SoftTech AI Registry
Microsoft · Microsoft Dataverse

MCP Server record and table operations

Generally available Dataverse MCP tools (organisation endpoint /api/mcp) that let outside AI/MCP clients create, update and delete Dataverse rows and create, modify and delete Dataverse table structure, within the authenticated user's Dataverse security roles. The MCP server is an operation interface, not the reasoning agent. Preview tools on /api/mcp_preview are outside this record.

Recorded characteristics

Function
Microsoft documents that "Microsoft Dataverse can act as an MCP server". Chain: outside AI/MCP client (supplies its own reasoning) → Dataverse MCP endpoint for the organisation/environment (https://{org}.crm.dynamics.com/api/mcp; no single shared endpoint) → fixed Dataverse MCP tool → Dataverse record or table operation. Tool design: a Microsoft-defined, general-purpose tool set that takes table, column and schema context at run time (the agent looks up logical names with describe); administrators control client access rather than generating a per-page tool surface (unlike Business Central's configuration-generated MCP tools). Credited persistent actions on the generally available endpoint — record operations: create_record ("Inserts a new row into a Dataverse table and returns the GUID"), update_record ("Updates an existing row in a Dataverse table"), delete_record ("Delete a row, only after explicit user approval."); table (structural) operations: create_table ("Creates a new table with a specified schema"), update_table ("Modifies schema or metadata of an existing table"), delete_table ("Deletes a table from Dataverse, only after explicit user approval."). Table operations change Dataverse structure, not only data. Contextual GA tools: search_data, search (metadata), read_query (Dataverse SQL SELECT), describe, upsert_skill, delete_skill, init_file_upload, commit_file_upload, file_download (the file tools generate temporary SAS upload/download URLs). Historical: describe_table, list_tables and fetch were removed (replaced by describe) and the former data search tool was renamed search_data. Connection methods include Copilot Studio, GitHub Copilot in VS Code and Copilot CLI, and non-Microsoft clients directly or through the Dataverse CLI local relay (npx @microsoft/dataverse mcp).
Data access
Reads and changes Dataverse rows and tables in the connected environment. The FAQ states the server "respects Dataverse security roles and row-level security. Users can only access tables and records that their security role permits." search_data appears only when Dataverse search is enabled for the environment. Each environment has its own MCP endpoint.
Actions
Can take actions
External actions
No
Human confirmation
Not established
Permission basis
User permissions
Administrative control
Two separate control layers. (1) Client governance — decides whether an MCP client may connect: Power Platform administrators control the environment setting "Allow MCP clients to interact with Dataverse MCP server" (Settings > Product > Features); it is on by default for the Copilot Studio client; each other client must be enabled (client record Is Enabled = Yes) or a custom Entra app client ID added to the allowed-clients list; admins can disable the setting, which "stops all tools and agents that rely on it"; Advanced connector policies apply for Managed Environments; the allow list applies only to the /api/mcp entrypoint (MCP-named custom APIs are regular Dataverse APIs and are not restricted by it). (2) Data authority — Dataverse security roles and row-level security determine what the authenticated user may access or change; Microsoft states no additional MCP-specific access controls are needed. Authentication for non-Microsoft clients: a custom Microsoft Entra app with the Dynamics CRM mcp.tools delegated permission, or Microsoft's Dataverse CLI app after one-time tenant admin consent. Neither consent, client allow-listing, admin enablement nor security roles are runtime human confirmation. Generic Dataverse auditing exists as platform functionality, but Microsoft does not establish that MCP operations are captured or attributed by it.
Default state
Conditional
Availability
Generally available: the FAQ states the /api/mcp endpoint "provides the generally available set of Dataverse MCP tools". A separate /api/mcp_preview endpoint (separate admin setting and separate "Microsoft Dataverse MCP Server (Preview)" Copilot Studio connector) carries preview tools that are not credited here. No exact GA date is recorded. Conditions before an operation: environment MCP setting on (default on for Copilot Studio); non-Microsoft client enabled/allow-listed with its documented Entra authentication path; user sign-in; Dataverse security-role authority and row-level security; tool-specific prerequisites such as Dataverse search for search_data.
Licensing
From 15 December 2025 Dataverse MCP tools are charged in Copilot credits when accessed by agents created outside Copilot Studio; qualifying Dynamics 365 Premium licences or a Microsoft 365 Copilot user licence are not charged for Dynamics 365 data access.
External model or provider
None fixed. The Dataverse MCP server is an operation/tool interface; the connecting MCP client supplies the reasoning model. Copilot credit billing does not establish a model.
Limitations and uncertainty
Human confirmation tension: Microsoft's tool descriptions say delete_record and delete_table run "only after explicit user approval", but the same Microsoft documentation's sample agent instructions tell the agent "do not ask confirmation for delete table or delete record operation, you can delete." The evidence therefore does not establish a Microsoft-enforced runtime approval at the Dataverse MCP layer, nor that deletes universally occur without confirmation; create/update/table create and modify carry no approval wording. Unresolved: whether Microsoft enforces delete approval anywhere beyond model-facing tool text; delete recovery/undo; specific privileges for table creation, modification and deletion; transaction/rollback behaviour; MCP-specific logging, auditing and attribution; Copilot Studio agent execution identity (user versus maker connection); detailed tool input formats and limits; exact GA date; excluded table types, if any; exact behaviour of upsert_skill and delete_skill. Downstream automation triggered by Dataverse changes is not credited as outside action.

Evidence