Dynamics 365 ERP MCP Server: The F&O Skill to Learn Now

On 15 October, Microsoft announced it had been named a Leader in the IDC MarketScape for AI-Enabled Operational ERP 2026. Analyst badges come and go, and I would not normally write a whole post about one. What caught my eye was the reason IDC gave. It said Microsoft's agentic ERP vision "is built on an open, MCP-first architecture that connects AI agents directly to business systems, data, and processes."

That one line tells Finance and Operations people where the work is heading. The piece of technology doing the heavy lifting is the Dynamics 365 ERP MCP server, and I am quite certain it will be one of the most useful things an F&O consultant or developer can learn over the next twelve months.

What is the Dynamics 365 ERP MCP server?

MCP stands for Model Context Protocol. It is an open standard that lets an AI agent connect to a business system and use it, a bit like a universal plug. Instead of building a custom connector for every agent and every scenario, the system exposes one standard doorway and any compatible agent can walk through it.

Microsoft's MCP documentation for finance and operations apps describes the server as a dynamic framework that lets agents work with data and business logic, performing "nearly any function that's available to a user through the application interface, without the need for custom code, connectors, or APIs."

It offers three kinds of tools:

• Data tools that create, read, update and delete records.
• Form tools that perform the operations available on pages in the application, the same things a user clicks through.
• Action tools that find and directly invoke classes in F&O code.

That third category is the one that makes developers sit up. An agent that can call real business logic is a very different beast from a chatbot that reads a few tables.

Why does it matter right now?

A few things have lined up this autumn.

First, the old way is gone. The earlier "static" ERP MCP server, built on the Dataverse connector framework with 13 fixed tools, was due to be retired on 1 October 2026. Anyone who built a proof of concept on it last year has a reason to revisit it, and anyone starting fresh is starting on the dynamic server.

Second, Microsoft is shipping its own agents on top. The IDC post lists the Procurement Agent, Account Reconciliation Agent, Time Entry Agent, Expense Agent and Activity Approvals Agent, all in production-ready preview. Clients will switch those on, and then they will ask for the agent that does the thing specific to their business. That is where the ERP MCP server, the Dynamics 365 ERP apps Cowork plugin and Copilot Studio come in.

Third, it is getting better quickly. A 2026 release wave 1 item moves the MCP data tools from OData to SQL. OData has limits with aggregations and query operators, which left the language model doing maths it should not be doing. Pushing that into deterministic queries means faster and more accurate answers, which is exactly what finance teams want before they trust an agent with month-end numbers.

Satya Nadella put the bigger picture neatly in the same post: "more agents don't make systems of record less important. They make trusted places to maintain information, coordinate changes, and manage state even more important." I agree completely. ERP is not being replaced by agents. It is becoming the thing every agent needs to talk to, which is great news for people who know ERP.

Will clients trust it? The security story

This is the first question every CFO and IT director will ask, so you need a crisp answer. Microsoft's security guidance for the ERP MCP server is reassuringly plain. The key points:

• Every request needs an authenticated user. There is no anonymous or shared-service route in.
• F&O security, not the MCP server, decides what is allowed. The user's roles, duties, privileges, record-level security and data security policies apply to every request.
• The server does not elevate privileges. An agent acting for a user can never do more than that user could do in the normal client.
• Business logic, validations and workflows are not bypassed. A transaction that would be rejected in the client is rejected through MCP too.
• The MCP server does not store customer data. It passes results back to the calling client.

There is one honest caveat Microsoft flags, and it is a good one to raise with clients yourself. Once data reaches the agent client, whether that is Copilot Studio, Claude or Microsoft Foundry, that client's own storage and retention rules apply. So someone has to check what the agent platform keeps and where it can send things. That someone could be you.

The practical upshot is that the security role design work F&O consultants have done for years becomes even more valuable. If an agent inherits a user's permissions, then sloppy roles become sloppy agents. Clean, least-privilege security design is about to get a lot more attention.

What do you need to get it running?

The setup is refreshingly light. According to the Microsoft Learn prerequisites:

• Your environment must be on version 10.0.47 or later, or 10.0.46 PQU-2, or 10.0.45 PQU-7.
• The Dynamics 365 ERP Model Context Protocol server feature must be on in Feature management. It is enabled by default.
• You add the agent platform you are building on to the Allowed MCP clients page.
• The environment must be Tier 2 or above, or a Unified Developer Environment. Cloud Hosted Environments are not supported.

That last point catches people out. If your sandbox is an old cloud-hosted VM, you will need a Tier 2 or a UDE to play.

For developers, the quickest way in is Visual Studio Code. Microsoft has a short guide to connecting VS Code to the ERP MCP server: run MCP: Add Server, choose HTTP, enter your environment URL with /mcp on the end (for example https://contoso.operations.dynamics.com/mcp), then sign in with your F&O credentials. Within minutes you can ask questions of your own test data and see which tools the server exposes.

Who wins from this?

Honestly, most of the F&O world, as long as people lean in.

Technical consultants and X++ developers

Action tools invoke classes in F&O code, so the people who understand that code base suddenly hold the keys. Knowing which classes are safe to expose, which need wrapping, and how to make custom logic agent-friendly is a rare and valuable skill. I expect to see "MCP" appear in technical job specs within months.

Functional consultants

Agents need someone who understands the process. Which approvals should an agent prepare, and which must stay with a human? Where does the Account Reconciliation Agent stop and the controller take over? Functional people who can write clear agent instructions grounded in real processes will be in demand, and you do not need to write code to do it.

Security and governance specialists

As above, the agent inherits the user's access. People who can design roles, audit agent clients and explain data residency to a nervous board are going to be very busy.

Solution architects

IDC called out that more than a third of Dynamics 365 customers go live in under six months. Faster projects mean more of them, and each one now has an agent layer to design. Architects who can draw the line between standard Microsoft agents, Cowork plugins, Copilot Studio agents and custom MCP work will win the bigger engagements.

A realistic view on the hype

None of this means agents will run your client's general ledger next Tuesday. Most of the Microsoft agents are still in production-ready preview, licensing and capacity questions are still being worked through on many projects, and plenty of F&O estates are a few versions behind 10.0.47. Data quality is still data quality. An agent reading a messy item master will produce messy answers, just faster.

But the direction is clear, and it is a happy one. The hard part of agentic ERP is not the AI. It is the governed business logic, the security model and the process knowledge, and those are exactly the things experienced D365 people already have. This is a chance to move up the value chain rather than a threat.

Your first weekend with the ERP MCP server

Here is a short list you can work through without anyone's permission:

• Read the MCP overview on Microsoft Learn end to end. It is shorter than you think.
• Check what version your sandbox is on, and whether it is Tier 2, a UDE or a cloud-hosted VM.
• Connect VS Code with GitHub Copilot to a test environment and ask it simple questions, like open purchase orders for a vendor or customers over their credit limit.
• Try one form tool and one action tool so you understand the difference in practice.
• Log in as a test user with a narrow security role and repeat the same questions. Watch the answers change. That is the best demo you will ever give a client.
• Write a one-page note on how you would govern agent clients on your next project, covering who approves them, what they can store and how you would monitor them.
• Add "Dynamics 365 ERP MCP" to your CV and LinkedIn once you have genuinely used it. Recruiters are already searching for it.

What to do next

If you are a consultant or developer, browse current D365 jobs and look for roles mentioning agents, Copilot Studio or MCP, and check your rate against our D365 salaries data. You can also add yourself to our consultant directory so employers looking for agent skills can find you.

If you are hiring, post your role through our employers page, and if you are weighing up tools that sit alongside the MCP server, browse the products and vendors in the D365 Market directory.

The doorway is open and the version you need is already out. Go and have a look this weekend.