---
title: "Is your Dynamics 365 F&O ready for AI agents?"
canonical_url: "https://cognilium.ai/blogs/is-your-dynamics-365-ready-for-ai-agents"
slug: "is-your-dynamics-365-ready-for-ai-agents"
section: "blogs"
date_published: "2026-10-21"
date_modified: "2026-10-21"
word_count: 1256
reading_time_minutes: 6
author: "Mudassir Marwat"
author_identifier: "0009-0008-1927-2598"
person_same_as:
  - "https://www.linkedin.com/in/mudassir-marwat/"
  - "https://orcid.org/0009-0008-1927-2598"
  - "https://github.com/mudassirmarwat"
  - "https://medium.com/@mudassir-marwat"
  - "https://www.youtube.com/@mudassir-marwat"
  - "https://dev.to/mudassirmarwat"
  - "https://hashnode.com/@mudassirmarwat"
  - "https://huggingface.co/mudassirmarwat"
  - "https://bsky.app/profile/mudassir-marwat.bsky.social"
  - "https://substack.com/@mudassirmarwat"
  - "https://topmate.io/mudassirmarwat"
  - "https://fueler.io/mudassirmarwat"
  - "https://www.instagram.com/mudassirmarwat/"
  - "https://www.facebook.com/mudassir.marwat"
  - "https://www.reddit.com/user/mudassirmarwat/"
  - "https://www.f6s.com/member/mudassir-marwat"
  - "https://cognilium.ai/founder"
entities: []
related: []
---
# Is your Dynamics 365 F&O ready for AI agents?

Six checks in the order that blocks a project. Version and tier are binary. The two that stop most pilots are who may connect and who owns the identity.

## Key takeaways

- Run the binary checks first and the organisational ones early. Version and tier take a minute; identity ownership and connection approval take weeks.
- Confirm the version of the environment you will pilot in, not production. The server is enabled per environment.
- Connecting is an allow-list controlled by an administrator, and the default set is short. That decision has an owner who is probably not on the project.
- Decide whose identity acts before you design. If the people the process depends on have no ERP identity, you need the autonomous pattern and a mediated confirmation.
- Validate segregation of duties after assigning roles. Microsoft states that compliance is not verified at creation.
- Decide where the agent's working record is retained. The server stores nothing, so retention follows your client.

**Six checks, in the order that actually blocks a project.** The version and environment tier come first because they are binary — you either pass or you do not. **The two that stop most pilots sit further down**: who is allowed to connect, and whether anybody owns the agent identity.

## Why does the order matter?

**Because the binary checks are cheap and the organisational ones are slow.**

A version check takes a minute. **Working out who approves a new agent identity, and who reviews its roles, can take weeks** — and it is not technical work, so it rarely gets started until someone notices it is on the critical path.

**Run them in this order and you discover the expensive problems first**, while there is still time to move them.

## Checks 1 and 2 — the version and the environment

**These are published requirements and they are absolute.**

The ERP MCP server has a version floor and an environment-type constraint. **We have covered both in detail already** — the floor, the acceptable quality updates, the tier requirement, and the environment types that are excluded — in [which environments can run the ERP MCP server](/blogs/which-environments-run-the-erp-mcp-server).

**What to do here:** confirm the version of the environment you intend to pilot in, not the version of production. **Pilots routinely get scoped against a sandbox that turns out to be on an older update**, and the check costs nothing until it is late.

**And one thing people forget:** the MCP server is enabled per environment. Confirming production is capable tells you nothing about the sandbox you will actually build in.

## Check 3 — who is allowed to connect?

**This is an allow-list, and it defaults to a short one.**

> *"Administrators can also control which agent clients are allowed to connect to the MCP server. When you enable the Dynamics 365 ERP MCP server in your environment, choose which agent platforms can access the server."*

**And the default set is explicit:** *"**By default, only the following platforms can access the MCP server**"* — the list Microsoft publishes, with a client ID against each, starting with Microsoft Copilot Studio.

> ### Why this stops pilots  **The decision is an administrator's, and it is a governance decision rather than a technical one.** A delivery team can have everything else ready and still be waiting on a conversation about which agent platforms are permitted to reach the ERP.  **Start that conversation first.** It has an owner, and the owner is probably not on the project.

**What to do here:** establish which client you intend to use, check whether it is in the default set, and if it is not, find out what registering it involves in your organisation. **Allow weeks, not days.**

## Check 4 — whose identity does the work?

**Decide this before you design anything, because it determines what is possible.**

Microsoft names two patterns: a delegated agent that runs *"on behalf of the user who is chatting with the agent"*, and an autonomous agent where *"The autonomous agent has its own identity, and that identity is the authenticated user making the request."*

**And the hard constraint behind both:** *"The MCP server doesn't provide an anonymous or shared-service path for accessing finance and operations data."*

**What to do here, in order:**

1. **Name the humans the process depends on.** Not roles — actual people or job functions.
1. **Check which of them have an ERP identity.** This is where most procure-to-pay processes fail, because the person who knows what arrived often does not.
1. **If they do not, you need the autonomous pattern** and a mediated confirmation step, which is [a design problem rather than a configuration one](/blogs/confirm-a-delivery-without-a-dynamics-365-licence).
1. **Assign an owner to the agent identity.** Somebody reviews its roles, and removes it when the process ends.

## Checks 5 and 6 — duties, and where the data goes

**Check 5 — validate segregation of duties after you assign the roles, not before.**

> *"Compliance with the rules for segregation of duties **isn't verified when you create a rule**… You must validate compliance after you create or modify a rule."*

**The same applies to assignment.** A new agent identity with a plausible set of roles can be in conflict with an existing rule and nothing will announce it. **Run the validation as a deliberate step, and run it again whenever either side changes** — [the pair to watch is named in Microsoft's own example](/blogs/segregation-of-duties-and-ai-agents).

**Check 6 — decide where the agent's data is retained.**

> *"**Any data movement or retention outside the customer's finance and operations environment** would be dependent on the **data storage and retention policies of the agent client**… Ensure you **audit the agent client's permissions to move data to other systems** and the data retention policies."*

**The server itself holds nothing:** *"The MCP server doesn't store customer data."*

**What to do here:** decide what the agent's working record is, where it lives, and how long you keep it. **If any of it is control evidence, that decision belongs to whoever owns your retention policy**, not to the project.

## What is deliberately not on this list

**Three things, and leaving them off is the point.**

**Model choice.** It changes, it is documented on a page that changes with it, and it is reversible. Checking it early buys nothing.

**Cost modelling.** It matters, and it is a function of your volumes rather than a readiness gate. **It cannot be answered before the process is scoped**, so putting it first produces a number nobody can rely on.

**Whether your data is clean enough.** The honest version is that you find out by running a read-only pass against your own data. **A readiness checklist that includes "have good data" is not a checklist** — it is a way of deferring the only test that answers the question.

> ### Where we are, honestly  **We have built two agents on this ground and they run on test data.** The Teams confirmation card and Outlook notice are **designed and in build, not shipped.** **No published results exist for this problem — ours or anyone's.** A scoped, read-only look at your own open lines is the honest first step, and it doubles as check six.

**About Cognilium** Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/

**Agentic ERP.** We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on **Azure OpenAI, Microsoft Fabric and Copilot Studio**. We build these on request, against your data and your environment.

**More on the boundary between what Copilot does and what you build:** [Agentic ERP on Dynamics 365](/erp-ai).

Six checks, and two of them need somebody outside your project. If you want to know which two will bite you, bring your environment and your process to a 15-minute call.

## Sources

- [Use MCP for finance and operations apps](https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/copilot/copilot-mcp) · **fetched and read in full 2026-10-21**
- [Security for Dynamics 365 ERP MCP](https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/copilot/mcp/mcp-security) · **fetched and read in full 2026-10-21**
- [Set up segregation of duties](https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/fin-ops/sysadmin/set-up-segregation-duties) · **fetched and read in full 2026-10-21**

## Fact-check

**Tier summary:** 9 × T1 (all verbatim), 6 × T2 — **0 × T4.**

> ### ⚠️ Claim 2 — this article deliberately does NOT restate the version facts  The version floor, the acceptable quality updates, the environment tier and the excluded environment types are **already published across six of our own articles.** Restating them here would make this the seventh.  **So §2 links out instead of repeating.** That is the depth gate working as intended: the demand brief for this cluster capped the readiness group at **one** article for exactly this reason, and the readiness article's job is **the order of the checks**, which nobody else has written, not the facts, which we already have.

> ### 🔴 Guardrails applied  | Rule | Compliance | |---|---| | Never *"least-privilege"* | **Not used.** §4 says "assign an owner" and "reviews its roles" | | Never *"SOX-compliant"* or *"100% audit-ready"* | **Not used.** §5 describes the validation step and makes no compliance promise | | Never *"Teams and Outlook are live"* | §6 states **designed and in build, not shipped** | | Never a customer name, saving or percentage | **None appears** | | Do not quote Microsoft's pricing | **§6 declines to model cost**, and gives the reason rather than a figure |

**🔴 No pricing.** §6 names cost modelling as deliberately out of scope and states no rate, credit price or currency. **This is the cluster's no-pricing ruling applied to the one article where a reader would most expect a number.**

**No unbounded absence claimed.** Every negative is Microsoft's own — *doesn't provide an anonymous path*, *isn't verified when you create a rule*, *doesn't store customer data*.

**No figures of ours.** No volume, no durations presented as measured, no customer, no result. **"Weeks, not days" is advice about approval cycles and is phrased as advice.**

## Frequently asked questions

### Why does the order matter?

Because the binary checks are cheap and the organisational ones are slow.

### Check 3 — who is allowed to connect?

And the default set is explicit: "By default, only the following platforms can access the MCP server" — the list Microsoft publishes, with a client ID against each, starting with Microsoft Copilot Studio.

### Check 4 — whose identity does the work?

Decide this before you design anything, because it determines what is possible.

---

Canonical HTML: https://cognilium.ai/blogs/is-your-dynamics-365-ready-for-ai-agents