--- title: "Why Microsoft's Dynamics 365 agents stumble on your customized F&O — and the last-mile fix" canonical_url: "https://cognilium.ai/blogs/dynamics-365-agents-customized-fo-last-mile-mcp" slug: "dynamics-365-agents-customized-fo-last-mile-mcp" section: "blogs" date_published: "2026-10-12" date_modified: "2026-10-12" word_count: 678 reading_time_minutes: 3 author: "Mudassir Marwat" author_identifier: "0009-0008-1927-2598" person_same_as: - "https://www.linkedin.com/in/mudassir-marwat/" - "https://orcid.org/0009-0008-1927-2598" - "https://github.com/mudassirmarwat" - "https://medium.com/@mudassir-marwat" - "https://www.youtube.com/@mudassir-marwat" - "https://dev.to/mudassirmarwat" - "https://hashnode.com/@mudassirmarwat" - "https://huggingface.co/mudassirmarwat" - "https://bsky.app/profile/mudassir-marwat.bsky.social" - "https://substack.com/@mudassirmarwat" - "https://topmate.io/mudassirmarwat" - "https://fueler.io/mudassirmarwat" - "https://www.instagram.com/mudassirmarwat/" - "https://www.facebook.com/mudassir.marwat" - "https://www.reddit.com/user/mudassirmarwat/" - "https://www.f6s.com/member/mudassir-marwat" - "https://cognilium.ai/founder" entities: [] related: [] --- # Why Microsoft's Dynamics 365 agents stumble on your customized F&O — and the last-mile fix Microsoft's ERP agents work beautifully on standard Finance & Operations — and stall on the X++ and ISV customizations that make your estate yours. Here's the last-mile fix: exposing your logic as governed MCP Action tools. Microsoft's Dynamics 365 agents are genuinely good, and they're getting better fast. The Account Reconciliation Agent, the Finance Agent, the supply-chain procurement agent, the Business Central Payables and Expense agents — on **standard** Finance & Operations, they do real work. The word doing the heavy lifting there is *standard*. Almost no enterprise runs standard F&O. Over years, your estate accumulated the thing that makes it yours: X++ customizations, ISV solutions, bespoke approval routing, custom tables and entities, process logic that encodes how *your* business actually runs. And that is precisely where a generic agent stalls — because it only knows the out-of-the-box surface, and the decision it needs to make lives in the custom logic it can't see or safely call. This is the last mile of agentic ERP, and it's where most agent projects quietly fail. ## Why generic agents can't reach your customizations A first-party or generic agent reasons over the capabilities it's been given. On standard F&O those are rich. But your customizations are, to that agent, invisible: - It doesn't know your custom entity exists, so it can't read from it. - It doesn't know your ISV's logic is what actually computes the result, so it works around it — or gets it wrong. - It can't call your X++ business logic safely, so it either can't complete the task or does something adjacent that looks right and isn't. - And if it *could* reach them, doing so without scoping and governance would be the exact exposure that makes IT refuse to turn agents on at all. So you get the frustrating half-outcome: the agent handles the textbook cases and hands back everything that touches the custom process — which, in a real estate, is most of what mattered. ## The fix: expose your logic as governed MCP Action tools The last-mile fix is to make your customizations *callable* by the agent — safely, explicitly, and inside your security roles. In Dynamics terms, that means exposing the specific operations the agent needs — read this custom entity, run this validated piece of business logic, write back to this customized record — as **governed MCP Action tools.** Done properly, each Action tool is: - **Specific and typed** — a defined operation ("create a quote line from this request", "validate this PO against the custom approval rule"), not "do anything in F&O." - **Permissioned inside your security roles** — the agent gets exactly the operations it's allowed, no more. This is also the governance answer: scope at the action layer, don't hand over the whole surface. (See [the Dynamics 365 agent governance gap](/blogs/dynamics-365-agent-governance-gap-close-it-first) for why that matters.) - **Approval-gated where it should be** — the agent prepares; a person approves anything irreversible before it posts. - **Built on the supported integration surface** — it never alters the ERP core (see [Dynamics 365 integration patterns](/dynamics-365/integration)). The result: Microsoft's agents — and your own — can finally do real work on *your* F&O, not a hypothetical standard one. The custom logic that used to be a dead end becomes a tool the agent can call, under control. ## Why this is an engineering job, not a configuration one Exposing X++ and ISV logic as governed, typed, permissioned actions is not a toggle in a setup screen. It needs someone who understands **both halves**: the agent side (what an action tool is, how an agent plans over it, where to put the human-in-the-loop) and the ERP side (your data model, the supported surface, how your customizations and your ISV solutions actually behave). That pairing — production AI engineering plus genuine F&O depth — is rare, and it's exactly the seam where generic offerings can't follow and depth shows. This is the work we do: the [MCP server for Dynamics 365](/dynamics-365/mcp-server) that turns your customized estate into a set of governed actions an agent can safely use. If your F&O is customized and Microsoft's agents keep handing back the cases that matter, [tell us what your customizations and ISV solutions look like](/contact) — the first conversation is about which of them an agent could safely reach, and what it would take. ## Frequently asked questions ### Why don't Microsoft's Dynamics 365 agents work well on our customized F&O? Generic agents reason over the standard, out-of-the-box surface. Your X++ customizations, ISV logic and custom entities are invisible to them, so they handle textbook cases and hand back anything that touches your custom process — which is usually what mattered. ### What are MCP Action tools in Dynamics 365? Specific, typed, permissioned operations that expose your customizations — read a custom entity, run validated business logic, write to a customized record — so an agent can call them safely, inside your security roles and behind approval where needed. ### Does exposing customizations to an agent create a security risk? Not if it's done right. Each Action tool is scoped to a specific operation and sits inside your security roles, so the agent gets exactly what it's allowed — which is safer than handing it the full user surface. ### Will this change our ERP core? No. Action tools are built on the platform's supported integration surface and never alter core ERP logic. ### Is this configuration or engineering? Engineering. Turning X++ and ISV logic into governed, typed, permissioned actions needs someone fluent in both the agent side and the F&O side — it's not a setup-screen toggle. --- Canonical HTML: https://cognilium.ai/blogs/dynamics-365-agents-customized-fo-last-mile-mcp