TL;DR
MCP publishes ERP data and actions as tools a language model can call, under an identity with its own permissions. What that buys, and what it does not.
MCP is an open standard for connecting AI applications to external systems. Inside Business Central it turns API pages into tools an AI client can call — read-only by default, over a single endpoint, running as the user who connected. That last part is what separates it from an agent.
What is MCP, in one sentence?
Two definitions, from the two parties who would know.
The protocol's own:
"MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems."
Microsoft's, in the Business Central documentation:
"The Model Context Protocol (MCP) is an open standard that defines how AI applications communicate with data sources and tools. It provides a consistent and secure way for AI clients—such as Copilot Studio, GitHub Copilot, Claude, ChatGPT, and custom agents—to access and interact with external systems like Business Central."
The protocol documentation offers an analogy that is worth borrowing: "Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect electronic devices, MCP provides a standardized way to connect AI applications to external systems."
Note what is not in either definition. MCP is not a model, not an agent, and not an AI capability. It is a connector standard — which is why it matters more than it sounds.
What does an MCP server actually do?
It publishes one application's capabilities in a form any compliant client can discover and use.
"An MCP server is a service that implements the Model Context Protocol, exposing an application's data and functionality to AI clients. When an AI client connects to an MCP server, it can read data, perform actions, and integrate that application's capabilities directly into conversational workflows—all through a standardized interface."
*The word doing the work is standardized.* The point of a standard is that the client and the server are written by people who never met. Microsoft names the clients it supports and they are not all Microsoft's:
- Visual Studio Code with GitHub Copilot
- Copilot Studio
- "Other clients that comply with Model Context Protocol specification, for example Claude, ChatGPT, and MCP Inspector."
An ERP vendor listing competitors' AI clients as supported hosts is not a small thing. It is what adopting a standard looks like when it is done properly.
What does it actually do inside Business Central?
It turns API pages into callable tools, and the default is deliberately narrow on writes.
"By default, the Business Central MCP server provides read-only access to all exposed Business Central API pages. With no extra configuration, MCP hosts can read data from your Business Central environment. To enable write operations, administrators configure API page objects with specific permissions for create, modify, delete, and bound actions."
Once configured, Microsoft groups what agents can do into three kinds:
| Capability | Microsoft's words |
|---|---|
| View and manage records | "List, create, update, and delete entities such as customers, items, and sales orders" |
| Execute business processes | "Post documents, change statuses, and run business logic" |
| Answer natural language queries | "Provide conversational access to Business Central data" |
The middle row is the one to notice. Post documents and run business logic is not reporting — it is the ERP's own logic being invoked from outside, with pricing, discounting and validation applied server-side rather than reimplemented by whatever is calling.
Whose identity does the work run as?
Yours. Not the client's, and not a separate agent's.
"All operations are performed with your user identity and permissions, ensuring audit trails show who performed each action."
### This is the sentence that places MCP in the picture A Business Central agent is "considered as a user" with its own assigned permission sets. MCP is not that. Over MCP, a person authenticates and the work runs under that person — so the audit trail names them, and the reach is theirs.
Which means the security question changes shape. For an agent you ask what should this thing be allowed to do? For MCP you ask who is connecting, and what are they already allowed to do? — because MCP adds no permissions of its own. It adds a new way to exercise the ones a person already has.
And that cuts both ways. It is reassuring, because nothing new is granted. It is also the reason the configuration matters: [the default exposes every API page in the environment](/blogs/business-central-version-agents-mcp), read-only, to anyone who can connect.
How does a client actually connect?
One endpoint for everybody, four headers, and standard OAuth.
Every host connects to the same address — "All MCP hosts connect to the same Business Central MCP server endpoint" — https://mcp.businesscentral.dynamics.com. The environment is selected by HTTP headers, not by a per-tenant URL: TenantId, EnvironmentName, Company and an optional ConfigurationName.
There is a real trap in those headers, and Microsoft documents it:
"If the Company or ConfigurationName values contain non-ASCII characters (for example, ø, æ, or å), you must encode the values using Base64 (UTF-8). The encoded value must use the format `=?base64?<encodedvalue>?=`."
A Danish or Norwegian company name will fail as a plain header. Microsoft adds that "With Copilot Studio, the platform handles the encoding, so manual encoding isn't required" — so this bites the hand-rolled client and not the low-code one.
Authentication is the standard stack, named: "OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE) and Microsoft Entra ID as the authorization server", with Protected Resource Metadata published so clients can discover the endpoints. Microsoft's own hosts use a preregistered application; non-Microsoft clients require you to register your own.
So what does MCP change?
It changes who can integrate, not what the ERP can do.
Nothing in the list above is new functionality. API pages existed. Business logic existed. What is new is that a client nobody at Microsoft wrote can discover those capabilities and call them, over one documented endpoint, with an identity the audit trail can name.
For anyone building on top of Dynamics, that is the material fact. The integration surface stopped being a one-off piece of work per client and became a standard one — which moves the effort from plumbing to deciding what should be exposed, to whom, and with which write permissions.
About Cognilium Cognilium builds AI optimization apps for Microsoft Dynamics 365 — companion apps that optimize the pricing, inventory, warehouse and planning decisions your ERP manages but can't optimize. Dynamics is your system of record. Cognilium is your system of intelligence. https://cognilium.ai · https://www.linkedin.com/company/37180269/
Agentic ERP. We build turnkey AI optimization apps for Dynamics 365 — sidecar applications that run in your own Azure tenancy and solve the calculations a standard ERP is not built to compute. Built on Azure OpenAI, Microsoft Fabric and Copilot Studio. We build these on request, against your data and your environment.
More on the boundary between what Copilot does and what you build: Agentic ERP on Dynamics 365.
If you are deciding what to expose over MCP and with which write permissions, that is a design conversation worth having before the first connection, not after. Fifteen minutes is usually enough.
Sources
- Model Context Protocol (MCP) in Business Central overview · fetched and read in full 2026-09-15 · Last updated on 2026-06-17
- Configure Business Central MCP Server · fetched and read in full 2026-09-15 · Last updated on 2026-05-03
- What is the Model Context Protocol (MCP)? — modelcontextprotocol.io · fetched and read in full 2026-09-15 · page shows Version 2026-07-28 (latest)
Sources and fact-check
| # | § | Claim | Tier | Primary source | Verdict |
|---|---|---|---|---|---|
| 1 | 1 | "MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems" | T1 — verbatim, from the protocol's own documentation, fetched not summarised | modelcontextprotocol.io | PASS |
| 2 | 1 | Microsoft's definition, including the named clients | T1 — verbatim | mcp-overview | PASS |
| 3 | 1 | The USB-C analogy | T1 — verbatim, attributed to the protocol documentation, not presented as ours | modelcontextprotocol.io | PASS |
| 4 | 1 | MCP is not a model, not an agent, not an AI capability | T2 — ours, a reading of the two definitions | — | PASS |
| 5 | 2 | "An MCP server is a service that implements the Model Context Protocol, exposing an application's data and functionality to AI clients…" | T1 — verbatim | mcp-overview | PASS |
| 6 | 2 | The supported-host list, including "Claude, ChatGPT, and MCP Inspector" | T1 — verbatim | mcp-overview | PASS |
| 7 | 3 | "By default, the Business Central MCP server provides read-only access to all exposed Business Central API pages…" | T1 — verbatim | mcp-overview | PASS |
| 8 | 3 | The three capability rows, each quoted | T1 — verbatim ×3 | mcp-overview | PASS |
| 9 | 3 | Server-side pricing, discounting and validation are applied rather than reimplemented | T2 — ours. A reading of "run business logic". Not a Microsoft sentence and does not read as one | — | PASS |
| 10 | 4 | "All operations are performed with your user identity and permissions, ensuring audit trails show who performed each action" | T1 — verbatim | mcp-overview | PASS — the article's spine |
| 11 | 4 | The contrast with an agent being "considered as a user" | T1 — verbatim, from the toolkit page already cited in this cluster and re-read 2026-09-15 | ai-development-toolkit-agent-create | PASS |
| 12 | 4 | MCP adds no permissions of its own | T2 — ours, a direct consequence of claim 10 | — | PASS |
| 13 | 5 | One endpoint; TenantId · EnvironmentName · Company · ConfigurationName | T1 — verbatim, header names character-exact | mcp-overview | PASS |
| 14 | 5 | The Base64 requirement and the =?base64?<encodedvalue>?= format | T1 — verbatim, format string character-exact, including Microsoft's own example characters ø, æ, å | mcp-overview | PASS |
| 15 | 5 | "With Copilot Studio, the platform handles the encoding, so manual encoding isn't required" | T1 — verbatim | mcp-overview | PASS |
| 16 | 5 | OAuth 2.0 Authorization Code flow with PKCE, Entra ID as authorization server, Protected Resource Metadata | T1 — verbatim | mcp-overview | PASS |
| 17 | 6 | What MCP changes — who can integrate, not what the ERP does | T2 — ours, the article's argument, stated as ours | — | PASS |
Tier summary: 13 × T1 (all verbatim), 4 × T2 — 0 × T4.
### ⚠️ One source here is not Microsoft, and §0 binds it identically modelcontextprotocol.io is the protocol's own documentation. It was fetched and read, not summarised — the two quotations above were matched against the fetched page text, the same check run on the Microsoft pages. This matters because of a specific past failure. An earlier cluster shipped a claim about a third-party vendor's pricing sourced to a page nobody had opened, and the adversarial pass missed it because the pass had been scoped to the vendor the cluster was about. Re-fetch every source, not every Microsoft source.Two Microsoft pages agree, and the article uses the stronger wording. mcp-overview says "read-only access to all exposed Business Central API pages"; configure-mcp-server says "the MCP Server gives agents read-only access to all exposed Business Central API pages". Both were read; neither contradicts the other.
🔴 No pricing. Nothing in this article states a rate, pack, total or currency.
No unbounded absence claimed. The only negative statements are Microsoft's own defaults and the observation that MCP grants nothing new — which follows from claim 10 rather than from failing to find something.
No figures of ours. No volume, no accuracy, no customer, no result.
Rule 2b sweep — generated by `_audit/sweep.py`, not typed. Case-insensitive, whole-word, over the published span (--- DRAFT --- → ## Fact-check, both lifted blocks included): only ×6, is not ×6, all ×6, every ×4, nothing ×2, no ×2, nobody ×1, never ×1, isn't ×1, can't ×1. `description` carries: only — swept against the body.
One hit was repaired rather than explained, per Rule 2c: "the least glamorous and most consequential piece of this whole subject" became "which is why it matters more than it sounds" — a superlative we had no way to establish.
Every remaining hit is Microsoft's word or bounded in its own sentence. every host, every exposed API page and all restate Microsoft's "All MCP hosts" and "all exposed Business Central API pages". a client nobody at Microsoft wrote is accurate on its face — Claude and ChatGPT appear in Microsoft's own supported-host list.
`validate-voice` reports ten AVOID hits: eight are `tools`, Microsoft's own term for what an MCP server exposes, and one is `reporting` inside a negation doing positioning work — "is not reporting — it is the ERP's own logic being invoked from outside". The tenth was genuine and was repaired: bespoke is on the AVOID list and became one-off.
Share this article
What Microsoft ships, what it does not, and the layer we build where a general assistant runs out.
