The Business Central MCP server lets AI agents built outside BC read and act on your data. That is powerful, and it is a door into your ERP. Which API pages to expose, which permissions to give, how to register clients in Entra, what to log, and the checklist to run before you switch anything on.
The Business Central MCP server (generally available since April 2026, at mcp.businesscentral.dynamics.com) lets agents in Copilot Studio, Visual Studio Code and registered third-party clients discover and use Business Central data and actions, under Business Central's own permissions. It's the most important AI capability in the platform, and it deserves the same care as opening any integration into your ERP. (See agentic AI in Business Central for the background.)
You choose which API pages the MCP server exposes in a configuration, and static validation checks it before it's used. Start with the minimum for the use case: a credit control agent needs customers and customer ledger entries, not vendors, G/L or setup tables. Prefer read-only pages. Expose write operations only where a specific, approved agent needs them. Keep separate configurations for separate purposes rather than one that exposes everything.
The MCP server acts with the permissions of the identity the agent uses. That permission set is the real control. Create one per agent or use case, with read access to exactly the tables needed, and no posting, no setup, no bank details, no SUPER. If an agent must create something, give it insert on that table only, and keep posting with a person. (See permissions.)
Copilot Studio and Visual Studio Code are pre-authorised. Third-party MCP clients must be registered in Microsoft Entra ID. Register each one separately with a clear name, so you can see and revoke it individually. Don't share one registration across tools. Use OAuth as designed; don't build workarounds with stored passwords.
Try everything in a sandbox first (environments). Point development agents at sandboxes only. Production access is a separate, approved step.
MCP calls are logged with success or failure, and configuration changes are audited through Microsoft Purview. Make sure someone looks at the logs: unusual volumes, failures, access outside working hours, new clients. Telemetry in Application Insights gives you more (telemetry).
Anything the agent reads may end up in its context or memory, outside Business Central. Think about personal data before you expose it, and record the processing (see AI and data protection).
