Business Central MCP server

Business Central as a mid-market ERP — and why MCP works so well here

Microsoft Dynamics 365 Business Central is the ERP for mid-sized companies: inventory, financial accounting, purchasing, sales and warehouse in one system. Precisely because so much converges there, the typical bottleneck arises — the data is there, but every answer requires navigating lists, cards and reports. An MCP server for Business Central turns this depth into a dialogue: the AI agent queries the ERP directly, instead of a person clicking through document screens.

The special thing: Microsoft runs its own MCP server for Business Central online, available at https://mcp.businesscentral.dynamics.com. According to the release plan, the extended version has been generally available since 1 April 2026, with OAuth 2.1 via Microsoft Entra ID (Microsoft release plan). Visual Studio Code and Copilot Studio are pre-approved; further MCP clients can be registered via Entra ID. The server exposes Business Central API pages and API queries as tools.

Important on the default configuration: Without your own setup, a built-in default configuration is active that makes all suitable API pages and API queries readable for which the signed-in user has permissions (Microsoft Learn: Configure Business Central MCP Server). The boundary is then drawn solely by the user’s Business Central permissions. To restrict the agent to specific pages, you create your own configuration and set it as the default. In addition there are the Data Query Tools (preview), with which agents can run read queries directly against the database; we switch those on only deliberately.

Use cases: what can be implemented with Business Central + MCP?

The following typical use cases can be implemented via the API pages of a custom configuration:

1. Customers & open items on demand “What is the open balance of customer Müller GmbH?” — “Show me all overdue receivables over €5,000.” The agent reads the customer and open-item pages and supplies the answer, without anyone opening the account statement.
2. Sales documents as drafts From an email or note, the agent creates a sales quote or an order draft in Business Central — customer, items, quantities and prices pre-filled. You review and approve.
3. Item & stock information “Which items are below minimum stock?” — “What does item 1928-S cost to purchase?” The agent pulls item master data and stock directly from the ERP.
4. Vendors & purchasing Check vendor balances, list open purchase orders, assign incoming invoices to a vendor — as a guided routine instead of a screen marathon.
5. Financial accounting & reporting Query G/L accounts, aggregate revenue by dimension or cost centre, a short monthly overview in plain text — the agent condenses the financial figures from Business Central.
6. Master data maintenance with plausibility check Create new customers or items, flag missing VAT IDs or IBANs, detect duplicates. The agent keeps the master data clean, instead of nobody doing it.

How the integration works

The architecture for Business Central is pleasingly short, because Microsoft supplies the server:

AI agent (Copilot Studio / VS Code / another client registered via Entra ID) ↔ Business Central MCP server (mcp.businesscentral.dynamics.com) ↔ API pages and API queries of your BC environment

The concrete steps in practice:

• Own MCP server configuration in BC: In Business Central we create our own configuration, add the API page objects the use case needs — such as customers, items, sales documents —, leave “Discover Read-Only Objects” off and set it as the default. Otherwise the built-in default configuration applies, which exposes all API pages and queries readable for the user.
• Define operations per page: For each page we determine which actions are allowed — read, create, modify, delete or bound actions (e.g. posting). Each permitted operation becomes its own tool in the MCP server.
• Read access as the default: The default configuration is read-only. Write and posting permissions require the “Unblock Edit Tools” switch and an approval per object — a deliberate decision per use case, not automatic.
• User permissions: The agent works with the Business Central permissions of the signed-in user. A tightly scoped user or permission set is therefore the second boundary alongside the configuration.
• Client connection: The MCP server is connected to the AI client via Entra ID authentication — in testing, for example via VS Code, in production via Copilot Studio or your own client registered in Entra ID.
• Approval logic & logging: Write actions run through a confirmation step where sensible; every operation can be traced in the ERP telemetry and audit context.

We show in detail what such a tool mapping looks like in the MCP cluster — and you can read how we deliver projects of this kind under MCP integration agency.

GDPR, hosting & security with Business Central

Business Central is a cloud ERP — so data sovereignty depends heavily on the region your tenant runs in and where the AI agent sends the content. For a clean Business Central MCP connection, we therefore pay attention to the particularities of this system:

• EU data region for the BC tenant: We make sure your Business Central environment is hosted in an EU region, so that ERP data does not leave the European Economic Area.
• Keep API pages tight: Through your own configuration, the agent gets only the pages a use case really needs. Payroll data or confidential accounts can be deliberately left out — data minimisation directly in the configuration.
• Entra ID instead of secret sprawl: Authentication runs via Microsoft Entra ID with defined permissions, not via freely circulating API keys.
• AI provider with EU data residency: We connect the AI part in an EU-compliant way — Claude via AWS Bedrock (Frankfurt region) or Google Vertex AI (EU), alternatively Azure OpenAI in an EU region or OpenAI Enterprise with EU data residency, each with a DPA. Microsoft itself runs the MCP server.
• Read / write separation: Posting-relevant actions are enabled separately and logged — so it stays clear what an agent was allowed to do automatically and what a human confirmed.

What about the effort?

Because the MCP server for Business Central comes from Microsoft, building your own connector is unnecessary — the effort shifts from “develop a server” to “configure it correctly”. That makes such projects plannable:

• Think per use case: We start with one clearly outlined use case — such as customer information or quote drafts — and expand in small steps.
• Configuration before code: The focus is on page selection, permissions and approval logic, not on weeks of custom development.

We give the concrete framework in the free initial conversation, depending on use cases, page scope and the desired depth of write and posting access.

Frequently asked questions

Does Business Central have an official MCP server?

Yes. Microsoft runs its own MCP server for Business Central online at https://mcp.businesscentral.dynamics.com, generally available in extended form since 1 April 2026 according to the release plan. It exposes API pages and API queries as tools, with OAuth 2.1 via Microsoft Entra ID. Visual Studio Code and Copilot Studio are pre-approved; further MCP clients can be registered via Entra ID. So you do not need a self-built connector.

Is this the same as the MCP server for Finance & Operations?

No. Business Central is the ERP solution for mid-sized companies and has its own MCP server. Finance & Operations (enterprise) has a separate implementation with different tooling, the Dynamics 365 ERP MCP Server. Here we deal explicitly with Business Central.

Can the AI agent really post in Business Central?

Technically yes: bound actions can also trigger postings if a configuration allows it. The default configuration is read-only. We enable write permissions and postings selectively and secure them with an approval step.

Which data does the agent see — and which not?

That depends on the configuration. The built-in default configuration makes all suitable API pages and API queries readable for which the signed-in user has permissions. With your own configuration as the default and a tightly authorised user, the agent gets only the pages the use case needs; sensitive areas such as payroll or certain G/L accounts then stay out. We leave the Data Query Tools (preview) off unless they are explicitly needed.

How does this become privacy-compliant?

It becomes privacy-compliant when the BC environment runs in an EU region, a custom configuration exposes only the required API pages instead of the read-only default configuration, and the AI provider is connected with EU data residency and a DPA — for example Claude via AWS Bedrock in Frankfurt or Azure OpenAI in an EU region.

Which AI models can be connected?

Microsoft names Visual Studio Code and Copilot Studio as pre-approved clients; further MCP clients can be registered via Microsoft Entra ID. Which model runs behind them depends on the client. Switching models is possible without a new integration, because MCP is the common standard.