Back to Blog
Published:
Last Updated:
Fresh Content
Copilot BoundaryChapter 19

Copilot, agent or agentic workflow — which is which?

5 min read
1,172 words
high priority
Ali Ahmed

Ali Ahmed

AI Solutions Engineer, Cognilium AI

TL;DR

Three words used interchangeably that mean three different things in Business Central. The distinction is the permission boundary, not the marketing.

Sort them by two questions: where does the thing run, and whose identity does it use? Copilot runs inside Business Central as you. An agent runs inside Business Central as itself. A Copilot Studio agent runs outside and reaches in. Everything else is vocabulary.

What are the two questions that sort them?

Where it runs, and whose identity it acts under. Those two answers place the products in this space and predict much of what matters about them — who can start it, what it can reach, what the audit trail says, and who has to review its output.

They are better questions than "how autonomous is it?" because autonomy has no agreed measure, while location and identity are facts a vendor documents. Both of ours are documented.

Which of these actually exist as named products?

Three, and Microsoft names and documents each one.

ThingWhere it runsWhose identity
Copilot in Business Centralinside Business Central, in your sessionyours — "inherits their data permissions"
A Business Central agentinside Business Central, in the backgroundits own — "considered as a user… assigned permission sets", capped at its creator's
A Copilot Studio agentoutside Business Central, reaching inyours, over MCP — "All operations are performed with your user identity and permissions"

The third row is the one people have not internalised. A Copilot Studio agent is not a Business Central feature that happens to be configured elsewhere. It is a separate application that connects to your environment, and Microsoft documents it as such.

What is a Copilot Studio agent, exactly?

Microsoft's own description is refreshingly unmystical:

"Copilot Studio is a graphical, low-code tool for building agents and agent flows. You can use it to create conversational agents that understand and act on your business processes and data model in Business Central."

What those agents can do is stated plainly too: they "present Business Central data (customers, orders, invoices, and inventory) and business logic to users via natural language", and they "can automate tasks such as creating sales orders, checking credit, or posting payments, and trigger approvals or flows."

And crucially, where they end up:

"After you create an agent, you can publish agents into multiple platforms or channels, like live websites and Microsoft Copilot, or messaging platforms like Teams and Facebook."

Read that last item and the architecture explains itself. A thing that can be published to Facebook is not running inside your ERP. It is an application that talks to your ERP — which is exactly why its identity question resolves to yours, over a connection, rather than to an assigned permission set.

Connector or MCP — how does it reach in?

Two documented routes, and Microsoft gives a one-line rule for choosing.

"Business Central provides two model-aware tools that agents can use to interact directly with Business Central environments: Business Central MCP (Model Context Protocol) server and Business Central Connector for Power Platform."
Business Central ConnectorBusiness Central MCP Server
What it is"part of the Power Platform framework", a "simplified, low-code interface""access to Business Central through standard and custom API pages"
Suits"simple CRUD… using predefined actions while acting as the user (respecting their Business Central permissions)""coordinate multiple AI-driven steps… into one seamless, automated workflow (AI orchestration)"
Trade-off"abstracts away many of the API details, making it easier to use but less flexible""performance, scalability, or security policies require direct API management"

Microsoft's summary is four words long each way:

"Connector: For standard integration and automation MCP server: For AI agents only"

And you are not required to pick one. The page says explicitly that "You can also use both options together" — which is the sensible answer more often than either column alone.

Where does "agentic workflow" fit?

It is industry vocabulary, and it is worth saying so.

### Whose word is this? Across the nine pages behind this cluster, the phrase "agentic workflow" appears on none of them. Microsoft's nearest named things are agent flows in Copilot Studio and what it calls AI orchestration"coordinate multiple AI-driven steps… into one seamless, automated workflow".

So when someone says "agentic workflow", ask the two questions. Usually they mean AI orchestration: several steps, chosen at run time rather than hard-coded, with a model deciding the order. That is a real thing and Microsoft describes it — it simply is not a product name.

The distinction that survives is the honest one. A workflow with a model in it is still a workflow; what makes it agentic is that the sequence is decided as it runs, which is precisely the property Microsoft contrasts with "static workflows or hard-coded AL logic."

How do you sort something you have not seen before?

Ask the two questions, in order.

  1. Where does it run? Inside the ERP, or outside it reaching in? That settles who administers it, where its logs live, and which team owns the incident.
  2. Whose identity does it act under? Yours, or its own? That settles the security review, the audit trail, and what happens when the person who set it up leaves.

If a vendor cannot answer both in one sentence each, the product is not ready for a security review, whatever it is called. And if they can, the name stops mattering — you already know how to reason about it.

About Cognilium Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/

Agentic ERP. We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on Azure OpenAI, Microsoft Fabric and Copilot Studio. We build these on request, against your data and your environment.

More on the boundary between what Copilot does and what you build: Agentic ERP on Dynamics 365.

If you have a proposal in front of you and cannot tell which of these it is, bring it to a 15-minute call and we will place it in two questions.

Sources

Sources and fact-check
#§ClaimTierPrimary sourceVerdict
11The two sorting questionsT2 — ours, a method. Presented as a way to reason, not as a Microsoft frameworkPASS
22Copilot "inherits their data permissions"T1 — verbatimCopilot FAQPASS
32An agent "considered as a user… assigned permission sets"T1 — verbatimToolkit agent pagePASS
42Over MCP, "All operations are performed with your user identity and permissions"T1 — verbatimmcp-overviewPASS
53"Copilot Studio is a graphical, low-code tool for building agents and agent flows…"T1 — verbatimCopilot Studio pagePASS
63What those agents present and do — data, business logic, sales orders, credit checks, posting paymentsT1 — verbatim ×2Copilot Studio pagePASS
73"publish agents into multiple platforms or channels, like live websites and Microsoft Copilot, or messaging platforms like Teams and Facebook"T1 — verbatimCopilot Studio pagePASS
83A thing publishable to Facebook is not running inside the ERPT2 — ours, an inference from claim 7, and it reads as reasoningPASS
94"two model-aware tools" — MCP server and the Power Platform connectorT1 — verbatim, with one typographic normalisation recorded belowCopilot Studio pagePASS
104The comparison rows, each cell quotedT1 — verbatim ×5Copilot Studio pagePASS
114"Connector: For standard integration and automation / MCP server: For AI agents only"T1 — verbatimCopilot Studio pagePASS
124"You can also use both options together"T1 — verbatimCopilot Studio pagePASS
135"Agentic workflow" appears on none of the nine pages behind this clusterT1 for the test that ran, BOUNDED to those nine pages and stated so in the body. Programmatic search across all nine fetched sourcesAll cluster sourcesPASS — see the bounding note
145Microsoft's nearest terms are agent flows and AI orchestrationT1 — verbatim ×2Copilot Studio pagePASS
155"static workflows or hard-coded AL logic" as the contrastT1 — verbatimRelease plan, re-read 2026-09-15PASS
166The two questions as a procurement testT2 — ours, advicePASS

Tier summary: 12 × T1 (all verbatim), 4 × T2 — 0 × T4.

### ⚠️ Claim 13 is an absence and is bounded twice "Agentic workflow is not Microsoft's phrase" would be refuted by one link. The body says "across the nine pages behind this cluster", which is the search that actually ran — every Microsoft and protocol page fetched for this cluster, checked programmatically rather than by recollection. It is not a claim that Microsoft has never used the phrase. The bound is in the body and not only in this table, because the lifted blocks travel without the table. This is the second CITE article in this cluster to run that check — ch17 ran it for "agentic ERP" — and running it costs one command.

One typographic normalisation, recorded rather than silently made. Microsoft's page spells it model‑aware with a non-breaking hyphen (U+2011), not an ASCII hyphen. This article uses the ASCII hyphen so the text imports and searches predictably. The wording is unchanged; only the hyphen character differs, and the verbatim check was re-run with that single substitution so nothing else could hide behind it.

No competitor is named or knocked. The comparison in §4 is between two of Microsoft's own routes into its own product, quoted from Microsoft's own page, including Microsoft's own recommendation to use both.

🔴 No pricing. No rate, pack, total or currency anywhere.

No figures of ours. No volume, no accuracy, no customer, no result.

Rule 2b sweep — generated by `_audit/sweep.py`, not typed. Case-insensitive, whole-word, over the published span (--- DRAFT ---## Fact-check, both lifted blocks included): is not ×6, cannot ×2, only ×1, all ×1, none ×1, no ×1, can't ×1. `description` and `title` carry no absolute terms.

Two hits were repaired rather than explained, per Rule 2c — and both are the unmeasured-claim class this cluster keeps producing:

hitwasnow
every · most"place every product in this space and predict most of what matters""place the products in this space and predict much of what matters" — a universal about products we have not seen
nobody"autonomy is a spectrum nobody measures the same way""autonomy has no agreed measure" — the narrower statement is also the defensible one

`validate-voice` reports three AVOID hits, all `automate`/`automated`, and all three sit inside Microsoft quotations"can automate tasks such as creating sales orders" and "into one seamless, automated workflow (AI orchestration)". *The gate reads blockquotes but not inline `"…"` quotations or table cells*, so it files them under our prose. Kept as quoted; permitted reason 2.

Share this article

The work behind this series

What Microsoft ships, what it does not, and the layer we build where a general assistant runs out.

Ali Ahmed

Ali Ahmed

AI Solutions Engineer, Cognilium AI

Ali Ahmed is an AI Solutions Engineer at Cognilium AI.

Applied AI AgentsAgentic SystemsRetrieval-Augmented Generation (RAG)LLM Product Engineering
Next in this series
What is an AI agent in Business Central, in plain terms?
Chapter 20 · 6 min
In short

Key takeaways

  • Two questions sort this whole space: where does the thing run, and whose identity does it act under? Both are documented facts; autonomy is not.
  • Copilot runs inside Business Central under your permissions. A Business Central agent runs inside it under its own. A Copilot Studio agent runs outside and reaches in under yours.
  • A Copilot Studio agent is a separate application, not an ERP feature — Microsoft documents publishing it to websites, Teams and other messaging platforms.
  • Two documented routes reach in: the Power Platform connector and the MCP server, and Microsoft says you can use both together.
  • "Agentic workflow" is industry vocabulary. Microsoft's nearest named things are agent flows and AI orchestration, and what makes a workflow agentic is that the sequence is decided as it runs.
What goes wrong

Common mistakes to avoid

  • Sorting these by how autonomous they sound. Sort by where they run and whose identity they use.
  • Treating a Copilot Studio agent as a Business Central feature. It is an application that connects to your environment and can be published to external channels.
  • Choosing connector or MCP as though it were exclusive. Microsoft documents using both together.
  • Accepting "agentic" as a specification. Ask which steps are decided at run time and which are fixed.

Terms in this article

Definitions in the Cognilium glossary.

Frequently Asked Questions

Find answers to common questions about the topics covered in this article.

Still have questions?

Get in touch with our team for personalized assistance.

Contact Us

Still have a question this did not answer?

The person who wrote this article answers these. Describe your setup and what you are stuck on — you will get a straight answer, including where we think the approach is wrong.