Why Microsoft's Dynamics 365 agents stumble on your customized F&O — and the last-mile fix

Microsoft's Dynamics 365 agents are genuinely good, and they're getting better fast. The Account Reconciliation Agent, the Finance Agent, the supply-chain procurement agent, the Business Central Payables and Expense agents — on standard Finance & Operations, they do real work.

The word doing the heavy lifting there is standard.

Almost no enterprise runs standard F&O. Over years, your estate accumulated the thing that makes it yours: X++ customizations, ISV solutions, bespoke approval routing, custom tables and entities, process logic that encodes how your business actually runs. And that is precisely where a generic agent stalls — because it only knows the out-of-the-box surface, and the decision it needs to make lives in the custom logic it can't see or safely call.

This is the last mile of agentic ERP, and it's where most agent projects quietly fail.

Why generic agents can't reach your customizations

A first-party or generic agent reasons over the capabilities it's been given. On standard F&O those are rich. But your customizations are, to that agent, invisible:

• It doesn't know your custom entity exists, so it can't read from it.
• It doesn't know your ISV's logic is what actually computes the result, so it works around it — or gets it wrong.
• It can't call your X++ business logic safely, so it either can't complete the task or does something adjacent that looks right and isn't.
• And if it could reach them, doing so without scoping and governance would be the exact exposure that makes IT refuse to turn agents on at all.

So you get the frustrating half-outcome: the agent handles the textbook cases and hands back everything that touches the custom process — which, in a real estate, is most of what mattered.

The fix: expose your logic as governed MCP Action tools

The last-mile fix is to make your customizations callable by the agent — safely, explicitly, and inside your security roles. In Dynamics terms, that means exposing the specific operations the agent needs — read this custom entity, run this validated piece of business logic, write back to this customized record — as governed MCP Action tools.

Done properly, each Action tool is:

• Specific and typed — a defined operation ("create a quote line from this request", "validate this PO against the custom approval rule"), not "do anything in F&O."
• Permissioned inside your security roles — the agent gets exactly the operations it's allowed, no more. This is also the governance answer: scope at the action layer, don't hand over the whole surface. (See the Dynamics 365 agent governance gap for why that matters.)
• Approval-gated where it should be — the agent prepares; a person approves anything irreversible before it posts.
• Built on the supported integration surface — it never alters the ERP core (see Dynamics 365 integration patterns).

The result: Microsoft's agents — and your own — can finally do real work on your F&O, not a hypothetical standard one. The custom logic that used to be a dead end becomes a tool the agent can call, under control.

Why this is an engineering job, not a configuration one

Exposing X++ and ISV logic as governed, typed, permissioned actions is not a toggle in a setup screen. It needs someone who understands both halves: the agent side (what an action tool is, how an agent plans over it, where to put the human-in-the-loop) and the ERP side (your data model, the supported surface, how your customizations and your ISV solutions actually behave). That pairing — production AI engineering plus genuine F&O depth — is rare, and it's exactly the seam where generic offerings can't follow and depth shows.

This is the work we do: the MCP server for Dynamics 365 that turns your customized estate into a set of governed actions an agent can safely use.

If your F&O is customized and Microsoft's agents keep handing back the cases that matter, tell us what your customizations and ISV solutions look like — the first conversation is about which of them an agent could safely reach, and what it would take.