TL;DR
Copilot inherits your permissions and returns a suggestion. An agent is a user of its own, with its own permission set, working in the background.
Copilot inherits your permissions and hands you a suggestion. An agent is a user in its own right, with its own permission set, working multistep in the background and handing you a task to review. That difference is architectural rather than a matter of degree — and Microsoft states both halves of it plainly.
What does Copilot actually do?
Microsoft's own definition is modest, and the modesty is accurate:
"Copilot is an AI-powered assistant that helps spark creativity, boost productivity, and eliminate tedious tasks."
The shape is easiest to see in a shipped feature. For marketing text on an item card, "By just selecting the Draft with Copilot action on the item card, Copilot will generate an intelligent draft text for you", and "Once you get the first draft, you can run Copilot again and again until you get a draft you like."
Three properties fall out of that description, and they hold across the Copilot features generally:
- A person starts it. There is a button, and somebody presses it.
- It produces a suggestion, not a result. Microsoft is explicit: "You should consider the AI-generated text as a suggestion only… human oversight and review are required."
- It finishes in the session. You accept, re-run, or discard, and the interaction ends.
And the security model is the part that settles it:
"When a user interacts with Copilot, it inherits their data permissions and can't read any more data than the user already has access to."
Copilot is you, assisted. It has no reach of its own.
What does an agent do that Copilot doesn't?
It acts as somebody, and that somebody is not you.
"The agent is considered as a user in Business Central, so it can be assigned permission sets to control what data and actions it can access."
That single sentence reorganises everything else. A thing with its own identity can be given less access than you have, can be audited separately, and can act while you are asleep.
There is a ceiling, and it is published. For agents built with the AI development toolkit, Microsoft lists "Permission inheritance: Agents can't have more permissions than their creating user." So an agent's permission set is genuinely its own — bounded above by its creator's, which is a narrower and more useful claim than "its own permissions".
Microsoft describes the behaviour in the same terms:
"Agents in Business Central are AI-powered team assistants that go beyond traditional automation… They reason over Business Central data, make informed decisions within defined boundaries, and collaborate with users through human-in-the-loop approvals for critical operations."
And the accountability that has to come with it: "every action is logged, permissions are rigorously enforced, and users remain in control at all times."
The consumption model differs too, and it follows from the behaviour. Copilot "is included with your Business Central license"; custom agents "consume Copilot credits as they perform their steps" — because an agent takes steps, and a suggestion does not.
What is the sharpest single difference?
Permissions. Everything else is a consequence.
| Copilot | Agent | |
|---|---|---|
| Whose access | "inherits their data permissions" — yours | its own: "considered as a user… assigned permission sets" |
| Who starts it | a person, in the moment | the runtime, or a task someone creates |
| How long it runs | one interaction | multistep, across pages |
| What you get | a suggestion to accept or discard | work done, plus something to review |
| What it costs to run | licensed with Business Central | credits consumed per step |
Read the first row and the rest is predictable. A thing that borrows your identity can only ever help you do what you were already permitted to do, in front of you. A thing with its own identity needs its own boundary, its own log and its own review step — which is exactly what Microsoft built, and why the permission set and the profile are separate controls.
One thing they share: "Copilot is exclusive to Business Central online. Therefore, it isn't available for other deployment types, such as on-premises or private cloud." Neither half of this story reaches an on-premises deployment.
So what does "agentic ERP" actually mean?
It means an ERP where some work is done by things that hold their own identity and act across several steps, rather than only by people the software assists.
### Whose word is this? It is not Microsoft's. Across the four Microsoft pages behind this article, the word agentic appears only inside Microsoft's own phrases — agentic AI, agentic strategy — and the phrase "agentic ERP" appears on none of them. It is category vocabulary in general use, and this article uses it as such rather than attributing it to a vendor.
The useful test is not what the software is called. It is the permission question: does the thing doing the work borrow a person's access, or hold its own? Software that only ever borrows is assisted software, whatever the brochure says. Software where a named non-human identity holds a permission set and produces work for review is the thing the word is reaching for.
A second test, from Microsoft's own framing: agents "adapt to dynamic business scenarios that can't always be anticipated during development". Where the scenarios can be anticipated, a rule is the better instrument — and choosing it is not a smaller ambition, as deciding not to build an agent sets out.
Where does the platform stop, and what gets built on top?
Microsoft draws this line itself, and it is the sentence to keep for scoping work:
"Business Central agentic strategy intentionally separates deep, well controlled, in-context and transparent execution within the product from cross-system orchestration."
Business Central agents are the in-product layer — they "form the foundational layer inside the product". Work that spans several systems sits above that layer, and Microsoft describes surfacing these capabilities to higher-level agents as something that "in the future will be possible" — a roadmap statement, and worth reading as one.
So the practical division is not AI versus no AI. It is in-product execution, which the platform increasingly does for you, against everything that crosses a boundary the platform does not own — your own data science, your own calculations, your own orchestration. That second space is where purpose-built applications live, and it is not shrinking as the platform grows. It moves.
About Cognilium Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/
Agentic ERP. We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on Azure OpenAI, Microsoft Fabric and Copilot Studio. We build these on request, against your data and your environment.
More on the boundary between what Copilot does and what you build: Agentic ERP on Dynamics 365.
If you are trying to work out which side of that line your problem sits on, that is a 15-minute conversation, not a project.
Sources
- Copilot FAQ — Business Central · fetched and read in full 2026-09-15
- Marketing text suggestions with Copilot overview — Business Central · fetched and read in full 2026-09-15
- Create and activate an agent (preview) — Business Central · fetched and read in full 2026-09-15
- Designing and coding agents (preview) — Business Central · fetched and read in full 2026-09-15
- Envision and design AI agents in Business Central — release plan · fetched and read in full 2026-09-15
Sources and fact-check
| # | § | Claim | Tier | Primary source | Verdict |
|---|---|---|---|---|---|
| 1 | 1 | "Copilot is an AI-powered assistant that helps spark creativity, boost productivity, and eliminate tedious tasks" | T1 — verbatim | Copilot FAQ | PASS |
| 2 | 1 | "By just selecting the Draft with Copilot action on the item card…"; "you can run Copilot again and again until you get a draft you like" | T1 — verbatim ×2, action name character-exact | Marketing text overview | PASS |
| 3 | 1 | "You should consider the AI-generated text as a suggestion only"; "human oversight and review are required" | T1 — verbatim ×2 | Marketing text overview | PASS |
| 4 | 1 | The three properties — person-started, suggestion, session-bound — generalised across Copilot features | T2 — ours. Drawn from one documented feature and stated as a shape, not as a claim about every Copilot capability | — | PASS — see the generalisation note |
| 5 | 1 | "When a user interacts with Copilot, it inherits their data permissions and can't read any more data than the user already has access to" | T1 — verbatim | Copilot FAQ | PASS — the article's spine |
| 6 | 2 | "The agent is considered as a user in Business Central, so it can be assigned permission sets to control what data and actions it can access" | T1 — verbatim | Toolkit page | PASS — the other half of the spine |
| 6b | 2 | The ceiling — "Permission inheritance: Agents can't have more permissions than their creating user" | T1 — verbatim, and BOUNDED in the body to agents built with the AI development toolkit, which is the section of the page it is listed under (Limitations (preview)) | ai-development-toolkit-overview · fetched 2026-09-15 | PASS — added after first draft; see the note |
| 7 | 2 | "Agents in Business Central are AI-powered team assistants that go beyond traditional automation"; "reason over Business Central data, make informed decisions within defined boundaries"; "collaborate with users through human-in-the-loop approvals" | T1 — verbatim ×3 | Release plan | PASS |
| 8 | 2 | "every action is logged, permissions are rigorously enforced, and users remain in control at all times" | T1 — verbatim | Release plan | PASS |
| 9 | 2 | Copilot "is included with your Business Central license"; custom agents "consume Copilot credits as they perform their steps" | T1 — verbatim ×2, stated as consumption mechanism, no figure | Copilot FAQ; release plan | PASS |
| 10 | 3 | The comparison table — every cell either a quotation already cited above or a plain restatement of one | T1 / T2 as marked in the rows | Both pages | PASS |
| 11 | 3 | "Copilot is exclusive to Business Central online. Therefore, it isn't available for other deployment types, such as on-premises or private cloud" | T1 — verbatim | Copilot FAQ | PASS |
| 12 | 4 | "Agentic ERP" is not Microsoft's phrase | T1 for the test that was run, bounded to the four pages behind this article. Programmatic search: agentic appears on the release plan only, in agentic AI / agentic strategy; the phrase "agentic ERP" appears on none of the four | All four sources | PASS — bounded in the body, not only here |
| 13 | 4 | The identity test as the definition of the category | T2 — ours. A definition we are proposing, written as one | — | PASS |
| 14 | 4 | "adapt to dynamic business scenarios that can't always be anticipated during development" | T1 — verbatim | Release plan | PASS |
| 15 | 5 | "intentionally separates… within the product from cross-system orchestration"; "form the foundational layer inside the product"; "in the future will be possible" | T1 — verbatim ×3, tense preserved | Release plan | PASS |
| 16 | 5 | That the space above the platform layer "moves" rather than shrinks | T2 — ours, a positioning view stated in our own voice | — | PASS |
Tier summary: 12 × T1 (all verbatim), 4 × T2 — 0 × T4.
### ⚠️ Claim 4 is a generalisation, and it is labelled as one Microsoft's "suggestion only… human oversight and review are required" is written about one feature — marketing text. The article uses it to describe a shape that holds across Copilot features, which is a step beyond the source. It is marked T2 rather than T1 for that reason. The body says "they hold across the Copilot features generally" rather than "Microsoft says every Copilot feature is a suggestion", and the Copilot FAQ's permission sentence — which is general — carries the load in §3.
### ⚠️ Claim 12 is an absence, bounded on purpose "The phrase 'agentic ERP' is not Microsoft's" is the kind of sentence one link refutes. It is bounded in the body to the four pages behind this article, and the bound is stated there and not only in this table, because the lifted blocks travel without the table. It is not a claim that Microsoft has never used the phrase anywhere.
Two superlatives in our own source material were NOT used. The founder-locked identity text describes Cognilium as "primary vendor" and "dominant player in 'Agentic ERP'". Both are unsupportable superlatives under `03-proof/DISCLOSURE-RULES.md` and neither appears in this article. The claims they carry — that we build turnkey AI optimization apps for Dynamics 365 as sidecar applications in the customer's own Azure tenancy — are stated in the footer as capability, in present tense, with no ranking.
Microsoft's own superlative was also not repeated. The Copilot FAQ calls Copilot "the world's first AI-powered assistant across all lines of business." That is a vendor claim and this article does not carry it, as fact or as quotation.
🔴 No pricing. Licensing and credits appear as consumption mechanisms only — no rate, pack, total or currency.
No figures of ours. No volume, no accuracy, no customer, no result.
Rule 2b sweep — generated by `_audit/sweep.py`, not typed. Case-insensitive, whole-word, over the published span (--- DRAFT --- → ## Fact-check, both lifted blocks included): is not ×7, only ×5, no ×3, can't ×3, does not ×2, nothing ×1, cannot ×1, every ×1, all ×1, always ×1, none ×1, doesn't ×1, isn't ×1. `description` and `title` carry no absolute terms.
[raw: {'nothing': 1, 'only': 5, 'cannot': 1, 'does not': 2, 'is not': 7, 'every': 1, 'all': 1, 'always': 1, 'none': 1, 'no': 3, "doesn't": 1, "isn't": 1, "can't": 3}]
Three hits were repaired rather than explained, per Rule 2c:
| hit | was | now |
|---|---|---|
| most | "the part most people miss" | "the part that settles it" — we have measured nothing about what readers miss |
| most | "the most useful sentence for anyone scoping work" | "the sentence to keep for scoping work" — a superlative plus a universal, both unnecessary |
| every | takeaway: "produces every other difference between them" | "is where the other differences come from" — the body derives several differences from the permission fact; every claimed completeness we had not established |
### 🔁 The same defect class has now appeared in three consecutive articles ch30 carried "a sentence most people never read" and "the most common reason a sound agent disappoints". This article carried "the part most people miss". All four are unmeasured claims about what other people think, do or notice, written in the voice of experience. The sweep catches them because they cluster on `most`, `every` and `never` — which is why the sweep runs on the finished draft rather than on the sentences the writer already doubts. Judgement is what fails here; the grep is what works.
Every remaining hit is Microsoft's word or bounded in its own sentence. only appears five times — twice inside Microsoft quotations, three times in logically bounded statements about borrowed access. none of them is bounded to the four pages, in that sentence. always is inside Microsoft's own "can't always be anticipated".
Share this article
What Microsoft ships, what it does not, and the layer we build where a general assistant runs out.
