SoftTech AI Registry
Microsoft · Dynamics 365 Business Central

MCP Server configured API operations

AI-callable Business Central operations exposed through Microsoft's hosted Business Central MCP server on API pages an administrator has added to an MCP configuration. Depending on configuration, the operation surface can include read, create, modify, delete and bound actions. Read-only by default; write operations require administrator configuration. The MCP server is an operation interface for outside AI/MCP clients, not the reasoning agent.

Recorded characteristics

Function
Microsoft-hosted MCP endpoint (https://mcp.businesscentral.dynamics.com) that exposes Business Central API pages as tools for outside AI/MCP clients. Chain: outside AI/MCP client (supplies its own reasoning) → Business Central MCP endpoint → selected MCP configuration → configured API page/tool → Business Central operation. Microsoft documents that administrators can enable create, modify and delete operations and bound actions per configured API page; the overview lists listing, creating, updating and deleting entities such as customers, items and sales orders. These are documented supported operations; no live action was observed by the Registry. Tool surface is generated from configuration, not a single fixed list: with Dynamic Tool Mode off, tools are generated per configured API page and operation (Microsoft's naming pattern includes List/Create/ListUpdate/Delete/<bound action> forms suffixed _PAG<ID>, e.g. CreateAPIV2 - Customer_PAG30009); with Dynamic Tool Mode on, Microsoft documents three tools: bc_actions_search, bc_actions_describe, bc_actions_invoke. Only top-level API pages are supported.
Data access
Reads and, where configured, writes Business Central data through configured API pages. By default the MCP server provides read-only access to all exposed Business Central API pages. Discover Additional Objects gives read-only access to all API pages and requires Dynamic Tool Mode. Connection scope is set by request headers: TenantId, EnvironmentName, Company (one company per connection) and optional ConfigurationName. Business Central Online only.
Actions
Can take actions
External actions
No
Human confirmation
Not established
Permission basis
User permissions
Administrative control
Users with the MCP - ADMIN permission set manage entries on the Model Context Protocol (MCP) Server Configurations page: Name, Description, Active, Dynamic Tool Mode, Discover Additional Objects (depends on Dynamic Tool Mode) and Unblock Edit Tools. Per API page: Allow Read, Allow Create, Allow Modify, Allow Delete, Allow Bound Actions. When Unblock Edit Tools is off, all write permissions are forced to false, so per-page write settings are not independent of it. Permissions are granular per page (Microsoft example: read/modify/create/delete on Items, read/modify on Customers). An environment can hold several configurations with one default; configurations export/import as JSON; deactivating a configuration breaks agents that use it. Configuration management is administrator governance, not AI-callable. Two-layer authority: (1) the MCP configuration determines which API pages and operations are exposed; (2) the authenticated user's own Business Central permissions determine what that user may actually perform. Microsoft states: "All operations are performed with your user identity and permissions, ensuring audit trails show who performed each action." Authentication: OAuth 2.0 with PKCE and Microsoft Entra ID (2026 release plan refers to OAuth 2.1); VS Code and Copilot Studio are pre-registered; other hosts need an Entra app registration with delegated Financials.ReadWrite.All and admin consent. No app-only, service or dedicated agent identity documented. Telemetry (current docs, version 28.0+) covers MCP configuration created/modified/deleted/set as default, with user ID; this is configuration telemetry, not an audit of AI-triggered data changes.
Default state
Conditional
Availability
Business Central Online only; Microsoft-hosted endpoint shared by all customers, environment selected by headers. Lifecycle evidence tension recorded: Microsoft's 2025 release wave 2 plan listed the Business Central MCP server as Public preview (Oct 31, 2025); the 2026 release wave 1 plan describes the enhanced MCP server experience as generally available from 1 April 2026; current how-to documentation carries no Preview label. No separate GA date is recorded for the original feature. Documented compatible clients (compatibility only, not part of capability identity): Visual Studio Code with GitHub Copilot, Copilot Studio, and non-Microsoft MCP hosts per Microsoft's host guide.
Licensing
Not established as a separate licence; operations are bounded by the user's Business Central permissions.
External model or provider
None fixed. The MCP server is an operation interface; reasoning is supplied by the connecting AI/MCP client.
Limitations and uncertainty
Unresolved: no universal runtime human confirmation documented for MCP write operations (confirmation described for the separate Business Central Admin Center MCP Server is not transferred; admin configuration, OAuth consent, static validation and permissions are not runtime confirmation); delete recovery/safeguards not documented; exact bound-action scope not established (bound actions run Business Central business logic, e.g. posting, which can have financial effect); current logging of individual MCP calls not confirmed — detailed MCP-call logging is a 2026 release-plan promise; audit treatment of AI-triggered data changes beyond Microsoft's user-identity statement not established; Purview coverage stated for MCP configuration changes only and operational status unconfirmed; generated tool descriptions, schemas and input formats not documented; whether connected clients pick up configuration changes not documented; original-feature versus enhanced-feature lifecycle chronology unresolved. Not every API page supports every operation and write operations depend on administrator enablement.

Evidence