Dynamics 365 MCP Server: The Future of AI and ERP Integration

ERP systems hold the most critical data in an enterprise—financial records, supply chain transactions, inventory levels, supplier information, customer history. But for a long time, connecting this data to AI tools has been a challenge: custom APIs, specialized connectors, security workarounds—every attempt started from scratch. The emergence of Model Context Protocol (MCP) is changing this landscape.

What Is MCP? Why Does It Matter?

MCP is an open standard that enables AI applications to discover and invoke tools and data sources in a structured way. Think of it as a universal remote: without MCP, every AI agent needs separate wiring for each system—one wire for CRM, one for ERP, another for the data warehouse; with MCP, you plug in once and get access to everything.

The "Model Context" in MCP is equally important. AI agents don't just get raw data—they also receive detailed information about what tools exist, what they do, how to use them, and what data is available. Agents can view the tool list, understand which tool fits the current task, and invoke it correctly—this is the foundation for intelligent decision-making.

Before this, connecting an AI assistant to ERP was a full-blown project: building custom APIs, maintaining connectors, handling security challenges, and updating everything whenever the ERP changed. This approach was expensive, slow, and fragile. MCP replaces the custom bridges you had to build every time with a standard interface.

Two Types of MCP Servers in Dynamics 365

Microsoft built MCP servers for finance and operations applications, making hundreds of thousands of ERP functions discoverable and usable tools for AI agents—from creating purchase orders to posting journal entries to running financial reports, every function is exposed through a single governed interface.

Static MCP Server: The Vending Machine Model

The initially released ERP MCP server came with a fixed set of 13 tools that could perform specific actions, such as finding approved vendors or releasing purchase requisition lines. It's useful but limited—like a vending machine where you can only choose from pre-stocked options.

Dynamic MCP Server: The Supermarket Model

Microsoft then introduced the dynamic MCP server (now in public preview), which lets agents navigate ERP forms like human users: opening forms, setting field values, clicking buttons, running actions, and following the same business logic and validation rules as manual operations.

The gap between the two is enormous. The static server is a vending machine; the dynamic server is a full supermarket—you can browse every shelf and pick anything your security permissions allow. Hundreds of thousands of ERP functions across tens of thousands of forms—covering finance, supply chain, human resources, project operations—every form, action, and button a user can access is available to the agent.

For organizations with customized ERPs, the most critical point is: customizations and ISV extensions are automatically visible to agents, with no special code needed to expose custom fields or processes. As long as it's in the ERP and the user can interact with it, the MCP server can make it available.

Analytics MCP Server: Grounding Actions in Data

Actions without data are blind. Microsoft also announced a separate analytics MCP server (entering public preview in December 2025), connecting to Business Performance Analytics (BPA)—the ERP's analytical data store that unifies data from multiple ERP instances into a single schema, complete with pre-built reports and dimensional models.

The analytics MCP layer exposes just two tools: get dataset schema and execute DAX queries. The agent first requests the schema to understand available data, tables, and measures, then writes DAX queries to retrieve the needed data. This means no more building complex Power BI dashboards and waiting for refreshes—ask questions in natural language and get instant answers, such as "Who are my top 10 high-risk vendors?" or "Show me cost of sales spikes by quarter."

The real magic happens when both servers are combined: the agent uses the analytics MCP to identify vendors with more than 5 overdue invoices, flags them as high-risk, then uses the action MCP to automatically place the vendor on hold in the ERP. Insight and action form a continuous flow with no human intervention.

DAX (Data Analysis Expressions) is the formula language shared by Microsoft Power BI, Analysis Services, and Excel Power Pivot, designed specifically for performing aggregations, filters, and calculations on tabular models. Its syntax resembles Excel formulas, but it operates on entire columns rather than individual cells, enabling efficient processing of millions of rows. In BPA's semantic model, measures and table relationships are defined in DAX, so an agent writing DAX queries is effectively conversing directly with the pre-built dimensional model without first building a visualization layer. For business users familiar with Excel, DAX concepts are not unfamiliar; for AI agents, it provides a structured, verifiable query interface that allows natural language questions to be precisely translated into data operations.

Business Performance Analytics (BPA) is Microsoft's analytical data store for Dynamics 365 finance and operations. It extracts data from various ERP instances and unifies it into a single schema, with built-in pre-built reports and dimensional models. Unlike querying the ERP transaction database directly, BPA is optimized for analytical scenarios, avoiding the performance impact of running heavy queries on the business system, and providing a foundation for unified analysis across legal entities and modules. The analytics MCP server is precisely the agent interface built on top of BPA, enabling AI to access these pre-governed analytical assets in a consistent way.

Real-World Use Cases

The vendor risk management agent demonstrated in Microsoft's technical presentation monitors open invoices in the system. Once it finds a vendor with more than 5 overdue invoices, it automatically places the vendor on hold in the ERP, blocks new purchase orders, and sends an email to the accounts payable team explaining why—all without human intervention.

Capgemini's Ted Olson demonstrated prepayment invoice automation: a user asks the agent to create a prepayment proposal for a specific sales order, and the agent autonomously navigates ERP forms, sets the prepayment type to percentage, sets the value to 50%, confirms the sales order, creates the prepayment invoice, and posts it. Multiple steps across multiple forms, all completed by the agent walking through the interface like a human.

Solution architect Scott Gaines built a team of AI agents in VS Code to configure an entire ERP environment: a project manager agent coordinates the work, a solution architect agent reviews requirements, a consultant agent performs the actual setup (creating legal entities, charts of accounts, fiscal calendars), and a data migration agent uploads master data. Agents pass work between each other, partially automating a complete ERP implementation.

These are not PowerPoint concepts—they are real demonstrations from Capgemini, Scott Gaines, Avantico, and Microsoft itself. MCP already works in preview environments. The core takeaway is simple: MCP translates natural language into ERP operations—you describe what you need, and the agent figures out how to execute it.

How to Get Started

Three prerequisites are needed: a Dynamics 365 Finance and Operations environment running version 10.0.38.0 or higher; Business Performance Analytics version 2.5 or higher if using the analytics MCP; and an MCP-compatible client.

There are two ways to connect. The simplest is Copilot Studio: create a new agent, add a tool, search for Dynamics 365 ERP MCP and connect to your environment, and you can start prompting—all low-code. The second is Visual Studio, suited for more technical users or those who want to test directly.

Using the VS Code MCP client, paste the ERP MCP endpoint URL and provide credentials to connect. It takes a few more steps but is still intuitive, and Microsoft documentation provides the exact URL format.

There's an important security mechanism: agents use the security permissions of the connected user's identity. Any role-based access control set up in Dynamics 365 automatically applies—users can only see their own legal entity, and agents can only see that legal entity; if a user can't post journals, neither can the agent. The existing security model directly becomes the agent's security model.

Tips for writing good prompts: always specify the legal entity (agents won't assume—if you don't tell them, they might pick the wrong company); use clear natural language, no technical jargon needed; break complex tasks into smaller steps rather than asking for a 10-step process in a single prompt.

Limitations that need honest mention: it's still in public preview, with a 120-second execution timeout, so long-running operations may fail; each query can return about 10MB of data, sufficient for most questions but unable to handle massive data dumps; AI is not yet stable—a task it handles perfectly today may struggle tomorrow. Test thoroughly before trusting it with important transactions.

Copilot Studio is Microsoft's low-code agent-building platform where users can create, configure, and publish AI agents through a graphical interface, adding tools, knowledge sources, and conversation flows. In MCP scenarios, Copilot Studio acts as an MCP client: it has built-in support for connecting to MCP servers, and users only need to search for the target server, fill in the endpoint, and complete authentication to give agents access to the ERP toolset. This approach shields the underlying protocol details, making it suitable for business analysts or low-code developers to quickly validate ideas.

MCP client is any AI application or development environment that implements the MCP protocol, responsible for establishing connections with MCP servers, discovering tool lists, and making calls according to the protocol format. In addition to Copilot Studio, Visual Studio Code can also be used as a client through MCP extensions or built-in support, suitable for technical users who need to directly inspect request responses or perform scripted testing. Communication between client and server is typically based on JSON-RPC, with authentication relying on existing identity systems (such as Microsoft Entra ID), so the agent's permission boundaries are determined by the connected user.

Roadmap and Future Direction

Microsoft is fully betting on MCP: all new ERP agents will be built on it, and existing agents will be migrated by December 2025. This is not a side experiment—it's the strategic direction of the entire platform.

The analytics MCP will see several new features: granular schema retrieval, allowing agents to request smaller data model fragments rather than pulling everything at once, which benefits performance and managing AI model context windows; agents will be able to directly create and update dashboards and measures, not just query existing content; native integration into Copilot and Teams is also on the roadmap, letting you ask ERP data questions without leaving your daily tools.

The future scenario Microsoft envisions: a CFO opens a BPA dashboard and clicks the "Analyze" button. The agent immediately scans the data, spots a cost of sales spike, drills into supplier spending, identifies suppliers driving the increase, brings in external data like tariff changes and news, builds slides explaining root causes, and flags action items—from dashboard click to complete analysis and recommendations in seconds, with no one writing a single query.

MCP is expanding beyond finance and operations to commerce, Business Central, and customer service, creating a unified agent layer across the entire Dynamics 365 ecosystem. The partner ecosystem is also growing rapidly—RSM, HSO, FellowMind, KPMG, Crow, and others have already built agents on MCP for specific industry needs: shop floor automation in manufacturing, invoice payment agents for accounts payable, inbound load processing in logistics, and quality-impact recall agents for product safety.

Long term, MCP will become the standard way to integrate with ERP systems. The phrase "headless ERP plus agent workflows" will appear more and more—ERP runs in the background as the system of record, while AI agents handle front-end interaction. You no longer click through forms; you describe what you need, and the agent does it.

Headless ERP refers to decoupling the ERP's backend records and business logic from the front-end user interface, so that system capabilities can be consumed through APIs, agents, or other channels without forcing users to operate through traditional form interfaces. In this model, the ERP remains the authoritative source of data and processes (system of record), but the interaction layer is handled by AI agents, chat interfaces, or custom applications. MCP is precisely the key glue layer for realizing headless ERP: it exposes ERP forms and operations as agent-discoverable, invokable tools, replacing "click menus, fill fields" with "describe needs, agent executes." This shift doesn't mean interfaces disappear—it means interfaces go from being the only entry point to one of several optional entry points.

What This Means for You

For Dynamics 365 users, you'll soon be able to delegate routine tasks—posting journals, creating purchase orders, running reconciliations, checking supplier balances—by simply describing what you need rather than navigating menus. Your work shifts from execution to oversight.

For IT professionals, MCP simplifies work: no need to build custom APIs for every integration, no need to maintain separate connectors for every tool; the existing security model applies automatically, and agents inherit the permissions you've already set. Less custom code, fewer maintenance headaches, faster delivery of new capabilities.

For partners and ISVs, MCP opens new opportunities: build reusable agents that span multiple tenants; customizations are agent-ready by default, with no special exposure layer needed. What works in the ERP interface also works through MCP.

The bigger picture: this is not just a new feature—it's a structural shift. We're moving from systems of record to systems of action. ERP is no longer just storing information waiting for humans to act; it's becoming a platform where AI agents directly execute business processes. The data is still there, but now it's connected to action.

One warning: governance still matters. Plan human-in-the-loop checkpoints for high-risk operations (such as posting large financial transactions or changing supplier terms), monitor agent behavior, and maintain audit trails. Start with low-risk tasks and expand as confidence builds.

In plain terms, MCP servers give AI agents a governed way to talk to ERP—sort of like turning Dynamics 365 into a toolbox that any intelligent assistant can open and use.

One-line Summary

MCP turns Dynamics 365 ERP into a toolbox that AI agents can discover and invoke, driving the shift from systems of record to systems of action.

Paragraph Summary

The article explains how Model Context Protocol (MCP) is transforming AI-ERP integration. MCP is an open standard that lets AI agents discover and invoke ERP tools and data in a structured way, replacing the old model of building custom APIs for each system. Dynamics 365 offers two types of MCP servers: the static server exposes a fixed set of 13 tools, while the dynamic server lets agents navigate forms like humans and execute hundreds of thousands of ERP functions, with customizations and ISV extensions automatically visible; the analytics MCP server connects to BPA, supporting natural language data analysis through schema retrieval and DAX query execution. Combined, they enable a closed loop from insight to action, with real use cases covering vendor risk management, prepayment invoice automation, and multi-agent ERP configuration. The security model inherits the connected user's RBAC, but the product is still in public preview, with limitations including a 120-second timeout, 10MB query limit, and unstable AI behavior—requiring thorough testing and planned human intervention.