): is not ×6, cannot ×2, only ×1, all ×1, none ×1, no ×1, can't ×1. `description` and `title` carry no absolute terms.
Two hits were repaired rather than explained, per Rule 2c — and both are the unmeasured-claim class this cluster keeps producing:
| hit | was | now |
|---|---|---|
| every · most | "place every product in this space and predict most of what matters" | "place the products in this space and predict much of what matters" — a universal about products we have not seen |
| nobody | "autonomy is a spectrum nobody measures the same way" | "autonomy has no agreed measure" — the narrower statement is also the defensible one |
`validate-voice` reports three AVOID hits, all `automate`/`automated`, and all three sit inside Microsoft quotations — "can automate tasks such as creating sales orders" and "into one seamless, automated workflow (AI orchestration)". *The gate reads blockquotes but not inline `"…"` quotations or table cells*, so it files them under our prose. Kept as quoted; permitted reason 2.
Share this article
What Microsoft ships, what it does not, and the layer we build where a general assistant runs out.
