Business Central MCP Server: The Complete Guide to AI Integrations (incl. V29 Custom Data Queries)

ERP systems have an AI problem. Not a lack of intelligence — they’re packed with business logic. The problem is that AI agents can’t talk to them natively. Every integration is a custom REST wrapper, a middleware layer, a brittle connector that breaks when someone renames a field. If you’ve ever tried to get an AI assistant to pull live inventory or post a sales order in Business Central, you know the pain.

Microsoft’s answer is the Business Central MCP server — a Model Context Protocol gateway that exposes your ERP data and operations to AI agents through a standard, self-describing interface. It entered public preview on October 31, 2025, became generally available on April 1, 2026 (2026 release wave 1), and got a major extension in V29 (October 2026): custom data queries, which let AI clients query data that no API page exposes.

This guide covers all of it: what the server does, how to configure it properly, what V29 changes, realistic use cases, the separate admin center MCP server, costs, and the limits you should know before you build on it.

What MCP Is (in Plain Terms)

Model Context Protocol is an open standard — created by Anthropic in late 2024 — for how AI applications discover and use external data and tools. Think of it as USB-C for AI-to-system connections: one connector instead of a custom integration for every tool and every application.

The architecture is simple:

• The MCP host is the AI application — Copilot Studio, GitHub Copilot in VS Code, ChatGPT, Claude, or your own agent.
• The MCP server is the gateway exposed by the business application — here, Business Central.
• The host discovers which tools the server offers, reads their inputs and outputs, and calls them through the protocol.

The BC MCP server exposes Business Central entities — customers, items, sales orders, vendors, posted invoices — as tools that agents can discover, understand, and call. It’s not a chatbot. It’s a communication layer that turns your ERP into something an AI agent can reason about and act on.

Timeline: How the BC MCP Server Got Here

If you read an earlier version of this article: the data MCP server is no longer a preview feature. The admin center server still is, and the V29 data query tools carry a preview label in the configuration documentation.

What the Server Exposes

By default, the MCP server gives clients read-only access to the API pages and API queries the signed-in user has permission to use: the built-in default configuration has dynamic tool mode and read-only object discovery turned on. With no configuration of your own, an agent connected to your environment can query customers, pull inventory, list open sales orders, and check vendor balances.

Read-only is the starting point. Administrators can build configurations that allow create, modify, delete, and bound actions on specific API pages. Once allowed, agents can:

• View and manage records — list, create, update, and delete customers, items, sales orders, and more
• Execute business processes — post documents, change statuses, run business logic through bound OData actions
• Answer natural-language questions — conversational access to BC data

Every call respects Business Central’s existing security model. Authentication uses OAuth 2.0 authorization code flow with PKCE and Microsoft Entra ID; all operations run with the signed-in user’s identity and permissions, so audit trails show who did what — including when the “who” was an agent acting for a user. No backdoor, no special privileges.

Supported MCP Hosts: Not Just Copilot

Microsoft supports three kinds of hosts:

1. Copilot Studio — add the Business Central MCP connector to an agent, pick environment, company, and configuration. The platform handles authentication and header encoding.
2. Visual Studio Code with GitHub Copilot — gives Copilot live access to your BC data and APIs while you code. Useful for AL developers who want answers grounded in the environment they’re working against.
3. Any MCP-compliant client — Claude, ChatGPT, MCP Inspector, or your own agent. You register your own Entra ID application for these; Microsoft’s hosts use a preregistered app.

Everyone connects to the same endpoint, https://mcp.businesscentral.dynamics.com, and selects the target with HTTP headers:

Each configuration also offers a ready-made connection string (Advanced → Connection String) you can paste into VS Code or another client.

How It Differs From Standard BC APIs

Business Central has had REST APIs for years. So what does MCP add?

Standard APIs are dumb pipes. The client must already know the endpoint, field names, data types, relationships, and business rules. That’s why integrations take weeks and break when schemas change.

MCP is self-describing. When a host connects, it discovers which tools exist, which parameters they take, what they return, and the schema of each entity. The agent doesn’t need pre-programmed knowledge of your setup. Add a custom API page to the configuration — or run with dynamic tool mode and Discover Read-Only Objects on — and the agent can use it at the next connection, with no integration code to maintain.

It’s the difference between shipping someone a printed map and giving them live GPS.

Configuring the MCP Server Properly

This is where early coverage (including ours) was wrong: there’s no Feature Management switch. Configuration lives on a dedicated page.

Prerequisite: the MCP - ADMIN permission set or equivalent.

1. Open Model Context Protocol (MCP) Server Configurations (page 8350) and select New.
2. Set the general fields:

3. In the Server Features section, activate what the configuration needs:

4. Under Available APIs, add API pages or API queries (object type, object ID, and API version), or use Add All Standard APIs or Add APIs by API Group, and tick Allow Read / Create / Modify / Delete / Actions per object. API queries support read only; for API pages, Allow Actions controls bound actions.

Each allowed operation becomes a tool — for example List_Customers_PAG30009 or Create_Customer_PAG30009. Query tools end in _QRY<ID>.

Practical notes:

• Only top-level API pages work. ListPart and CardPart subpages can’t be tools.
• Write permissions are per configuration, per API page. The clean pattern is one configuration per agent or team: a read-only “Sales insights” configuration, a narrowly writable “Order entry” one.
• Export/import configurations as JSON to move them between sandbox and production or across customers.
• Static validation (GA in wave 1): the Validate action checks configurations before runtime — API objects that no longer exist, missing parent API pages, Allow Modify without Allow Read — and Apply Recommended Action fixes them.
• The default configuration has a blank name and is used when a connection doesn’t send ConfigurationName. You can make another active configuration the default with Set as Default.

V29: Custom Data Queries

Until V29, the MCP server had one real ceiling: it only worked over exposed API pages. If the data your agent needed wasn’t published as an API page — a custom table, a calculated field, a specific join — you had to write a new AL API page first. A developer, a deployment, and days or weeks of lead time for what was often just “run this query.”

Business Central 2026 release wave 2 (V29) adds MCP tools to define, validate, and run custom data queries. In Microsoft’s words, your MCP application “can then query data for which no existing APIs exist.”

Status: shipped with V29 in October 2026. Microsoft’s 29.0 release notes list “Run data queries with MCP Server” as generally available, but the MCP configuration documentation still labels the Data Query Tools (Preview) server feature as preview and subject to change. An administrator turns it on per configuration: in the Server Features section, select Data Query Tools (Preview) and then Activate.

Microsoft documents four read-only tools: bc_data_find_tables (find tables by keyword or semantic search), bc_data_get_table_schema (the fields of a table), bc_data_get_table_relations (join paths between tables), and bc_data_query, which compiles and validates an AL query and, with returnData set to true, runs it and returns the rows.

What changes in practice

Before V29: you want a Copilot Studio agent to answer “which customers have open invoices older than 60 days, grouped by salesperson?” The data spans tables and no single API page exposes it that way. You write a custom API page, deploy it, then point the agent at it.

With V29: the agent defines a query that joins and filters the data, validates it, and runs it. No new API page.

That closes the biggest gap for anyone building AI on BC: the API surface was the bottleneck, not the AI.

Why define → validate → run matters

The three-step structure is what separates this from “the agent can fire arbitrary SQL at your ERP”:

1. Define — construct the query
2. Validate — check it’s well-formed and correctly scoped
3. Run — execute it

The validation step is the safety property. An LLM will happily produce a confidently wrong query. Validate-before-execute is how any serious AI data-access layer stops malformed queries from hitting production — the same discipline we used to build in custom code, now part of the BC MCP surface.

What it unlocks

1. Natural-language reporting without a report developer — “inventory by warehouse for items below reorder point” without a custom API page or a Power BI model first.
2. Ad-hoc questions from ChatGPT or Claude — “what did we spend with vendor X last quarter?” answered by a query, not limited to pre-exposed pages.
3. Custom and ISV tables finally reachable — extensions that never published API pages can be queried, which matters in multi-extension environments.
4. Faster prototyping — validate the query and data shape first, then turn the recurring ones into proper API pages.

Does security loosen?

It shouldn’t. The MCP server runs every operation under the connecting user’s identity and Business Central permissions, and Microsoft hasn’t described custom queries as an exception. A query shouldn’t return data the user couldn’t already read. Validation is an extra guard on top of permission scoping, not a replacement. Microsoft’s documentation says the data query tools are read-only: they can’t create, modify, or delete data. It doesn’t spell out how table permissions apply to them, so verify this on a sandbox with a restricted test user before you let anyone near production.

Custom queries don’t make API pages obsolete. For recurring, business-critical access you’ll still want a proper API page: stable contract, predictable performance, reviewable code. Queries are for the long tail.

Realistic Use Cases (Not PowerPoint Fantasies)

Customer service: “What’s my order status?”

An agent in Teams or a portal answers “What’s the status of order SO-10432?”, “When did we last ship to Contoso?”, “How much does Alpine Ski House owe us?” — reading production data in real time, not a cached warehouse.

Sales: “Create a quote for an existing customer”

A Copilot Studio agent with create rights on quotes takes “Quote Fabrikam 50 units of item 1000 at standard pricing”, pulls the customer, checks inventory, creates the quote, and returns the number and total. The rep reviews and confirms.

Warehouse: “What needs picking today?”

A supervisor asks for unreleased sales orders due today. The agent lists them and offers “Release order 10435?” With the bound action allowed, the supervisor confirms and the order moves to the warehouse flow.

Finance: “Prepare the cash receipt journal”

With bound actions allowed on the right API page, a finance agent prepares the journal, flags exceptions, and — after human approval — triggers posting. The audit trail shows the approving user.

Custom line-of-business agents

Your unique process — a service order flow, rental management, field dispatch — can get a purpose-built agent that works with your extensions exactly as it does with standard entities, once the right API pages exist. With a custom development partner, that’s a days-not-months project.

The Admin Center MCP Server

A separate MCP server, in public preview since April 1, 2026, exposes the Business Central admin center API rather than business data.

Administrators can ask, from VS Code or another MCP client:

• “What’s the update status of my sandbox environments?”
• “Which environments have extension X installed?”
• “Show available upgrades for Production.”

And have the agent propose actions — copy Production to a new sandbox, schedule an update, investigate a failed upgrade — with explicit confirmation steps before anything runs. Endpoints that could disrupt an environment if called by accident are excluded.

This replaces a lot of PowerShell and Logic Apps glue for routine admin work.

For partners, one caveat: during preview it uses the same single-tenant authentication as the admin center API. A “health check across all my customers” isn’t one click. Microsoft provides a sample MCP proxy on GitHub that shows how to route requests to different tenants under GDAP. Useful, but it’s code you run and own.

Getting Started

For Business Central online customers this is configuration, not implementation:

1. Assign MCP - ADMIN to whoever manages the configuration.
2. Decide what agents may do. Start read-only. List the few writes you actually need.
3. Create configurations on page 8350 — one per agent or use case, Unblock Edit Tools only where needed, dynamic tool mode on if you expose many APIs.
4. Connect the host. In Copilot Studio, add the Business Central MCP connector. For VS Code, paste the connection string. For Claude, ChatGPT, or custom clients, register an Entra ID app and configure the endpoint and headers.
5. Test with MCP Inspector (free) to confirm connectivity and see exactly which tools are exposed.
6. Pilot on a sandbox — and turn on Data Query Tools in a sandbox configuration first if you want custom queries.

Checklist

• On Business Central online (the MCP server doesn’t apply to on-premises)
• MCP - ADMIN assigned to a named owner
• Read-only pilot configuration created and tested
• Write operations listed per API page, approved by the process owner
• Unblock Edit Tools on only in configurations that need writes
• Dynamic tool mode on where tool count exceeds client limits (70 in Copilot Studio)
• Entra ID app registered for any non-Microsoft client
• Tested with a restricted user to confirm permissions hold
• Configurations exported as JSON and version-controlled
• Copilot / model usage costs budgeted
• Data query tools evaluated on a sandbox before production use

Limitations and Honest Caveats

Writes need deliberate design. Nothing writes by default. You must decide what each agent may do, page by page. That’s the right design, but “just turn on full agent access” isn’t a plan.

Performance depends on your API pages. The MCP server calls your API pages (and, from V29, your queries). A slow custom API page makes a slow agent. The server doesn’t optimize your APIs.

Tool limits are real. Copilot Studio caps tools per agent at 70. Use dynamic tool mode or smaller, focused configurations.

One environment and one company per connection. A consolidated agent across subsidiaries needs multiple connections or an orchestration layer.

Custom queries are new. They shipped with V29, and the configuration documentation still labels them preview. Pilot before you depend on them.

Agents are only as good as their instructions. The MCP server provides tools; the host model provides reasoning. A vague system prompt gives vague — or confidently wrong — answers.

Language quality depends on the model. The protocol is language-agnostic, but understanding Romanian, German, or Spanish questions is down to the host model. Test in the language your team actually uses.

Where This Fits in Your AI Strategy

The BC MCP server isn’t a product you buy. It’s infrastructure you use. The real question is what you build on top.

Business Central’s built-in agents — the Sales Order Agent, the Payables Agent, and the Expense Agent — are packaged solutions for specific workflows. The MCP server is the open platform for everything else.

A sensible sequence:

1. Deploy the built-in agents where ROI is obvious (order intake, AP, expenses)
2. Use the MCP server for custom agents on your unique processes
3. Connect third-party hosts (Claude, ChatGPT, custom tools) where they beat Copilot Studio for the job
4. Use V29 custom queries for the long tail of questions, and build custom API pages for the recurring, critical ones

It’s additive, not rip-and-replace: same data, same security, same business logic, with agents as a new way in. For the rest of the V29 release, see What’s New in Business Central 2026 Release Wave 2.

The MCP server removes the biggest barrier to AI on your ERP: the integration tax. One protocol, one endpoint, any agent. Start read-only — “show me open orders for customer X” — and build from there.

We help companies configure the BC MCP server, design safe permission sets, and build custom agents and API pages for their processes.

Book a 30-minute call →

Frequently asked questions

What exactly is the Business Central MCP server?

It’s a Microsoft-hosted gateway at https://mcp.businesscentral.dynamics.com that implements the Model Context Protocol for Business Central online. It exposes your API pages as tools that AI clients such as Copilot Studio, GitHub Copilot in VS Code, ChatGPT, and Claude can discover and call, without custom integration code. It entered public preview on October 31, 2025 and became generally available on April 1, 2026.

Is the Business Central MCP server secure?

It doesn’t bypass Business Central security. Authentication uses OAuth with Microsoft Entra ID, every call runs under the signed-in user’s identity and permissions, and write operations are off until an administrator turns on Unblock Edit Tools and allows create, modify, delete, or bound actions per API page. Configuration changes are audited through Microsoft Purview.

How do I enable and configure the MCP server?

There’s no Feature Management switch. With the MCP - ADMIN permission set, open the Model Context Protocol (MCP) Server Configurations page (page 8350), create a configuration, turn on the server features you need, add API pages or API queries as tools with the permissions you want, and set Active. Without a configuration of your own, the built-in default configuration already lets clients discover and read the API pages and API queries the signed-in user has permission to use.

What are the V29 custom data queries?

Business Central 2026 release wave 2 (V29), released in October 2026, adds read-only MCP tools to find tables, read their schema and relations, and compile, validate, and run AL queries, so an MCP client can query data that no existing API page exposes. Microsoft’s 29.0 release notes list the feature as generally available, while the MCP configuration documentation still labels the Data Query Tools server feature as preview. An administrator turns it on per MCP configuration.

Can I use it with ChatGPT or Claude instead of Copilot Studio?

Yes. Microsoft supports any client that follows the MCP specification, including ChatGPT, Claude, and MCP Inspector. VS Code and Copilot Studio use a preregistered Entra ID app; for other clients you register your own application in Microsoft Entra ID and pass tenant, environment, company, and configuration name as HTTP headers.

What’s the difference between the data MCP server and the admin center MCP server?

The data MCP server exposes business data and processes: customers, items, orders, journals. The admin center MCP server, in preview since April 2026, exposes the admin center API: environment update status, installed extensions, environment copies, and failed upgrades. Potentially disruptive endpoints are excluded, and actions require explicit confirmation.

What does the Business Central MCP server cost?

The server is included with Business Central online, with no separate license and no per-call fee. You pay for the AI side: Copilot Studio capacity or Copilot credits for Microsoft agents, and whatever ChatGPT, Claude, or your model provider charges for third-party clients. Custom API pages are development work priced by complexity.

Can I expose my custom Business Central extensions through MCP?

Yes. Any top-level API page, standard or custom, can be added to an MCP configuration as a tool; ListPart and CardPart API subpages aren’t supported. From V29, custom data queries can also reach tables and fields that were never published as API pages, which helps with ISV extensions and prototypes.

Vanguard 360 Solutions is a Microsoft Dynamics 365 Business Central partner and LS Retail Gold Partner based in Romania, serving clients across Europe, the UK, UAE, and Saudi Arabia. Our work includes LS Central across 120+ stores in Romania, Pharmacy for LS Central across 100+ pharmacies in Norway, and the architecture for a 700-store retailer in 13 countries.