Dynamics 365 ERP MCP server: what F&O developers need to know

The Dynamics 365 ERP MCP server is Microsoft's entry point that lets an AI agent (built in Copilot Studio or another MCP-compatible client) act inside Finance & Operations: read and write data, use forms the way a user would, and call X++ classes exposed as tools. Everything the agent sees and does is filtered by the security role of its identity.

For an X++ developer, the key point is the third tool family: when business logic is reachable neither through a data entity nor through a form, you write the X++ class the agent will call. For an IT manager, the key point is security: an agent has exactly the rights of the role you assign to it, no more and no less.

Microsoft Learn describes three categories of dynamic tools:

• Data tools (data_find_entity_type, data_get_entity_metadata, data_find_entities, data_create_entities, data_update_entities, data_delete_entities): CRUD operations through data entities and OData. Deep inserts are not supported. In version 10.0.48, data_find_entities_sql replaces the OData read. Microsoft recommends preferring these tools for CRUD: fewer calls, better performance.
• Form tools (form_open_menu_item, form_set_control_values, form_click_control, form_save_form, grid filters and sorts, and so on): the agent navigates forms through server APIs, without opening a client session, and triggers the actions behind buttons.
• Action tools (api_find_actions, api_invoke_action): the agent finds and invokes X++ classes built as AI tools, which implement the ICustomAPI interface and whose action menu item is covered by a privilege.

Context is dynamic: on every call, the server returns the application view model, taking your extensions, configuration and personalisation into account. Your custom fields and forms are therefore visible to the agent with no extra development, as long as its role grants access.

• Minimum F&O version: 10.0.47, or 10.0.46 PQU-2, or 10.0.45 PQU-7.
• "Dynamics 365 ERP Model Context Protocol server" feature enabled in Feature management (enabled by default).
• Agent platform added on the "Allowed MCP Clients" page.
• Tier 2 or higher environment, or a Unified Developer Environment (UDE). Cloud Hosted Environments (CHE) are not supported.

Watch out for the old version: the "static" server with 13 tools, built on the Dataverse connector, is retired on 1 October 2026. Any agent still using it must be moved to the dynamic server.

The security role of the authenticated user for the agent determines everything: the menu items returned, the entities listed, the APIs offered, the fields and actions visible on a form. An explicit call to an unauthorised object is rejected. Microsoft gives the example of an agent assigned the Purchasing Agent role: it only reaches the objects in that role's duties and privileges.

In practice, design one dedicated role per agent, limited to its scope. It is both a security measure and a quality gain: the fewer objects the agent has to scan, the better it picks the right form or entity. Some administration forms (feature management, users, security configuration) are excluded anyway.

On licensing, an agent identity assigned the System agent role is exempt from an F&O user licence; that role grants no rights, so you add the business roles it needs. Tool calls are billed according to the agent client (the Agent Action rate in Copilot Studio, 0.1 Copilot Credits per call in other clients, with exemptions for Premium licences). Check these terms on Learn before any costing.

• Metadata and guidance returned in US English only; dates and numbers in ISO format.
• Some controls not supported (calendar, org chart, HTML editor, image, radio button…), nor custom controls.
• Form tabs closed by default: the agent must open them.
• Grid filters limited to the "matches" operator.
• Server unavailable during servicing windows.
• Adding it to the in-app Copilot for F&O (side panel) not yet supported.

Three concrete workstreams. First, the quality of your data entities: they are what the agent uses first to read and write. A well-named, documented custom entity is directly usable. Second, action classes: a composite operation, calculation or validation that does not exist behind a button must be written in X++ and exposed as an AI tool. We cover that case in Copilot Studio agents for D365 F&O: what still needs X++. Third, security: privileges, duties and roles dedicated to agents.

Not to be confused with how Skalp AI uses MCP. Microsoft's server makes an agent act inside the ERP. Skalp's Pro plan uses an MCP connection to your instance and your Azure DevOps context to generate X++ code aligned with what you already have, delivered with unit tests and validated by your IT lead: see MCP for D365 F&O. Two complementary uses of the same protocol. For the bigger picture, read building X++ without a consultant in 2026 and compare the plans. Microsoft also offers another MCP server for its product roadmap: see release waves retired.

• Microsoft Learn, "Use Model Context Protocol for finance and operations apps", updated 18 Aug 2026, accessed 11 Oct 2026.
• Microsoft Learn, "Build an agent with Dynamics 365 ERP MCP", updated 5 Mar 2026, accessed 11 Oct 2026.
• Microsoft Dynamics 365 Blog, "Microsoft Ignite 2025: Powering Frontier Firms with agentic business applications", 18 Nov 2025 (public preview announcement), accessed 11 Oct 2026.