Dynamics 365 Business Central API facts that shape an MCP server
| Fact | Detail | Source |
|---|---|---|
| Status and scope | Microsoft’s MCP documentation applies to Business Central online. Update 28.0 (2026 release wave 1) lists "Create agentic experiences with enhanced MCP server (now from Visual Studio Code and other MCP-compliant clients)" as generally available. | Microsoft Learn: Business Central update 28.0 |
| Endpoint and headers | All clients use https://mcp.businesscentral.dynamics.com and choose the environment with TenantId, EnvironmentName and Company headers, plus an optional ConfigurationName. Values with non-ASCII characters must be Base64-encoded. | Microsoft Learn: MCP in Business Central |
| Authentication | OAuth 2.0 authorization code with PKCE against Microsoft Entra ID, with Protected Resource Metadata for discovery. Every operation runs with the signed-in user’s identity and permissions, so audit trails show who did what. | Microsoft Learn: MCP in Business Central |
| Non-Microsoft clients | VS Code and Copilot Studio use a preregistered app. Claude, ChatGPT and other hosts need your own Entra app registration, because Entra ID doesn’t support dynamic client registration, with the delegated Business Central permission Financials.ReadWrite.All and admin consent. | Microsoft Learn: Non-Microsoft MCP hosts |
| Read-only by default | Out of the box the server gives read-only access to all exposed API pages. Writes need an MCP Server Configuration with Unblock Edit Tools on and Allow Create, Modify, Delete or Bound Actions set per API page; configuring it takes the MCP - ADMIN permission set or equivalent. | Microsoft Learn: Configure the Business Central MCP server |
| Tool limits | Copilot Studio currently allows 70 tools per agent, so Dynamic Tool Mode replaces per-page tools with bc_actions_search, bc_actions_describe and bc_actions_invoke. ListPart and CardPart API pages aren’t supported as tools. | Microsoft Learn: Configure the Business Central MCP server |
| Next release | Update 29.0, in public preview on sandbox environments with general availability planned for October 2026, adds MCP tools to define, validate and run custom data queries for data that has no API. | Microsoft Learn: Business Central update 29.0 preview |
| API limits | Business Central online allows each user 6,000 OData requests in a 5-minute sliding window and 5 concurrent requests. Requests over the rate get HTTP 429, a request times out after 8 minutes, and an environment can hold up to 200 webhook subscriptions. | Microsoft Learn: Business Central operational limits |
| Webhooks | API subscriptions notify your URL when entities change, after a validation handshake. Subscriptions expire after three days unless renewed with a PATCH request. | Microsoft Learn: Business Central webhooks |
| Sandboxes | Premium and Essential subscriptions include one production and three sandbox environments at no extra charge, so MCP configurations can be tested on a sandbox first. | Microsoft Learn: Production and sandbox environments |
| On-premises APIs | Business Central on-premises exposes the API once an admin enables OData and API Services on the server instance (Set-NAVServerConfiguration with ApiServicesEnabled set to true). A custom on-premises MCP server calls these endpoints. | Microsoft Learn: Enabling APIs on-premises |
Every way to connect Dynamics 365 Business Central to AI
| Option | Type | Fits when | Limits |
|---|---|---|---|
| Business Central MCP server (Microsoft) | Official | Online customers who want governed access from Copilot Studio, VS Code, Claude or ChatGPT under each user’s permissions, with write control per API page. | Online only. Tools are API pages, so the business logic is whatever the APIs expose, and non-Microsoft clients need an Entra app registration plus custom headers. |
| Business Central connector for Power Platform | Official | Copilot Studio agents that need simple, predefined create, read, update and delete actions and Power Automate flows, acting as the user. | Copilot Studio and Power Platform only, and less suited to multi-step AI orchestration, per Microsoft. |
| Admin center MCP server (preview) | Official | Administrators who want an agent to help with environment tasks in the Business Central admin center. | Administration only, not business data, and in public preview. |
| SShadowS business-central-mcp | Community | Testing on BC27 or BC28 on-premises, where no official server exists; it also runs against online sandboxes. | Unofficial and MIT-licensed. It talks to Business Central through the web client’s WebSocket protocol, which its maintainer describes as reverse-engineered, not through documented APIs; on-premises sign-in uses NavUserPassword. |
| Custom MCP server on Business Central APIs | Custom | On-premises deployments, tools that combine Business Central with other systems, business rules and approvals beyond per-page CRUD, and background agents with their own service identity. | You host and secure it; on-premises needs API Services enabled and a safe network path for cloud AI clients. |
Tools a Dynamics 365 Business Central MCP server should expose
Start with read-only tools and add write actions once the team trusts the answers. Every write action below runs with a confirmation or approval step.
| Tool | Access | Risk | Purpose | Guard |
|---|---|---|---|---|
get_customer_overview | Read | Low | Balance, overdue amount, credit limit and recent orders for a customer. | Runs as the signed-in user through API v2.0; the company is fixed per session. |
list_open_sales_orders | Read | Low | Open sales orders by customer, date or salesperson. | Read-only; results paged. |
get_item_availability | Read | Low | Inventory and projected availability by location. | Read-only; location filter required. |
get_vendor_aging | Read | Medium | Open vendor ledger entries grouped by due date. | Read-only; the user’s permission sets decide which vendors appear. |
run_approved_query | Read | Medium | Run a reviewed query for data that has no standard API page. | Only reviewed, versioned query definitions; no ad-hoc queries in production; row cap. |
create_sales_quote | Write | Medium | Create a sales quote and return totals before saving. | Saves only after the user confirms; prices and discounts come from Business Central; Allow Create only on the quotes page. |
post_sales_invoice | Write | High | Post a sales invoice through its bound action. | Explicit approval; checks the user’s posting permissions and allowed posting dates first; logged with user and document number. |
update_customer_contact | Write | Medium | Change a customer’s email, phone or address. | Confirmation with before-and-after values; Allow Modify only on the customers page. |
Connect it to Claude, ChatGPT or Copilot Studio
Claude
Microsoft’s steps for non-Microsoft hosts use Claude Code: register an Entra app with Financials.ReadWrite.All, then add https://mcp.businesscentral.dynamics.com with the TenantId, EnvironmentName and Company headers and your client ID. In claude.ai and Claude Desktop, a custom connector takes the URL plus an OAuth client ID and secret; Claude’s request-header option is a beta for a limited set of organizations, and non-standard header names need Anthropic’s approval, so many teams will need a small proxy that adds the headers.
ChatGPT
Microsoft lists ChatGPT among supported MCP hosts. In developer mode (Pro, Plus, Business, Enterprise and Education on the web), add the server URL under ChatGPT Plugins with OAuth, using the same kind of Entra app registration. OpenAI’s developer mode documentation doesn’t describe custom request headers, so test how the environment headers are supplied or route through a proxy. Tools without a readOnlyHint ask for confirmation.
Microsoft Copilot Studio
The most direct route: Copilot Studio uses Microsoft’s preregistered app, handles the header encoding, and lets agent makers pick an MCP server configuration by name. You need a Copilot Studio license with Copilot Credits capacity and generative orchestration turned on. Keep agents under 70 tools, or turn on Dynamic Tool Mode.
Claude implementation · Copilot implementation · ChatGPT implementation
Permissions, identity and audit
- The MCP server runs every call as the signed-in user, so Business Central permission sets decide what each person can read or change, and the audit trail shows who did it.
- The MCP configuration adds a second layer: per API page, Allow Read, Create, Modify, Delete and Bound Actions. A user needs both the permission set and the configuration’s allowance.
- Keep Discover Additional Objects off in production, since it gives read access to every API page in the environment.
- Only users with MCP - ADMIN (or equivalent) should create or change configurations. Export them as JSON and review changes like code.
- For background agents with no user present, a custom server can use service-to-service authentication (OAuth client credentials) with a Microsoft Entra application registered in Business Central. Such apps can’t be given SUPER; assign only the permission sets they need and check Microsoft’s licensing guide for the scenario.
Hosting and network
- Online: Microsoft hosts the MCP server, so there is nothing to deploy, and clients call it over the internet.
- On-premises: there is no official server. A custom or community server runs inside your network next to the Business Central service tier and needs a secure path for cloud AI clients, such as an allowlisted HTTPS endpoint for Claude, ChatGPT’s Secure MCP Tunnel, or a published endpoint for Copilot Studio.
- Build and test configurations on a sandbox, export them as JSON, and import them into production.
- Plan for API limits of 6,000 requests per 5 minutes per user; agents that loop can hit them, so cap how many calls one prompt can fan out.
Cost and timeline
- Turning on the official server and building read-only configurations is configuration work, not a build. Copilot Studio agents need Copilot Studio licenses with Copilot Credits.
- A focused custom Business Central MCP server, for example for on-premises or for business-rule tools, typically takes two to four weeks including security and evaluation.
- Multi-system agents (Business Central plus a CRM or WMS) and approval workflows take longer and are scoped after a short discovery.
Dynamics 365 Business Central MCP questions
Does Business Central have an official MCP server?
Yes, for Business Central online. Microsoft’s server became generally available with update 28.0 and works with Copilot Studio, VS Code with GitHub Copilot, and other MCP clients such as Claude and ChatGPT.
Does the MCP server work on-premises?
No. Microsoft’s MCP documentation applies to Business Central online only. On-premises you can test a community project or run a custom MCP server that calls the on-premises APIs once API Services is enabled.
Can it write data?
Only if you allow it. The default is read-only on all exposed API pages; an admin must create a configuration that unblocks edit tools and allows create, modify, delete or bound actions page by page.
Does it work with Claude?
Yes, Microsoft lists Claude as a supported host. You register your own Entra app because Entra ID doesn’t support dynamic client registration, grant Financials.ReadWrite.All, and send the TenantId, EnvironmentName and Company headers; Microsoft’s example is for Claude Code.
Do AI users need Business Central licenses?
Every call runs as the signed-in Business Central user, so each person needs their own Business Central user with the right permissions. Copilot Studio agents also need a Copilot Studio license with Copilot Credits; Microsoft’s MCP pages don’t list a separate MCP fee.
MCP server or the Business Central connector?
Microsoft positions the Power Platform connector for simple, predefined CRUD and Power Automate, and the MCP server for AI agents that chain steps. You can use both in one Copilot Studio agent.
How many tools can an agent use?
Copilot Studio currently caps an agent at 70 tools. Dynamic Tool Mode replaces per-page tools with three search, describe and invoke tools, so large configurations still work.
Build or buy?
Online: start with the official server and add a custom server only for cross-system tools, business rules or background agents. On-premises: build, or test the community project first. AIONDATA builds these read-only first, under the user’s identity, with writes behind approval.
