SoftTech AI Registry
Microsoft · Dynamics 365 Customer Service

MCP Server service operations

Customer Service-specific business operations exposed through Microsoft's current Dynamics 365 CX MCP Server - Service (also called the Dynamics 365 Customer Service MCP Server) behind the Agent 365 Tooling Gateway: case update, reassignment, closure, merge, knowledge publication, email sending and Customer Service configuration, executed under the signed-in user's Dataverse privileges. The MCP server is a tool interface for outside AI/MCP clients, not the reasoning agent.

Recorded characteristics

Function
Current server: "Dynamics 365 CX MCP Server - Service", server ID mcp_D365CX_Service, gateway address https://agent365.svc.cloud.microsoft/mcp/environments/<environment-id>/servers/mcp_D365CX_Service. Microsoft also calls the current replacement the "Dynamics 365 Customer Service MCP Server" and, in the overview, the "Dynamics 365 Customer Experience MCP Server for Service" (naming inconsistency preserved). Chain: outside AI/MCP client (own reasoning) → Microsoft-hosted Agent 365 Tooling Gateway → Dynamics 365 CX MCP Server - Service → on-behalf-of access into Dataverse → Customer Service MCP tool → Customer Service/Dataverse operation. The gateway handles authentication; it is not the Customer Service product. The overview describes "more than 90 service-oriented tools"; Microsoft states tool names and behaviour can change over time. Credited current persistent operations — Case: update_case (updates case fields; "the change takes effect immediately"), reassign_case (changes case owner and posts a handover note), assign_entity (Dataverse assign or queue routing), close_case (Dataverse CloseIncident; case becomes Resolved and a resolution activity is created), resolve_case_and_pick_next (resolves the case and claims the next queue item for the user), merge_cases (merged cases cancelled as "Merged", activities/emails/attachments re-parented; documented as irreversible), create_case_from_email (creates a case, may create a contact, links the email), create_note, create_activity, link_email_to_case. Knowledge: publish_knowledge_article (Draft → Published in Dataverse), save_knowledge_draft, discard_knowledge_draft; content drafting/generation is distinct from publication. Email: draft_email opens an in-chat compose form and may auto-save a draft (no transmission); send_email "sends an email right away… through Dynamics 365 and recorded as a sent activity". General entity tools: create_entity_record, update_entity_record, delete_entity_record (hard delete, no undo) — part of the surface but not its defining boundary. Configuration: save_mcp_registration / delete_mcp_registration (external MCP server registrations in the organisation store), save_tool_selection (organisation- or profile-level tool visibility overrides), save_agent_config / delete_agent_config, save_profile_config, save_copilot_studio_registration / delete_copilot_studio_registration, save_cross_namespace_grant / delete_cross_namespace_grants, save_tool_description / delete_tool_description, save_user_prefs / delete_user_prefs. Vocabulary: manage_service_vocabulary only opens an editor; persistent changes are made by save_glossary_term, save_synonym, remove_glossary_terms, remove_synonyms. Question-answering scope: manage_customer_service_dv_qna only opens a panel; add_dv_qna_table / remove_dv_qna_table change which tables the Customer Service QnA skill answers from (binding rows) and do not modify the bound table's schema or records — distinct from Dataverse table-schema operations. Read/AI-generation tools (e.g. get_case, summarize_case, predict_fields, suggest_next_action_for_case) are context only; predict_fields is read-only and applying a prediction uses update_case. Not credited (no current tool pages): enrich_case, resolve_incident, draft_email_with_suggested_response from historical release-plan material.
Data access
Reads and changes Customer Service data in the connected Dataverse environment (cases, activities, notes, emails, knowledge articles, related records) and Customer Service configuration. Scope is one environment per server URL and OAuth scope.
Actions
Can take actions
External actions
Yes
Human confirmation
Not established
Permission basis
User permissions
Administrative control
Authentication: the client requests a token for the Agent 365 Tooling Gateway resource (audience is the gateway, scope ends in /.default); the gateway "performs the on-behalf-of exchange that allows the request to reach Dataverse". Tenant admin consent for the gateway app (ea9ffc3e-8a23-4a7d-836d-234d7c7565c1) is required in advance; Copilot Studio custom connectors need a client Entra app with the delegated McpServers.D365Service.All permission. Consent is setup, not the runtime execution identity. Roles: System Administrator or Omnichannel Administrator to configure the server; Customer Service Representative or CSR Manager to use it. Privilege governance: a user must hold all privileges mapped to a tool before it is discoverable; privileges are enforced again when the tool runs. Some tools are intentionally ungated at discovery (including get/list/update/delete_entity_record, environment tools, and synthesized ext_* and mcs_* tools); if a privilege lookup fails discovery is fail-open, but Dataverse can still deny execution (HTTP 403). Not every mutating tool appears in the privilege map (e.g. merge_cases, create_entity_record). Examples: update_case prvWriteIncident; reassign_case prvWriteIncident, prvCreateNote; close_case prvReadIncident, prvWriteIncident, prvCreateActivity; publish_knowledge_article prvWriteKnowledgeArticle; save_mcp_registration and save_tool_selection prvmsdyn_ServiceAgentMakerCustomize (save_mcp_registration page also states System Administrator or Copilot Service administrator); vocabulary and QnA-scope tools prvmsdyn_ServiceAgentMakerCustomize. Human interaction types documented: some tools have no confirmation gate (e.g. update_case, close_case, reassign_case; send_email runs after the user's explicit chat request and "Microsoft 365 Copilot doesn't show a separate confirmation card"); some Microsoft 365 Copilot client prompts (e.g. create_case_from_email); some assistant behaviours ask for confirmation (e.g. delete_entity_record, vocabulary deletes, merge preview); some app-in-chat widgets require a person to click Save or Publish. Microsoft also advises organisations to "implement approval mechanisms". None of these establishes a server-enforced approval that every external MCP client must pass.
Default state
Conditional
Availability
Lifecycle: the current overview states the server "is generally available as an independent offering"; Microsoft's connector wrapper ("Dynamics 365 MCP Server (Preview)") still carries a Preview label and lists both "Dynamics 365 Customer Service MCP Server (Preview)" (msdyn_ServiceMCPServer) and "Dynamics 365 Service MCP Server" (mcp_D365CX_Service). No GA date is recorded, and which connector ID corresponds to the deprecated server is not established. Separate boundary evidence: the old "D365 Service MCP Server" was deprecated on 24 November 2025 and is to be removed; it is not part of this record. Prerequisites: tenant admin consent and gateway service principal; server configured and available; Dataverse environment ID in the URL; Entra sign-in; appropriate Customer Service roles and Dataverse privileges; tool-specific prerequisites such as email configuration (send_email), knowledge management (knowledge tools), queues (resolve_case_and_pick_next), automatic record creation rules (create_case_from_email), AI/Copilot features (predict_fields, draft_email) and the provisioned CustomerServiceQnA skill (vocabulary and QnA-scope tools). Validated clients (compatibility only): Microsoft 365 Copilot including Service Agent, Copilot Studio agents, Visual Studio Code, GitHub Copilot CLI and other HTTP MCP clients; the connection page also documents Cursor, ChatGPT and Claude Code. US notice: enabling allows data egress outside the FedRAMP High boundary.
Licensing
Not established as a separate licence in current Customer Service MCP documentation; some AI tools depend on organisation AI features including pay-as-you-go billing where applicable.
External model or provider
None fixed. Outside MCP clients supply the reasoning model; Microsoft Customer Service AI features behind generation tools use models that are not disclosed.
Limitations and uncertainty
Unresolved: whether any runtime confirmation is enforced at the MCP server layer; the exact underlying transport/service used by send_email; whether send_email can reach recipients outside the organisation in all configurations; whether gateway on-behalf-of execution ever uses an identity other than the signed-in user; MCP-specific tool-call logging and auditing; environment/licence differences in tool availability; precise separation of Customer Service tools from Sales, Marketing and workforce tools in the shared tool reference; exact mapping between deprecated and current connector IDs; whether some admin tools are usable from external MCP clients or only through Microsoft experiences/widgets; whether widget-driven saves count as human rather than AI actions in particular flows; incomplete privilege mappings for some mutating tools; recovery/undo for hard deletion and merge operations. Downstream automation triggered by Customer Service changes is not credited.

Evidence