AI Agents in Dynamics 365 Business Central: The Intelligent Operational Core for SMBs

  • Thread Author
The February installment of the AI Business Solutions Partner Show made a clear, practical case for what many partners have been waiting to see: real, production-ready AI agents that can understand Dynamics 365 Business Central data, follow ERP business rules, and take meaningful actions on behalf of users. Microsoft’s Blazej Kotelko, Business Central Product Manager, walked partners through how those agents are being built in Copilot Studio, the connectivity options (Business Central MCP servers and the Power Platform connector), and how agents are published into Microsoft 365 Copilot and other channels — positioning Business Central as the “intelligent operational core” for AI-driven SMBs and mid-market enterprises. (msdynamicsworld.com)

Background / Overview​

Microsoft’s recent product work has turned Copilot Studio from a prototyping environment into a platform for authoring, connecting, and operating fleets of agentic assistants that can act on enterprise data and workflows. Copilot Studio offers a graphical, low-code canvas for composing agents, wiring tools, and orchestrating multi-step workflows; organizations can include both low-code connectors and Model Context Protocol (MCP) endpoints to give agents structured, model-aware access to business systems. (learn.microsoft.com)
Business Central has been an early focus for these capabilities because ERPs are where operational truth lives — invoices, customers, inventory, pricing, approvals and audit trails. Microsoft has shipped built-in, purpose-specific agents (for example, Sales Order and Payables agents) while also enabling partners and makers to construct custom agents that call Business Central APIs, invoke AL extensions, and enforce server-side business logic. That combination — prebuilt agents for rapid value and an extensible platform for bespoke scenarios — is the core message Kotelko brought to the Partner Show. (learn.microsoft.com)

Why Business Central as the “Intelligent Operational Core” Matters​

Business processes are the place where information becomes decisions and decisions become action. Turning Business Central into an operational core for AI agents matters for three practical reasons:
  • Business Central already contains authoritative transactional data (orders, invoices, inventory, ledgers) and rule logic (pricing, validations, workflows). Agents that interact with those records can automate end-to-end business tasks rather than only creating advisory outputs. (learn.microsoft.com)
  • Microsoft’s platform-level investments — Copilot Studio, MCP servers, connector catalogs and Microsoft 365 Copilot — let partners build once and publish agents into multiple endpoints (Teams, 365 Copilot, websites), shortening time-to-value. (learn.microsoft.com)
  • The combination of model-aware access (MCP) and low-code connectors allows partners to balance safety, performance, and extensibility when agents need to perform record-level writes or complex multi-step workflows. (learn.microsoft.com)
These are not speculative claims. Microsoft’s documentation shows agents that can ingest email attachments, extract sales order data, match customers, check credit, and create sales documents — all with built-in oversight capabilities for human review and approval. That operational depth is what Kotelko described as making Business Central uniquely positioned for this agent era. (learn.microsoft.com)

How Agents Connect to Business Central: Connector vs MCP Server​

One of the most important technical decisions for partners building agents is how the agent accesses Business Central data and APIs. Microsoft documents two primary options — each with different trade-offs.

Business Central Connector (Power Platform)​

  • Designed for low-code scenarios and Power Platform makers.
  • Provides simplified CRUD-like actions for common Business Central entities (customers, items, invoices).
  • Acts in the identity of the user and respects Business Central permissions and role-based access control.
  • Best when the agent needs to perform standard operations with minimal setup.
The connector is intentionally opinionated and abstracted for speed and safety, making it an excellent choice for many partner scenarios where the agent needs to act like a human user within standard application semantics. (learn.microsoft.com)

Business Central MCP Server (Model Context Protocol)​

  • Uses MCP to present Business Central APIs and domain model in a machine-friendly, semantically aware way.
  • Provides the greatest flexibility for orchestrating multi‑step, transactional agent workflows and for invoking custom AL APIs and server-side business logic (pricing, validations, dimension handling).
  • Ideal when performance, complex orchestration, or fine-grained API control matters, or when agents must coordinate several system calls within one atomic flow.
  • MCP configurations can be scoped to specific companies, environments, and API pages with explicit permission settings.
Microsoft’s guidance is pragmatic: choose the connector for standard, low-risk interactions and the MCP server when you need agentic orchestration, extensibility, and production-scale control. Many real implementations will combine both approaches to get the best of each. (learn.microsoft.com)

What Partners Can Build Today: Real Agent Scenarios​

The Partner Show highlighted practical patterns that partners can adopt immediately, and Microsoft’s product pages document built-in examples that partners can use as templates.

Built-in and near-term agent templates​

  • Sales Order Agent: monitors email (or other intake channels), extracts structured order data from attachments or messages, locates or creates the customer in Business Central, and generates a draft sales order for human review. This pattern removes manual order entry bottlenecks while keeping supervision in the loop. (learn.microsoft.com)
  • Payables Agent: monitors vendor inboxes for invoices, extracts invoice content, maps it to vendors and purchase orders, and prepares invoice drafts for posting — again with supervisor review capability to reduce erroneous postings. (learn.microsoft.com)

Partner-led, verticalized agents​

  • Inventory optimization agents that read on-hand and forecast data, then create replenishment orders or proposals.
  • Collections agents that triage overdue accounts, assemble context-rich cases, and draft communications for finance teams.
  • Pricing and promotions orchestration agents that evaluate rules, test scenarios and execute bulk price updates while respecting approvals and audit trails.
Third-party partners are already packaging specialized agent experiences (for example, operators offering prebuilt Sales Order and Procurement agents tuned for industry-specific data), which helps accelerate adoption for customers that are not ready to build from scratch. (levelshift.com)

The Technical and Governance Stack Partners Must Master​

Bringing agent scenarios to production requires more than an agent script; it requires a disciplined stack covering connectivity, identity, governance, monitoring, and incident handling.

Key plumbing components​

  • Copilot Studio: the authoring surface where agents are defined, tools are wired, and orchestration flows are created. (learn.microsoft.com)
  • MCP Servers / Connectors: the runtime tools agents call to read and write Business Central records. MCP server definitions can be published into Copilot Studio’s catalog so agents can discover and use them. (learn.microsoft.com)
  • Microsoft 365 Copilot and channels: published agents can appear inside Microsoft 365 Copilot, Teams, websites, and other channels to reach users where they already work. (learn.microsoft.com)
  • Runtime governance (Agent 365, external monitors): enterprises need the ability to intercept, approve, or block agent actions while they execute — a capability Microsoft is addressing through runtime monitoring and integrations with security stacks and third‑party gatekeepers. Partners should plan for an enforcement point to manage high-risk operations like financial postings or data exfiltration.

Operational controls and observability​

  • Logging, telemetry and searchable audit trails for every agent action.
  • Human-in-the-loop checkpoints for financial or otherwise irreversible operations.
  • Cost and quota controls for model calls and connector/API usage.
Several vendors and Microsoft initiatives are building the governance tooling partners will need: from Agent 365 control planes to third‑party runtime monitors (XDR/DLP integrations) and backup/rewind capabilities for agent actions. These guardrails are not optional for production ERP automation.

Strengths and Opportunities for Partners​

Microsoft’s stack unlocks concrete advantages for Business Central partners:
  • Speed-to-value with low-code plus model-aware depth. Copilot Studio’s low-code canvas plus MCP-backed access gives partners a fast path for putting prebuilt agents into production and the extensibility to handle complex scenarios. This combination reduces the need for large bespoke projects for many valuable automations. (learn.microsoft.com)
  • Operational fidelity and rule preservation. Agents that call Business Central APIs via MCP or connector will naturally surface server-side validations, pricing logic, and dimension/posting rules. That preserves the accounting and audit semantics partners and customers expect from ERP automation. (learn.microsoft.com)
  • Multi-channel reach. Agents authored once can be published into Microsoft 365 Copilot, Teams, and web channels — multiplying user adoption vectors without duplicate engineering. (learn.microsoft.com)
  • Partner productization opportunity. Companies that create hardened agent templates for specific verticals (retail order intake, distributor invoice processing, services time capture) can productize these as IP and accelerate customer deployments. Market evidence shows vendors already packaging these offerings. (levelshift.com)

Risks, Unknowns, and What Partners Must Watch​

Despite the promise, the agent era brings non-trivial risks and operational challenges partners must manage deliberately.

Data governance, privacy, and leakage risk​

Agents are designed to read, summarize, and act on sensitive ERP data. Without careful governance, agents can inadvertently surface PII, financial details, or confidential terms into a model’s context or external systems. Enterprises must define strict data handling rules, use runtime DLP and external monitors where needed, and ensure MSP/partner contracts clearly define responsibilities. Recent vendor integrations highlight the industry’s growing attention to runtime prevention and DLP for agents.

Security and approval semantics​

When agents can post transactions or change customer balances, the wrong action can create immediate financial risk. Partners must design human‑in‑the‑loop checkpoints for high-risk operations, implement near-time approval/monitoring integration patterns, and leverage vendor capabilities (for example, runtime monitors that approve/block actions) rather than relying solely on after‑the‑fact logs. Microsoft and third-party security vendors are adding runtime enforcement to the agent execution path to address this.

Compliance and auditability​

ERP changes must remain auditable. Agents must not bypass server-side logging or approvals, and any automated workflows must create clear traceability (who/what acted, which model version, which inputs led to a change). Partners should plan for long-term retention of agent telemetry and replay capabilities to support audits and incident response. Rubrik and similar vendors are beginning to surface agent lifecycle and rewind features for this reason.

Model provenance and multi-model complexity​

Microsoft’s platform is increasingly multi-model (including OpenAI and Anthropic models within Microsoft 365 Copilot). Partners should document which models their agents use, how prompts and tuning are applied, and test behavior under multiple model back-ends. Model drift, differences in reasoning, and regulatory concerns (data residency, third-party model hosting) are operational realities partners must accommodate. (theverge.com)

Operational fragility and UI automation limits​

Copilot Studio includes features that allow agents to “use a computer” — interacting with web pages and desktop UIs when APIs are absent. That capability broadens reach but can be brittle; UI automation can break when vendors update pages. Partners should prefer API-driven MCP or connector approaches for mission-critical flows and reserve computer-use techniques for fallback or light‑weight automations, with robust monitoring and retraining plans. (theverge.com)

A Practical Roadmap: How Partners Should Get Started​

Partners that move deliberately will capture the lion’s share of early opportunities. Below is a practical sequence to design, build, and operate Business Central agents responsibly.
  • Identify and quantify candidate processes.
  • Target high-frequency, high-effort, low-expertise tasks first (order intake, invoice capture, routine reconciliations).
  • Measure current manual cost, error rates, and potential time-savings to build a clear business case.
  • Choose the right connectivity pattern.
  • Use the Business Central Connector for straightforward CRUD-style automations where identity delegation and low-code speed are priorities.
  • Use the Business Central MCP Server when you need atomic orchestration, custom AL API calls, or better performance and model-awareness. In many cases, use both where each is strongest. (learn.microsoft.com)
  • Define MCP configurations and least-privilege permissions.
  • Configure MCP exposures to only the API pages agents need; avoid broad “read/write all” exposures.
  • Map agent identities to least-privilege roles and ensure separation of duties for sensitive operations. (learn.microsoft.com)
  • Design guardrails and human‑in‑the‑loop flows.
  • Require human approval for irreversible financial actions, bulk updates, or price and credit changes.
  • Integrate runtime monitors and external policy engines to intercept and approve or block risky actions.
  • Author, test, and tune in Copilot Studio.
  • Use a sandbox Business Central environment for iterative testing; include negative test cases and adversarial prompt tests.
  • Track model versions, prompt recipes and test coverage; prepare rollback plans. (learn.microsoft.com)
  • Publish thoughtfully, measure continuously.
  • Publish first to Teams or a pilot group in Microsoft 365 Copilot to collect real-world feedback.
  • Instrument for telemetry, usage, error-rates, and business outcome KPIs (order throughput, invoice cycle time, error reduction).
  • Productize and scale.
  • Convert repeatable agent designs into partner IP or managed service offerings.
  • Offer managed governance and monitoring as part of the service, and establish change control for MCP configurations and AL extension updates.
Following this path helps partners reduce risk while increasing the speed of customer value realization.

Case study fragments and partner examples (what’s already working)​

Microsoft and ecosystem partners have already shown concrete integrations that illustrate the platform’s traction:
  • Copilot-built Sales Order and Payables agents demonstrate that intake automation with human oversight reduces manual data entry while preserving Business Central’s server-side rules. (learn.microsoft.com)
  • Industry data providers and integrators (for example, financial data vendors exposing MCP-managed endpoints) are wiring high-value datasets directly into Copilot Studio so agents can reason with licensed, timely data. These MCP-first integrations shorten the path from insight to action.
  • Security and operations vendors are integrating runtime policy controls into Copilot Studio, enabling enterprises to intercept agent actions before execution. This trend highlights industry recognition that governance must be runtime-capable, not solely retrospective.

Checklist: Minimal safety, governance and operational requirements for production​

  • RBAC and least-privilege service identities for MCP and connector access.
  • MCP configurations that limit API exposure to only required entities and operations. (learn.microsoft.com)
  • Human-in-the-loop approvals for all irreversible financial operations.
  • Runtime monitoring and approve/block controls integrated with security tooling.
  • Comprehensive telemetry, searchable audit trails, and retention policies for agent actions.
  • Model provenance documentation — which model, version, and prompt tuning is used.
  • Incident response and rewind/recovery plans for erroneous agent actions.

The partner opportunity and the business case​

Partners that can combine operational knowledge of Business Central with productized agent templates and hardened governance will be in high demand. The economics are straightforward: reducing manual order and invoice processing, shrinking days sales outstanding (DSO), and cutting data-entry errors translate quickly into measurable ROI for SMBs and mid-market customers.
Moreover, partners can capture recurring revenue by offering:
  • Managed agent-as-a-service packages (service fee + governance & monitoring).
  • Verticalized agent templates (retail, distribution, services).
  • Change management and training services for staff to adopt agent-augmented workflows.
Microsoft’s platform investments — Copilot Studio, MCP server catalogs, and multi-channel publishing — lower the technical barrier. But the value equation still depends on partners’ ability to deliver secure, auditable, and reliable automation that preserves ERP controls and auditability. (learn.microsoft.com)

Final analysis: realism over hype​

The Partner Show’s message is not “agents will replace ERP professionals”; it’s that agents will become reliable co-pilots and virtual operators that offload repetitive transactional work while leaving governance and judgment to people. That nuance matters.
Strengths to lean on:
  • Microsoft has engineered the integration points and is iterating governance and runtime controls quickly. (learn.microsoft.com)
  • Business Central’s internal rule engine and AL extensibility make it feasible to preserve accounting semantics while enabling AI-assisted automation. (learn.microsoft.com)
Real risks to mitigate:
  • Data leakage and model-exposure of sensitive ERP fields unless strict DLP and runtime monitoring are in place.
  • Governance gaps that allow agents to perform irreversible changes without adequate human approvals.
  • Operational brittleness when agents rely on UI automation rather than API-first MCP patterns. (theverge.com)
Partners who adopt a disciplined build-test-govern-operate lifecycle and who productize secure agent templates will lead the early market. Those who chase feature demos without robust runtime controls will expose customers to avoidable financial, compliance, and reputational risk.

Conclusion​

The February Partner Show demonstrated that the agent era for Business Central is not theoretical — it’s practical and present. With Copilot Studio, MCP servers, and Power Platform connectors, partners can build agents that read, reason, and act on Business Central data while preserving server-side business logic and compliance expectations. The business case is immediate: accelerate processing, reduce errors, and free staff for higher‑value work.
But realizing that value requires more than a clever prompt. It requires disciplined architecture choices (connector vs MCP), least‑privilege permissions, runtime enforcement, comprehensive telemetry, and productized partner services that combine automation with governance. Partners who marry ERP domain expertise with secure agent engineering will find a large, near-term opportunity in helping customers transform Business Central from a system of record into the intelligent operational core of their AI-driven organizations. (msdynamicsworld.com)
Source: MSDynamicsWorld.com AI Business Solutions Partner Show, February 2026: Real AI Agent Scenarios Working for Business Central Partners
 
Click to expand...
You must log in or register to reply here.