What is an MCP server for Microsoft Dynamics 365?
In Dynamics 365 F&O, every answer sits behind several forms: order status, stock availability, open accounts payable items. The data is there, but every click path costs business users time, and every new AI integration has so far required its own OData scripts or Power Automate flows. This is exactly where an MCP server for Microsoft Dynamics 365 comes in: it connects AI agents (Claude, GPT, Gemini, Copilot) to your Finance & Operations environment through the open Model Context Protocol, via a standardised interface instead of building each integration from scratch, and strictly within the limits that the assigned security role allows.
Important for enterprise stacks: Dynamics 365 F&O is not a lightweight tool but a full ERP with tier 2 environments, granular security roles and a complex data model of orders, items, warehouses and financial dimensions. An MCP server has to respect that depth. Separating read from write and inheriting roles are not optional extras here but mandatory. You will find more on the architecture comparison in the guide MCP vs. API & function calling.
Typical searchers work at large or upper mid-sized companies with a Microsoft stack that already run their ERP in production and have an integration budget. They want to pull recurring information and checking routines out of the ERP without sending business users through forms.
In one sentence: Dynamics 365 + MCP means a business user asks in natural language about order status, stock levels or open accounts payable items; the AI agent reads the data from F&O in line with their role, summarises it, and triggers write steps only after approval.
Use cases: what can a Dynamics 365 MCP server do in practice?
- Order status in natural language “Where does the order for supplier X for the steel beams stand?” The agent reads the order header, order lines, goods receipt status and delivery dates from F&O and gives a clear answer, without the buyer navigating through several forms.
- Anomaly detection in purchasing The agent checks orders against framework agreements and average prices and reports outliers: unusual quantities, prices above a threshold, new suppliers without master data or duplicate orders. This is an anonymised, realistic sketch, not a specific reference.
- Inventory & availability “How much of item 4711 is in the Hamburg warehouse, what is reserved, what is available?” The agent pulls together on-hand quantities, reservations and open orders, which is useful for sales and planning.
- Accounts payable and receivable enquiries Open items, due dates, payment behaviour: the agent answers questions about accounts payable and receivable from the finance modules, read-only, with a clear separation by company code and role.
- Sales workflow support From quotation line to order: the agent prepares sales orders as drafts, takes over customer terms and price lists and flags missing mandatory fields. Final approval stays with sales.
- Forecast support The agent condenses historical consumption and order data into a demand outlook and gives planners a reasoned draft; the planned requirements are booked after human review.
How the integration works
Architecture overview for Dynamics 365:
Route 1, official: AI agent ↔ Dynamics 365 ERP MCP Server (operated by Microsoft) ↔ your F&O environment
Route 2, own server: AI agent ↔ MCP server (your EU host) ↔ Dynamics 365 F&O API (OData / custom service, OAuth 2.0 via Microsoft Entra ID)
With the Dynamics 365 ERP MCP Server, Microsoft offers an official, dynamic MCP server for Finance & Operations. Through data tools (CRUD on data entities), form tools (open forms, set fields, trigger buttons) and action tools, an agent can do almost anything a user with the same security role may do in the interface. According to Microsoft, the earlier static server with 13 tools was switched off on 1 October 2026. Known limits: metadata and hints in US English only, and some controls are not supported (Microsoft Learn, as of 18 August 2026).
Mind the costs: In Copilot Studio, every tool call is billed as an “agent action” at a fixed rate. In other clients, such as Microsoft Foundry or third-party clients, Microsoft additionally charges 0.1 Copilot credits per tool call to the MCP server; the client's model costs come on top separately. According to Microsoft, users with Dynamics 365 Finance Premium or Supply Chain Management Premium are exempt from this tool fee in third-party clients.
Alongside this, your own self-hosted MCP server remains an alternative: with purpose-built tools instead of free-form form navigation, your own approval logic, your own audit log and hosting to your specifications. Which route fits depends on licensing, data protection requirements, the number of tool calls and the level of control you want.
Concrete technical steps:
- Prerequisites & feature management (official server): Microsoft specifies at least version 10.0.47, 10.0.46 PQU-2 or 10.0.45 PQU-7, a tier 2 or higher environment or a Unified Developer Environment (no cloud-hosted environments), the feature “Dynamics 365 ERP Model Context Protocol server” in Feature Management, and maintenance of the Allowed MCP Clients.
- OAuth via Entra ID (own server): The MCP server authenticates through an app registration / service principal in Microsoft Entra ID. Tokens are stored encrypted on the EU host, with a rotation and revocation strategy.
- Secure role inheritance: Access runs in the context of a defined Dynamics 365 security role. With the official server, Microsoft gives the agent only the menu items, entities and actions of that role and rejects other calls; with your own server, we implement the same via the service principal.
- Tool mapping (own server): We define MCP tools such as
get_purchase_order,list_on_hand_inventory,get_vendor_balance,create_sales_order_draft, each with a JSON schema, validated inputs and clear error messages. - Read vs. write separation: By default, the agent reads or creates drafts. Order approvals or postings require a human approval step, configurable per tool and role.
- Logging: Every action is logged with timestamp, user / service principal and diff.
Mind the setup hurdle: Activating the ERP MCP via Feature Management, registering the Allowed MCP Clients and choosing the right security role need some explanation, and depend on tier and licence. We check these prerequisites in the audit before we build.
GDPR, hosting & security
Dynamics 365 can be operated in European Azure regions, which is a good starting point. To keep the whole chain compliant with data protection requirements, we look at the following for every MCP connection to Dynamics 365:
- EU hosting of your own MCP server next to your F&O instance in a European Azure region, for example Germany West Central in Frankfurt (alternatively Hetzner), without a US edge in your own part of the chain. The official ERP MCP server is operated by Microsoft; where processing takes place there and at the AI provider, we check against the contract documents.
- Entra ID service principal with minimal scope: OAuth tokens encrypted on the EU host, rotation and revocation via Microsoft Entra ID, no permanently valid master credential.
- DPA (data processing agreement) with the AI provider with EU data residency (Claude via AWS Bedrock in the EU region Frankfurt, OpenAI Enterprise EU, Azure OpenAI in an EU region).
- Field and entity minimisation: The agent receives only the F&O entities that the assigned security role needs for the task, for example order header and order lines without access to personnel or bank data, and no blanket table release.
- Legal entity and company code separation: Through the dimensions in F&O, clients, legal entities and permissions stay cleanly separated: an agent for the DACH company sees no data of the EU sister companies.
For more on this topic: MCP server, security & GDPR.
What does it cost?
Dynamics 365 projects are more demanding than a lean API connection, because ERP depth, role model and tier prerequisites all play a part. Our approach is still predictable:
- First productive use case typically a read-only information routine such as order status or stock availability: quick benefit at low risk.
- A clear scope per use case, no hourly roulette. Scaling afterwards in clear increments.
The concrete figure is part of the initial consultation. It depends on licence tier, number of tools and tool calls, desired write permissions and whether you use the official ERP MCP server or have us build your own agent via Copilot Studio or a self-hosted MCP server. Our MCP integration agency handles the build; if you are looking for a tailored solution, you can also have an MCP server developed directly.
Related guides
Frequently asked questions
What is the difference between Microsoft's ERP MCP and your own Dynamics 365 MCP server?
Microsoft's official Dynamics 365 ERP MCP Server is dynamic: through data, form and action tools, an agent can do almost anything its security role allows in the interface. Microsoft operates it, every client must be approved under Allowed MCP Clients, and outside Copilot Studio every tool call costs 0.1 Copilot credits. The earlier static server with 13 tools was switched off on 1 October 2026. Your own MCP server allows purpose-built tools, your own approval logic, your own audit log and hosting according to your compliance requirements.
What prerequisites does Dynamics 365 need for an MCP connection?
For the official ERP MCP server, Microsoft specifies at least version 10.0.47, 10.0.46 PQU-2 or 10.0.45 PQU-7, a tier 2 or higher environment or a Unified Developer Environment (no cloud-hosted environments), the feature “Dynamics 365 ERP Model Context Protocol server” in Feature Management, registered Allowed MCP Clients and suitable security roles. We clarify the exact licence and tier constellation in the audit.
Do Dynamics 365 security roles stay in place?
Yes. The official MCP server delivers only the menu items, entities, fields and actions that the security role of the signed-in user or agent identity has access to, and rejects other calls. With your own server, the same applies to the assigned service principal. The agent cannot see or change more than the assigned role allows.
Can Dynamics 365 plus MCP be operated in a data-protection-compliant way?
Yes, if the chain is built cleanly: F&O in an EU region, your own MCP server in EU hosting or, with the official server, a check of where Microsoft operates it for your environment, and an AI provider with EU data residency and a DPA. Data minimisation and role inheritance keep access tightly limited.
Can an AI agent trigger orders or postings in Dynamics 365?
By default, the agent reads or creates drafts. We tie write actions such as order approvals to a human approval step, configurable per tool and role.
Do you want an MCP server for Dynamics 365?
A free 30-minute initial call: we check your F&O prerequisites (tier, version, roles), clarify ERP MCP vs. your own agent and estimate the project effort.
Book an AI Check arrow_forward