MCP Is Becoming the Front Door Into Dynamics 365. Connecting an Agent Was Never the Hard Part.

Microsoft is settling on Model Context Protocol, or MCP, as the standard way for AI agents to reach Dynamics 365. MCP is an open standard that lets an agent securely connect to external tools, systems and data. In a 21 July post, Microsoft named seven certified MCP data partners, ZoomInfo, Dun and Bradstreet, LeadIQ, Draup, Gong, Enlyft and HG Insights, that feed intelligence to its first-party agents, the Sales Qualification Agent and the Sales Opportunity Agent, without making sellers or IT rebuild integrations or duplicate data. The protocol is spreading past Sales. Microsoft's docs now cover MCP for finance and operations apps, and Business Central's 2026 Release Wave 1 ships a preview MCP server that exposes admin-center APIs.

Why it matters

Putting an outside AI next to an ERP used to mean a bespoke integration for every system. MCP replaces that with one self-describing standard. An agent can ask Dynamics what it can do and then do it. The cost of standing an agent up next to your ERP data falls toward zero, which is the shift behind reading and writing Dynamics data without touching the ERP core and how an AI agent should read Dynamics data.

A connection is not a decision

Here is the part the announcements skip. MCP solves how an agent reaches your inventory, picking or slotting data. It says nothing about whether the agent makes a good call once it is there. That gap is the whole game, and it is the one we mapped in what Copilot cannot do in Dynamics 365.

An open door swings both ways. An agent that can act on ERP data through a standard protocol is a new surface for identity and permissions to go wrong. Deciding what an agent may touch, and proving it, becomes part of the job, as we argued in can an ERP agent escalate its own permissions.

What to do: if you run Finance and Operations or Business Central, treat MCP as the integration question you no longer have to answer, and move your attention to the decision and control layers. Decide what the agent should optimise, what it may touch, and how you will verify both. The front door is open. What you let through it, and how you check its work, is what matters, a point we drew out in Copilot sidecar versus an MCP agent.