The MCP server is shipped. The decision is not.
An MCP server is how a large language model reaches your ERP: it exposes data and actions as tools an agent can call, under the permissions of the user it runs as. Microsoft ships one for both Dynamics 365 products. The Dynamics 365 ERP MCP server for Finance, Supply Chain Management, Human Resources and Project Operations is generally available, with seven data tools, thirteen form tools and two action tools; Business Central ships its own built in. What either gives an agent is everything the ERP already records. What neither can give is the answer to a question the ERP never calculates: the optimal price, the optimal stock level, the route a picker should walk. Those are computed beside the ERP and handed back through the same protocol.
Two questions that look alike
“What is the reorder point on this item?”
The agent reads the field. The ERP stores it. Answered.
“What should the reorder point be?”
Nothing in the ERP holds this. No amount of tool-calling produces it, because the calculation was never there to call.
What an MCP server actually is
The Model Context Protocol is a standard way to describe tools to a language model. An MCP server sits in front of a system and publishes a list: here are the things you can read, here are the things you can do, here is the shape of each one. The model picks a tool and calls it. The server carries out the call under an identity with its own permissions.
For an ERP that matters more than it sounds. Without it, an assistant over Dynamics is doing retrieval over exported documents: it can tell you what a report said, and it cannot act. With it, the agent works the way a person does, through the same supported surface, under a role you granted.
The platform's own supported entry points, not the database. For Finance and Supply Chain Management the dynamic server works through data entities, server-side form logic and registered code actions, which is what keeps upgrades intact.
An authenticated user, with the agent assigned its own security roles. The agent can do exactly what those roles can do and nothing else, which is the part an IT director will ask about first.
Structured records and the application's own view model, not prose. The model reasons over the result; it does not have to parse a screen or trust a summary written by another model.
The Dynamics 365 ERP MCP server, fact by fact
Read against Microsoft's documentation and announcements on the date at the top of the page. Where a status moved, the row says when.
| Fact | What Microsoft says | Where |
|---|---|---|
| Products covered | Dynamics 365 Finance, Supply Chain Management, Human Resources and Project Operations, through one server. | Microsoft blog, 11 Nov 2025 |
| Status | Generally available. Public preview November 2025; general availability 27 January 2026 per the release plan; restated as GA in Microsoft's roadmap post of 23 September 2026. | Release plan; Microsoft blog, 23 Sep 2026 |
| Minimum version | 10.0.47, or 10.0.46 with PQU-2, or 10.0.45 with PQU-7. The feature “Dynamics 365 ERP Model Context Protocol server” is on by default in Feature Management. | Microsoft Learn, updated 18 Aug 2026 |
| Environments | Tier 2 or above, or a Unified Developer Environment. Not supported on Cloud Hosted Environments. | Microsoft Learn |
| Which clients may connect | Only platforms you add on the Allowed MCP Clients page: Copilot Studio, Microsoft Foundry and non-Microsoft agent clients alike. | Microsoft Learn |
| The static server | The original Build 2025 server, 13 fixed tools on the Dataverse connector framework, with a retirement date of 1 October 2026 in Microsoft Learn. That date has passed; confirm the state of your own environment, and move every agent to the dynamic server. | Microsoft Learn |
| Security model | The server returns the same view model a user would see, filtered by the authenticated user's security role: menu items, fields, actions, entities and code actions outside the role are not returned, and explicit calls to them are rejected. | Microsoft Learn |
| Forms it refuses | Security configuration, user role assignment, segregation of duties, temporary and privileged roles, users and user groups, Entra applications and Feature Management are excluded from the server entirely. | Microsoft Learn |
| Agent-only permissions | Agent-specific roles, duties and privileges, scoped by legal entity, that apply only when the ERP is reached through an agent. In development: preview October 2026, general availability December 2026. | Roadmap item 571677, published 30 Sep 2026 |
| Agent licence | An agent identity needs no finance and operations user licence when assigned the System agent role, which carries no permissions; working permissions come from other roles you assign. | Microsoft Learn |
| Metering | Inside Copilot Studio a tool call bills as an Agent Action at a fixed rate. From any other client, Microsoft charges 0.1 Copilot Credits per tool call, with Finance Premium and Supply Chain Management Premium exempt. | Microsoft Learn |
| Analytics server | A second server over Business Performance Analytics: measures, dimensions, reports and semantic models. Public preview was announced for December 2025. | Microsoft blog, 11 Nov 2025 |
| Next to it | The Dynamics 365 ERP plugin for Copilot Cowork is generally available; a Commerce MCP server is in public preview; business skills, including procure-to-pay, are coming without a date. | Microsoft blog, 23 Sep 2026 |
Sources: Microsoft Learn, Use Model Context Protocol for finance and operations apps; Microsoft Dynamics 365 blog, 11 November 2025 and 23 September 2026; Microsoft roadmap item 571677. The full agent list sits in the Dynamics 365 agent catalog.
Twenty-two tools in three families
The dynamic server does not have a tool per business function. It has a small set of generic tools and lets the application's own metadata decide what the agent can do with them.
Data tools
7Create, read, update and delete through data entities. The efficient path for standard record operations: fewer calls, better performance. From version 10.0.48 the SQL read tool replaces the OData find.
data_find_entity_type, data_get_entity_metadata, data_find_entities, data_find_entities_sql, data_create_entities, data_update_entities, data_delete_entities
Form tools
13Open forms, set field values, open lookups, filter and sort grids, select rows, click controls, save and close, through server APIs rather than a client session. This is how an agent runs business logic that lives behind a button.
form_open_menu_item, form_find_menu_item, form_find_controls, form_set_control_values, form_open_lookup, form_click_control, form_filter_form, form_filter_grid, form_sort_grid_column, form_select_grid_row, form_open_or_close_tab, form_save_form, form_close_form
Action tools
2Find and invoke X++ classes a developer has registered as AI tools through the ICustomAPI interface, with security on the menu item. This is the door for logic that no entity and no form exposes: the customized estate.
api_find_actions, api_invoke_action
Microsoft's own guidance: steer the agent to data tools for plain record operations and to form tools for actions and runtime-calculated values, and write an Action tool only when neither reaches the logic you need.
The limits Microsoft publishes
Known limitations as documented, which are the first things a pilot runs into.
- Language
- Tool metadata and guidance are returned in US English only; labels and values follow the user's locale.
- Dates and numbers
- ISO format throughout. User locale is not considered.
- Controls it cannot drive
- Calendar, organisation chart, list view, availability view, HTML editor, image, radio button, time edit and any custom control.
- Attachments
- Document viewer and file upload controls are not supported; files go through a separate documented path.
- Filters
- Grids accept the matches operator only. No before, after or between on dates.
- Downtime
- The server is unavailable during servicing windows, and requests made then fail.
- The sidecar
- Adding the ERP MCP server as a tool inside Copilot for finance and operations apps, the in-client chat, is not yet supported.
Both products ship the server. The question moved.
Dynamics 365 Business Central 2026 wave 1 put autonomous agents in the product: a Payables Agent that drafts vendor invoices from a mailbox, a Sales Order Agent that turns customer emails into quotes and orders, an Expense Agent. They reach data through a built-in MCP server, and a person stays in the loop on anything consequential.
Finance and Supply Chain Management followed with the dynamic ERP MCP server, generally available since January 2026 and the surface Microsoft's own Account Reconciliation and Procurement agents, and every named partner agent, now build on.
That is the honest starting point for anyone searching this term, and it changes the question. It is no longer “who will build me an MCP server for Dynamics”. It is “what do I still have to build once the transport is free”.
We cover the Business Central release in our own newsroom and keep the agent catalog current. Our position has not required adjusting, because it was never the transport we were selling.
Business Central 2026 wave 1, in our newsroom →What it can reach, and what it cannot compute
An MCP server is a transport and a permission layer. It is not a decision layer. The distinction is not a quibble: it is the line between a question the ERP can already answer and a question nobody has answered yet.
| Ask an agent over the built-in MCP server | What actually has to happen |
|---|---|
| “What is the reorder point on this item?” | It reads the field. The ERP stores it. Answered. |
| “What should the reorder point be?” | Nothing in the ERP holds this. It has to be computed from demand history and lead-time variability, then written back. The ERP records the number; it does not derive it. |
| “Which purchase order lines are overdue?” | It reads the open lines and their delivery dates. Answered, and an agent can work that list. |
| “What did we quote this customer last time?” | It reads the quote. Answered. |
| “What price should go on this line to protect the margin?” | Requires elasticity over your own transaction history. The ERP has the transactions and none of the model. |
| “Where is this item stored?” | It reads the bin. Answered. |
| “Where should it be stored, and in what order should this wave be picked?” | A routing and slotting computation over the layout and the order profile. Not a field, not a report. |
Every row in the second half has the same shape. The data is in the ERP, the answer is not, and no amount of tool-calling produces it, because the calculation was never there to call. That is the work that sits beside the ERP.
What we build
The decision layer the agent calls
The optimizers compute what the ERP records but never derives: safety stock and reorder points, margin-optimal prices, pick paths and slotting. Exposed as tools, an agent can ask for the number and then act on it through the platform's own MCP server. The transport being free is good for us: it removes the part we were never differentiated on.
The last mile on your customized F&O
Microsoft's server reaches standard entities and forms. Your X++ logic becomes reachable only once a developer registers it as an Action tool through the ICustomAPI interface, with security on the menu item. That registration, and the testing around it, is engineering we do.
The approval boundary
Anything that moves money or stock is prepared and put to a person. That design is what gets an IT director to say yes, and it is stronger than promising autonomy. It applies whether the agent runs on Microsoft's MCP server or ours, and it is the control Microsoft's agent-only roles will formalise from October 2026.
Where we stand, in the five words we use
We publish a status word against everything, because “we do that” is the sentence that wastes a buyer’s quarter.
Our own MCP server and Copilot extension for Dynamics
In developmentBeing built now, named as roadmap. Not a thing you can buy from us today, and we will not imply otherwise while Microsoft ships one in the box for both products.
PO Receipt Chase Agent for Finance & Supply Chain Management
Built, demonstrated on requestFinds overdue purchase order lines, reports them by buyer and posts the product receipt behind an approval. Runs on test data in a demonstration environment today.
Contract Review Copilot
ShippedRunning for a customer today, as Paralegent AI.
Pricing, Pick-Path & Slotting, Demand & Inventory Optimizers
Built, demonstrated on requestThe software exists and is shown live against your own data.
Action tools for a customized F&O, warehouse mapping, financial reconciliation, mobile Power Apps
Built to orderWe have the engineering and build it for you; there is no packaged app yet.
Supply-chain risk forecasting, planning-operations tooling
BlueprintArchitecture designed, nothing built.
Dynamics 365 and MCP, answered plainly
- Does Dynamics 365 have an MCP server?
- Yes, for both products. The Dynamics 365 ERP MCP server for Finance, Supply Chain Management, Human Resources and Project Operations is generally available: public preview in November 2025, general availability on 27 January 2026 per Microsoft's release plan. Business Central ships one built in from 2026 release wave 1, the same release that added the Payables, Sales Order and Expense agents.
- Is the Dynamics 365 ERP MCP server generally available?
- Yes. Microsoft's release plan dates general availability to 27 January 2026 and Microsoft restated it as generally available in its roadmap post of 23 September 2026. It needs version 10.0.47 (or 10.0.46 PQU-2, or 10.0.45 PQU-7), a Tier 2 or Unified Developer environment, and your agent platform added on the Allowed MCP Clients page.
- What happened to the static 13-tool MCP server?
- It was the original server from Build 2025, built on the Dataverse connector framework with 13 fixed tools for Finance and Supply Chain Management. Microsoft Learn gives its retirement date as 1 October 2026, which has now passed, and asks every agent to move to the dynamic server, which replaces fixed tools with data, form and action tools over the whole application.
- What are data tools, form tools and action tools?
- Three families on the dynamic server. Data tools do create, read, update and delete through data entities. Form tools open forms, set values, filter grids and click controls through server APIs, so an agent can run logic that lives behind a button. Action tools find and invoke X++ classes a developer has registered as AI tools through the ICustomAPI interface. Seven, thirteen and two tools respectively.
- Which security role does an agent run under?
- The authenticated user's. The server returns only the menu items, fields, actions, entities and code actions that role can reach and rejects explicit calls outside it; system administration forms are excluded altogether. Agent-specific restrictions, so an agent session can be narrower than the same user in the client, are Microsoft roadmap item 571677: preview October 2026, general availability December 2026.
- Do you build an MCP server for Dynamics 365?
- Ours is In development, named as roadmap. We are deliberate about saying so, because Microsoft now ships one in the box for both products and claiming to build what the platform vendor includes would be a me-too claim. What we build is on the other side of it: Action tools that reach your customized F&O, agents such as the PO Receipt Chase Agent, and the calculations the ERP does not perform.
- If the MCP server is included, what is left to build?
- Everything the ERP does not compute, and everything your customization hides. An agent can read the reorder point because the field exists; it cannot tell you what the reorder point should be. It can open any standard form; it cannot reach your X++ logic until that logic is registered as an Action tool. The transport is solved. The decision, and the last mile, are not.
- Can an agent write back to the ERP?
- It can do whatever the roles you granted can do, through data tools, form tools and registered actions. Our design is narrower than that on purpose: the agent reads live rather than from a nightly copy, and writes back only what it created. Anything that moves money or stock is proposed, prepared, and approved by a person.
- Does this require changing our ERP?
- No. The work sits beside the ERP and reaches it through the supported surface, so what your implementation partner supports does not change. Registering an Action tool is an extension, not a change to core logic. We never alter core ERP logic.
- Business Central or Finance & Supply Chain Management, does it differ?
- Materially. Different product, different data layer, different environment model, different server. Business Central leads on quoting and pricing and carries the built-in agents; Finance and Supply Chain Management is where the deeper warehouse, procurement and planning work lives, reached through the dynamic ERP MCP server. Knowing that difference is most of the expertise in these engagements.