KPMG’s early-access collaboration with Microsoft to build an “Intelligent ERP” using the Model Context Protocol (MCP) for Dynamics 365 Finance and Operations reframes ERP from a passive ledger into a set of governed, agent-enabled services that can access, act and decide inside enterprise systems in near real time.
For decades ERP systems were treated primarily as systems of record: durable stores of transactions, master data, and business logic. The current wave of enterprise AI — led by protocol work such as the Model Context Protocol (MCP), hosting runtimes like Azure AI Foundry, and low-code authoring in Copilot Studio — is shifting ERP toward systems of action. That shift is not hypothetical; Microsoft has announced a dynamic Dynamics 365 ERP MCP server (public preview) and a parallel MCP server for analytics to make Business Performance Analytics agent-accessible, enabling agents to discover, call, and execute ERP operations under tenant governance. KPMG says it is one of a small group of global partners chosen for early access to MCP for Dynamics 365 Finance and Operations and is co-developing agentic ERP scenarios—especially in finance, procurement, and audit—where agents automate routine controls, enrich decisions with external data, and generate auditable evidence packages. Those claims are reflected in KPMG’s alliance messaging and in early partner briefings gathered as part of this review.
Source: KPMG Intelligent ERP with KPMG and Microsoft
Background / Overview
For decades ERP systems were treated primarily as systems of record: durable stores of transactions, master data, and business logic. The current wave of enterprise AI — led by protocol work such as the Model Context Protocol (MCP), hosting runtimes like Azure AI Foundry, and low-code authoring in Copilot Studio — is shifting ERP toward systems of action. That shift is not hypothetical; Microsoft has announced a dynamic Dynamics 365 ERP MCP server (public preview) and a parallel MCP server for analytics to make Business Performance Analytics agent-accessible, enabling agents to discover, call, and execute ERP operations under tenant governance. KPMG says it is one of a small group of global partners chosen for early access to MCP for Dynamics 365 Finance and Operations and is co-developing agentic ERP scenarios—especially in finance, procurement, and audit—where agents automate routine controls, enrich decisions with external data, and generate auditable evidence packages. Those claims are reflected in KPMG’s alliance messaging and in early partner briefings gathered as part of this review. What is the Model Context Protocol (MCP) — a practical primer
The core idea
MCP is a protocol-first approach that standardizes how AI agents discover, call, and exchange structured operations (tools) with applications and services. Instead of bespoke connectors and brittle prompt engineering, MCP offers:- Tool discovery: Agents can enumerate available capabilities published by an MCP server.
- Typed inputs/outputs: Tools carry structured schemas so calls are deterministic and traceable.
- Security and identity: Calls are scoped to agent identities and tenant entitlements.
- Auditable traces: Every tool invocation and resulting state change can be logged and traced.
Why protocol matters for ERP
ERP landscapes are highly customized—thousands of forms, extensions, and ISV add-ons per tenant. The dynamic MCP server announced by Microsoft allows agents to open server forms, set fields, call form actions, and save records using the same server-side business logic that human users exercise. That reduces the need to build a separate API for every interaction and brings agent interactions under the ERP’s existing permissioning and audit controls. Microsoft describes this as a move from a static catalog of a small number of tools to a dynamic manifest that can expose hundreds of thousands of ERP functions to appropriately privileged agents.KPMG + Microsoft: what KPMG is building and why it matters
KPMG’s stated aims
KPMG’s public materials and partner briefings frame the collaboration as an effort to convert routine ERP and audit work into governed, agentic workflows that:- Reduce manual reconciliation and exception-chasing work.
- Improve working capital visibility by accelerating GRNI (Goods Received Not Invoiced) resolution.
- Add supplier-risk intelligence by combining ERP telemetry with external feeds (credit, filings, sanctions, news).
- Increase audit coverage via whole-dataset analysis and reproducible evidence packaging inside KPMG Clara and other audit platforms.
Concrete use cases KPMG highlights
- GRNI Chaser — agent periodically queries Dynamics 365 for stale receipt records, enriches each record with PO and supplier metadata, and prompts owners in Teams to confirm or correct; responses update the ERP or open AP cases and are logged for auditability. Early pilot summaries indicate large reductions in reconciliation cycle times but emphasize dependency on master-data quality.
- Supplier Performance Insight — agent fuses ERP-derived supplier metrics (on-time delivery, returns) with external intelligence (financial filings, credit scores, sanctions lists, news sentiment) to compute a reliability score and recommend mitigations; every recommendation links back to evidence to reduce hallucination risk. Operational limits include identifier mapping and licensing for third-party feeds.
- Audit automation (KPMG Clara AI) — agents run substantive procedures across whole datasets, flag anomalies, generate workpapers, and compile evidence packages for reviewers; the design emphasizes preparing work for auditors rather than replacing human judgment. KPMG cites .NET 8, Azure App Service, and Cosmos DB (for state/memory) with Azure AI Foundry used for model hosting and lifecycle controls.
The technical architecture: how agents are composed and governed
A canonical stack
KPMG and Microsoft converge on a repeatable architecture:- Authoring: Copilot Studio for low-code/pro-code agent composition and prompt-first development.
- Protocol & integration: Model Context Protocol (MCP) for tool manifests, dynamic form access, and discovery.
- Runtime: Azure AI Foundry (agent service, model catalog, lifecycle protections, observability).
- Data foundation: Dataverse / Microsoft Fabric / OneLake or direct ERP connectors as governed sources.
- Identity & governance: Microsoft Entra (Azure AD) for agent identities, Microsoft Purview for data classification, and OpenTelemetry-style tracing for observability.
Key operational primitives and safety scaffolding
- Agents are provisioned with tenant-bound identities and narrow service principals to enforce least privilege.
- Sensitive actions (financial write-backs, legal disclosures) require explicit human approvals and leave immutable audit trails.
- Observability and telemetry capture per-action provenance, enabling post-hoc reviews, red-team testing, and regulatory evidence collection.
Strengths — what KPMG + Microsoft bring to the table
- Interoperability-first design: MCP reduces M×N connector overhead and allows partners to publish reusable tool manifests across tenants. This materially lowers integration costs for agent projects.
- Enterprise governance baked into the stack: Entra-based identities, Purview classifications, and Copilot Control System policies give IT tangible levers over agent privileges and data exposure. These are not mere checkboxes—when correctly configured they make regulated automation feasible.
- Productivity and scale: For high-volume, repetitive tasks (e.g., GRNI, bank reconciliations, time & expense validation), agentic automation manifests measurable time savings in pilots; forcing agents to surface provenance improves trust and auditability.
- A managed runtime and evaluation pipeline: Azure AI Foundry provides model cataloging, evaluation, and runtime protections that enable continuous monitoring and safer deployments at enterprise scale.
Risks, caveats, and governance blind spots
While the promise is compelling, multiple operational and compliance risks must be taken seriously.1) Pilot gains vs. production reality
Vendor and partner pilot numbers are encouraging, but they are context-dependent. Gains reported (for example, shifts from multi-day reconciliation to hourly triage) come with asterisks: success depends on master-data hygiene, connector reliability, and change-management. Treat vendor-reported results as directional until validated by formal pilot KPIs.2) Concentrated control plane risk
MCP centralizes integration and control into a single server layer. That centralization simplifies governance but also concentrates risk: a misconfigured MCP server, compromised agent identity, or flawed manifest could enable widespread unwanted changes. Tenant administrators must treat the MCP server as critical infrastructure and protect it accordingly.3) Hallucination and explainability in regulated workflows
Agents that generate narratives and recommendations must always surface evidence links. Where agents propose supplier holds, journal entries, or audit conclusions, organizations must be able to show exactly which records, rules, and external facts led to the recommendation. Independent red-teaming and model validations should be part of the CI/CD pipeline. KPMG and Microsoft emphasize provenance, but operationalizing explainability remains a discipline more than a feature.4) Audit independence and conflict-of-interest optics
KPMG’s deep alliance with Microsoft accelerates product access and co-engineering, but it raises legitimate independence questions when KPMG audits firms that are Microsoft customers or partners. Firms must adopt clear firewalls, transparent disclosures, and documented governance to preserve audit independence and public trust.5) Licensing, data residency and third-party feed fidelity
Supplier scoring and other cross-source analyses depend on licensed third-party data (credit scores, filings, sanctions lists). Mapping external identifiers to ERP supplier masters is frequently non-trivial and should be treated as a discrete project within pilots. Data residency and regulatory requirements may also constrain where model hosting and telemetry can run.Practical rollout playbook — recommended phased approach
KPMG and partner materials converge on a pragmatic, phased plan to reduce operational surprises:- Readiness assessment
- Inventory Dynamics 365 modules and customizations.
- Conduct master-data health checks (supplier IDs, PO consistency).
- Map stakeholders and define acceptance criteria.
- Pilot design (tight scope)
- Choose one high-frequency process (e.g., GRNI Chaser for a single legal entity).
- Define measurable KPIs: days-to-match, straight-through match %, human edit rate.
- Implement human-approval gates for write-backs.
- Harden connectors and mapping
- Validate API latency and mapping fidelity.
- Remediate master-data issues concurrently with agent deployment.
- Observe, evaluate, iterate
- Use OpenTelemetry-style traces and per-action logs for monitoring.
- Maintain a feedback loop for prompt and model tuning.
- Governance and scale
- Centralize agent lifecycle in a Copilot Center of Excellence.
- Establish CI/CD for agent artifacts and automated regression tests.
- Enforce quarterly privilege reviews and periodic red-team tests.
Cost, licensing and procurement considerations
Agentic ERP projects change cost structures in subtle ways:- Model usage and routing across multiple models can shift billing dynamics; enterprises should apply cost governance to agent runtime and model selection.
- MCP can reduce integration engineering effort, but operational support (agent lifecycle, telemetry, staffing) creates recurring OPEX.
- Third-party data licensing for supplier scoring or external intelligence must be scoped into procurement and contract terms early.
Cross-checking claims and independent validation
Key technical claims and dates were validated against multiple, independent sources:- KPMG’s announcement that it is among a select group given early MCP access is stated in KPMG’s alliance materials and reflected in partner briefings collected during this review.
- Microsoft’s Dynamics 365 blog confirms the dynamic MCP server public preview and the analytics MCP server timeline; it also documents the original Build 2025 static server (13 tools) and the shift to dynamic manifests. Those product statements align with Microsoft docs and public blog posts.
- Azure AI Foundry’s role as an agent runtime with MCP support is documented in Microsoft’s Azure product pages and DevBlogs; Foundry explicitly supports importing MCP servers and routing calls through enterprise security primitives.
- MCP’s origin and broader ecosystem context were cross-referenced with independent reporting on Anthropic’s MCP initiative and coverage in major tech press that described MCP as a portable protocol for agent integrations. This provides independent confirmation of MCP’s intent and ecosystem uptake.
How enterprise IT and finance leaders should respond now
- Treat MCP and agent frameworks as strategic integration platforms, not just a collection of point solutions. Establish MCP server hardening, life-cycle review cadence, and token protections as part of core platform engineering responsibilities.
- Start with conservative pilots that pair automation with master-data remediation and human approvals. Define success metrics before you start and instrument the system for continuous measurement.
- Create governance guardrails that include:
- Per-agent least-privilege service principals.
- Automatic provenance capture on every recommendation and action.
- Red-team testing for hallucination and privilege escalation scenarios.
- Vendor due-diligence requiring evidence of operational support and model testing.
- Address audit independence proactively with transparent disclosures and operational firewalls where advisory teams co-develop automation that could later be used in audit contexts. Document separation of duties and decision trails in contracts and client communications.
Conclusion
KPMG’s collaboration with Microsoft on MCP-powered, agentic ERP represents a meaningful step toward ERPs that can act—unlocking large swathes of Dynamics 365 functionality to governed AI agents. The architecture—Copilot Studio for authoring, MCP for integration, Azure AI Foundry for runtime, and Microsoft enterprise primitives for governance—creates a technically plausible and operationally disciplined path to automation across finance, procurement, and audit. However, the benefits are conditional. Real, sustained value depends on disciplined pilots, master-data remediation, rigorous governance, cost oversight, and independent validation of audit-quality improvements. Vendor pilot metrics are promising but should be validated locally by defined KPIs and contractual SLAs. Organizations that align platform protections, process controls, and human-in-the-loop approvals will be best positioned to convert the promise of intelligent ERP into dependable, auditable, and scalable operational gain.Source: KPMG Intelligent ERP with KPMG and Microsoft
