Dynamics 365 ERP MCP server for Finance and Supply Chain: what it does, what it can change, how to connect

Microsoft runs an MCP server inside each Dynamics 365 Finance and Supply Chain environment, with 22 tools that read and write. Entra ID sign-in. Verified 21 Oct 2026.

Official MCP server · read & write (hosted in your environment)

Hosting: Remote HTTP, served by your own finance and operations environment at https://<your-environment-base-url>/mcp. The code isn't open source.
Auth: Microsoft Entra ID sign-in as a named user or agent identity. Other clients use an Entra app with the delegated Dynamics ERP permission mcp.tools, and the app's client ID must be on the Allowed MCP clients list.
Read / write: Read & write. Data tools create, update and delete records through OData; form tools fill in and save pages and click buttons; action tools run custom business logic.
Works with: Allowed by default: Copilot Studio, Visual Studio Code, Microsoft Cowork, Finance Agent, Finance Agent (Sydney). Microsoft also documents Foundry; other MCP clients can be allowed, and each entry has an Allowed setting an admin can review.
Plan requirement: Dynamics 365 Finance or SCM on version 10.0.47 (or 10.0.46 PQU-2, 10.0.45 PQU-7), Tier 2+ or a Unified Developer Environment. Tool calls cost 0.1 Copilot Credits each outside Copilot Studio unless the user has a Premium licence.
Last changed: 2026-08-18: main MCP, Foundry and VS Code articles revised (SQL read tool for 10.0.48); security article revised 17 Aug
Verification: Verified 21 Oct 2026 by theFinanceStack · confidence: high

What can an agent do with Dynamics 365 Finance through MCP?

Microsoft says agents can perform nearly any function available to a user in the app, within the user's roles and the documented exclusions (security and user setup forms, some controls, attachments).

Tool families

Microsoft lists three tool families.

Family	Tools	What they do
Data	Seven	Find entities and create, read, update or delete records through OData. `data_find_entities_sql` replaces the OData read tool from version 10.0.48.
Form	Thirteen	Open pages, filter grids, set values, click controls and save forms through server APIs.
Action	Two	Call classes developers have published as AI tools.

What happens when it writes

None of the tools creates a draft.
A create, update or delete commits at once, and a click on Post or Generate payments runs that action. Both are subject to the user's role and any existing workflow approvals.
Microsoft says validations and business rules run as they do in the client.

For a read-only setup

Give the identity read-only roles. Also turn off the write tools in the client: Copilot Studio's per-tool toggles or VS Code's Configure tools.

Can

Find entities and read records with OData or SQL (data tools)
Create, update and delete records through data entities, for example sales order headers (Microsoft's example), with no deep insert (data tools)
Open pages, filter grids, set values, click buttons and save, as a user would (form tools)
Run custom business logic your developers publish as AI tools (action tools)
Act under its own agent identity or on behalf of the user in the chat

Cannot

Do more than the authenticated user's security roles allow; Microsoft says it never grants more privilege than that
Open security, user setup, Entra ID application or Feature management forms (excluded by Microsoft)
Use calendar, org chart, HTML editor, radio button, time edit or custom controls, or advanced date filters (per Microsoft)
Use the document viewer, DocuUpload or FileUpload controls; Microsoft documents a separate route for attachments
Return more than 25 rows of form state per tool call (per Microsoft's agent guidance)
Work during environment servicing windows, or in Cloud Hosted Environments (per Microsoft)
Run in the in-app Copilot sidecar chat panel; Microsoft says adding the server there isn't yet supported

What access does it get?

It gets exactly the Dynamics 365 security roles of the identity that signs in. An admin also keeps a list of which agent clients may connect at all.

Where	Scopes and permissions (as documented)	Admin requirement
Dynamics 365 ERP MCP server (https://<your-environment-base-url>/mcp)	Delegated permission mcp.tools on the Dynamics ERP API ("Access Microsoft Dynamics AX MCP tools as organization users"); the Foundry guide requests https://<your-environment-base-url>/.default. Inside the app, the user's or agent's roles, duties, privileges and record-level security apply to every call.	An admin keeps the Dynamics 365 ERP Model Context Protocol server feature on (default). For any other client, the admin registers its Entra app under System administration › Setup › Microsoft Entra ID applications, mapping it to a User ID whose security roles the app then uses, and adds the client ID under System administration › Setup › Allowed MCP clients. Agent identities get the System agent role (licence exemption only) plus task roles.
Dynamics 365 ERP Apps plugin for Copilot Cowork	Same server and roles; Microsoft says users see only data they can already access.	Frontier preview enrolment, the Microsoft 365 setting Dataverse data available in Microsoft Copilot, the Finance and Operations Basic User role in Dataverse, and the Cowork client ID on Allowed MCP clients.

How do I connect it?

Microsoft documents four routes: Copilot Studio, VS Code with GitHub Copilot, Microsoft Foundry and Copilot Cowork. It recommends Claude Sonnet 4.5 as the model in each. It publishes no Claude.ai, Claude Code or ChatGPT setup.

Microsoft doesn't document Claude.ai or Claude Desktop as of 21 Oct 2026. A custom connector would need its own Entra app on Allowed MCP clients, and Microsoft documents no client ID or sign-in flow for it. To use Claude models today, choose Claude Sonnet 4.5 in Copilot Studio (tenant admin approval needed), VS Code or Foundry.

What should a finance team watch for?

The server can post, approve and delete wherever the signed-in role can, so the role you give the agent is the main control.

Give the agent identity a narrow, task-specific role. The server has no read-only mode. All tools are on by default; in Copilot Studio you can turn off Allow all and switch off tools such as data_create_entities, data_update_entities, data_delete_entities, form_click_control, form_save_form and api_invoke_action, and VS Code's Configure tools lets you uncheck them. Those toggles are a second layer. If the role can post journals or generate payments, the security role is the control that matters.
Data tool writes commit immediately, and a click on Post or Approve runs that action. Existing workflow approvals still apply, per Microsoft, so keep them on.
Microsoft's sample agent instructions tell the agent not to stop and ask the user for input. Rewrite them to require a person's confirmation before any write or posting step.
Treat record descriptions, vendor notes and attachments as untrusted text. An injected instruction in one could push the agent to approve, post or pay.
Microsoft says the server stores no customer data and that retention outside Dynamics depends on the agent client. Check that client's terms.
The Foundry route uses an Entra client secret shown once; keep it in Foundry's connection settings and out of shared files. Set a short secret expiry with a named rotation owner, and review with your identity team the implicit-grant access and ID token settings Microsoft's guide turns on.
Billing: 0.1 Copilot Credits per tool call outside Copilot Studio, waived for Finance Premium and SCM Premium users. Any other client (Claude included) bills its own token costs on top. Copilot Studio bills per Agent Action, with no extra credits when a Copilot-licensed user runs the agent under their own identity. People chatting with an agent need a Dynamics 365 user licence; an agent identity with the System agent role doesn't. Form-heavy tasks take many calls.
US English only, 25 rows of form state per response, no deep insert. The older 13-tool static server was due to retire on 1 Oct 2026.

How could finance teams and accounting firms use it?

Read tools suit questions and reporting; write tools suit preparing entries that a person reviews and posts inside Dynamics 365.

Inside a company

Ask for open purchase requisitions, vendor balances or unposted journals without building a report.
Prepare general journal lines from an accrual schedule, leaving posting to an accountant in the client.
Check vendor master data for missing bank or tax fields before a payment run.
Summarise a period's open sales orders and overdue invoices for the month-end pack.

At an accounting firm

Pull trial balance and subledger detail for a client's close review, under a read-only role the client grants.
Draft reclassification entries for the client's controller to review and post.
List journals posted by a given user or date range to support an audit sample.
Compare vendor records across legal entities to flag duplicates for the client to clean up.

Keep a person approving anything that posts, pays or deletes in Dynamics 365.

Want Dynamics 365 Finance connected to Claude for your team?

We configure scoped connections and a review step before anything changes your books. Fixed fee.

Book a 30-minute setup call

Change log

Date	Change	Source
2026-10-01	Date set by Microsoft to retire the older 13-tool static Dynamics 365 ERP MCP server	learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro
2026-08-18	Main MCP, Foundry and VS Code articles revised (security article 17 Aug); default allowed clients listed as Copilot Studio, VS Code, Microsoft Cowork, Finance Agent and Finance Agent (Sydney)	learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro
2026-06-16	Dynamics 365 ERP Apps plugin for Copilot Cowork documented, built on the MCP server	learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro
2026-01-27	General availability, per Microsoft's 2025 wave 2 release plan (public preview 19 May 2025)	learn.microsoft.com/en-us/dynamics365/release-plan/2025wave2

FAQ

Is this official?

Yes. Microsoft builds the Dynamics 365 ERP MCP server, runs it inside your finance and operations environment and documents it on Microsoft Learn.

Is it free?

Not entirely. Tool calls from clients other than Copilot Studio cost 0.1 Copilot Credits each, waived for Finance Premium and SCM Premium users, and that client bills its own model token costs on top. Copilot Studio bills each call as an Agent Action.

Does it write to my books?

Yes. It can create, update and delete records and press buttons such as Post, wherever the signed-in role allows. Microsoft says workflows and validations still run.

Is my data used to train models?

Microsoft's MCP docs don't say. Microsoft says the server itself stores no customer data and that retention depends on the agent client, so read Microsoft's and your AI provider's terms.

Can my accountant use it on my behalf?

Microsoft doesn't document this. Every call runs as the signed-in user or agent identity, so an accountant needs their own Dynamics 365 user with suitable roles.

Something wrong or out of date? Tell us and we'll email you when it's fixed.

Sources

Verified by theFinanceStack, 21 Oct 2026. Vendor list on the CFO Software Market Map courtesy of Jason Staats; AI connectivity data by theFinanceStack. Not tax, compliance or financial advice.