Your ERP System Can Now Take Actions on Its Own. Is Your Team Ready for That?
For twenty years, Business Central and its predecessors have been systems of record. They stored what already happened: the invoice you posted, the order you shipped, the reconciliation you closed. Every entry in the ledger existed because a person made a decision first and the system captured it second.
That sequence is starting to reverse. As of 2026 release wave 1, Business Central ships with built-in agents, most notably a Sales Order Agent, a Payables Agent, and now an Expense Agent, that read incoming documents, match them against your data, and prepare transactions for approval without a person opening the record first. Underneath that, Microsoft has published a Model Context Protocol (MCP) server for Business Central, a standardized connection point that lets AI clients such as Copilot Studio, GitHub Copilot, Claude, and ChatGPT read and, if you allow it, write directly into your ERP data.
If you run finance, operations, or IT for a mid-market or enterprise business on Business Central, this is not a feature update you can skim past. It changes who, or what, is allowed to touch your transactional data, and it puts a governance decision on your desk whether you asked for one or not.
Why Microsoft Is Calling This "Agent-Ready" Instead of Just "AI-Powered"
Microsoft's own framing matters here. In a July 2026 post on the Dynamics 365 blog, Microsoft describes the platform shift explicitly: business applications are moving from systems that record what already happened to systems that help move work forward, with people setting the guardrails. The company states that Dynamics 365 now exposes more than 650,000 MCP actions across sales, finance, supply chain, human resources, field service, customer service, and project operations.
That figure describes the Dynamics 365 platform as a whole, not Business Central specifically. It is easy to read a number like that and assume your ERP now has near-total AI coverage. It does not. What is actually exposed to an agent in your environment depends entirely on which API pages your Business Central MCP server configuration grants access to, and whether that access is read-only or extended to create, modify, delete, and bound actions. Before any conversation about what your organization can automate, ask your implementation partner for the specific list of API pages exposed in your environment, not the platform-wide headline number. That is one of the more common ways rollout expectations run ahead of what is actually configured.
The Decision in Front of You Isn't "Agents: Yes or No." It's Sequencing.
Most Business Central customers are not being asked whether to adopt AI agents. Microsoft ships Copilot with every Business Central license at no additional cost, and the built-in agent framework is now part of the base product. The real decision is which agents you activate, in what order, with what permissions, and under whose sign-off.
That framing matters because Business Central's built-in agents ship with very different risk profiles. A Sales Order Agent that drafts a sales order from a customer email and routes it for confirmation is a productivity gain with limited downside if it gets something wrong. A Payables Agent that reads vendor invoices, matches them to purchase orders, and prepares entries for posting sits much closer to your financial controls. An Expense Agent that processes an employee's receipt sits somewhere between the two: lower dollar value per transaction than accounts payable, but it touches employee data and, as covered below, a different AI subprocessor entirely. Treating all three as the same kind of decision, made by the same person, on the same timeline, is where several of the early missteps we're seeing come from.
How the MCP Server Actually Works Inside Business Central
It helps to understand the mechanism rather than take "AI agent" as a black box. The Business Central MCP server is a single endpoint, https://mcp.businesscentral.dynamics.com, that every supported AI client connects to. You do not stand up separate infrastructure per tool. Instead, the request identifies which Business Central environment and company to act on using HTTP headers for your Microsoft Entra tenant ID, environment name, and company name.
Three details in the underlying architecture are worth knowing before you approve a rollout:
By default, the MCP server grants read-only access to exposed API pages. Nothing writes to your data until an administrator explicitly configures an API page object with create, modify, delete, or bound-action permissions. That default is a genuine safety net, and it is also the first thing many teams disable in the rush to get value from the tool.
Authentication runs through Microsoft Entra ID using OAuth 2.0 with Proof Key for Code Exchange (PKCE), the same authorization code flow used for other secure Microsoft integrations. Every action an agent performs runs under a real user identity and that user's existing permission set. There is no shadow account. If your audit trail today shows who touched a record, it will keep showing that with agents in the loop, provided you have not granted the agent's connecting application broader rights than the person it acts on behalf of holds.
Non-Microsoft clients, including Claude and ChatGPT when used outside Copilot Studio, require you to register your own application in Entra ID. Microsoft's own clients, Visual Studio Code and Copilot Studio, use a preregistered application and need no extra setup. That distinction affects your security review timeline: a Copilot Studio agent can be pilot-ready in days, while a custom MCP integration through a third-party AI client needs an application registration and access review first.
Built-In Agents and Custom Agents Are Two Different Ownership Models
2026 release wave 1 also introduced a Custom Agent Designer inside Business Central, letting internal teams or implementation partners build agents tuned to a specific process rather than relying only on the two Microsoft ships out of the box. This is where a decision most businesses do not think to make upfront becomes important: who owns support and maintenance when the agent misbehaves?
A built-in Sales Order Agent or Payables Agent is Microsoft's code. When Microsoft changes the underlying model or logic, the behavior of that agent can change with it, on Microsoft's release schedule, not yours. A custom agent built through the Agent Designer or orchestrated in Copilot Studio is closer to a piece of your own extension estate. It needs the same change management, testing, and version control discipline you already apply to AL customizations. Businesses that treat a custom agent as a "set and forget" configuration, the way they might treat a report layout, tend to find out the hard way when a process change upstream quietly breaks the agent's assumptions.
A Third Model: Expense Agent Is Built for People Who Never Log Into Business Central
Sales Order Agent and Payables Agent were both designed for people already working inside the ERP. Expense Agent, announced by Microsoft in April 2026 and moving toward broader availability through 2026 release wave 1, follows a deliberately different design philosophy, and the difference is worth understanding before you assume it fits the same rollout pattern as the other two.
Expense Agent targets employees who are not Business Central users at all: field technicians, drivers, traveling salespeople, and occasional office staff who submit a handful of expenses a month and have no reason to learn an ERP interface. Employees capture receipts through a dedicated web app at app.expenses.dynamics.com, by forwarding them to a monitored shared mailbox, or eventually through Outlook and Microsoft 365 Copilot Chat.
None of those submission channels require a Business Central license. The agent extracts merchant, date, amount, currency, and line-item detail from the receipt, applies your configured expense categories and policy rules, handles mileage and per diem calculations, groups everything into a monthly expense report per employee, and routes it for approval. Once approved, posting still happens inside Business Central under your existing controls, generating the same expense ledger, employee ledger, and G/L entries a manually entered report would.
Two details here carry more business weight than a typical feature announcement:
Expense Agent runs on Anthropic models rather than Microsoft's own, and using it requires an administrator to formally enable Anthropic as an approved AI subprocessor in the Microsoft 365 Admin Center before the feature will function. That is not a configuration checkbox to click through. It is a data processing decision that your procurement, legal, or data protection function should sign off on the same way they would review adding any new subprocessor to a vendor agreement, and UK and Canadian organizations subject to UK GDPR or PIPEDA obligations should route it through whatever third-party data processor review already governs other Microsoft 365 add-ins.
Expense Agent is billed differently from the other two agents. Rather than a seat-based or bundled model, it consumes Copilot Credits at a flat rate of fifty credits per receipt processed, covering extraction, categorization, itemization, and grouping into a report regardless of how complex the receipt is. That is a genuinely usage-based cost that scales with expense volume, not headcount, which changes the budgeting conversation compared to a per-user Business Central license. A business with a large field workforce submitting frequent, simple expenses will want to model that credit consumption before rolling the agent out broadly, not after the first invoice.
As of this writing, Expense Agent is a production-ready preview feature, with public preview beginning in May 2026 limited to English-language use in the United States, and Microsoft stating that additional languages and country availability, which would include the UK and Canada, are planned to begin rolling out from July 2026. UK and Canadian finance teams reading about this feature should confirm current regional and language availability with their Microsoft partner before including it in a near-term budget, since a preview timeline stated in April can move.
What Early Adopters Are Actually Doing
Public detail on production Business Central agent rollouts is still thin, which is itself worth noting: most of the material available right now is written for developers configuring the MCP server, not for the finance director deciding whether to turn on write access for accounts payable. That is a gap worth being direct about, because the operational and governance questions matter more to a business leader than the API configuration steps.
Where we do have visibility is in how partners are applying the same MCP architecture across the wider Dynamics 365 platform, and the pattern is instructive even outside Business Central specifically. Microsoft's July 2026 partner roundup describes proMX's Project Operations Activity Approvals Agent, which started narrowly, with time-entry approvals that were stalling billing prep, kept human approvers in the loop with predefined thresholds, and reached fifty percent internal adoption within weeks of rollout.
The same post describes TrueGradient's forecasting agents in production at Angelcare, a consumer packaged goods manufacturer, where the customer reports a twelve percent improvement in demand forecast accuracy alongside separate efficiency targets in trade promotion and logistics cost. Both examples share a pattern worth borrowing regardless of which Dynamics 365 application you run: start with one narrow, high-volume, low-ambiguity process, keep a human checkpoint at the threshold that matters financially, and expand only after you can point to a measured result, not a demo.
Six Ways Businesses Get This Wrong
Enabling write access before defining approval thresholds. The default read-only configuration is doing you a favor. Flip it to write access for accounts payable or sales ordering before you have documented who approves what dollar threshold, and you have built an automation with no brake pedal.
Assuming agent licensing is bundled the way Copilot chat is. Copilot itself comes with a Business Central license at no separate cost. Consumption-based agent capacity, particularly for higher-volume use of the Payables Agent or custom agents built through the Agent Designer, is a different commercial conversation, and Microsoft's agent pricing has continued to evolve through 2026. Confirm current agent capacity pricing and currency terms with your Microsoft partner before budgeting, and treat any number you see in a blog post, including this one, as a starting estimate rather than a quote.
Registering a non-Microsoft AI client without an access review. If your team wants to connect Claude or ChatGPT directly to Business Central data through MCP rather than through Copilot Studio, that requires registering your own application in Entra ID. Skipping a security review on that registration because "it's just a read-only connection" ignores that read-only today can become write-enabled tomorrow with one configuration change, by someone who may not remember why read-only was the original decision.
Treating the Sales Order Agent and the Payables Agent as equivalent risk. One touches revenue recognition and customer commitments. The other touches cash disbursement and vendor payment. They deserve different approval owners and different rollback plans, not the same change request.
Skipping the "what does our auditor think" conversation until after go-live. Because every agent action runs under a real user identity with existing permissions, your audit trail mechanics do not fundamentally change. What does change is transaction volume and initiation pattern, and that is exactly the kind of shift an external auditor or compliance reviewer wants to know about before it shows up in a sample, not after.
Enabling Expense Agent without a subprocessor review. Because Expense Agent runs on Anthropic models, activating it requires approving Anthropic as a subprocessor in the Microsoft 365 Admin Center. Treating that as an IT setup step rather than a data governance decision skips the review your legal or data protection function would normally apply to any new third party touching employee and financial data.
A Practical Sequencing Framework
Start with the lowest-stakes, highest-volume built-in agent your team already understands manually, most commonly the Sales Order Agent for a business with a steady stream of email-based orders. Run it in shadow mode, drafting but not posting, for a defined period before granting write access.
Set a dollar or volume threshold for automatic processing versus mandatory human review, and put that threshold in writing before go-live, not after the first exception occurs.
Confirm the exact API pages exposed in your MCP server configuration with your implementation partner, and review that list the same way you would review a new integration's data access scope, because that is precisely what it is.
Bring your controller or finance lead into the Payables Agent conversation before your IT team configures write access, not after. The technical configuration is the easy part; the approval workflow redesign is where the real work sits.
If you are considering a custom agent through the Agent Designer, scope it, test it, and version it the way you would any AL extension, with a named internal or partner owner responsible for what happens when Microsoft's underlying platform changes under it.
Revisit licensing and agent capacity consumption quarterly through 2026 and into 2027, since Microsoft's release cadence for this feature set is unusually fast and commercial terms are still settling.
If your business has a large field or traveling workforce, evaluate Expense Agent on its own track rather than folding it into the Sales Order or Payables rollout. Confirm regional and language availability for the UK or Canada with your Microsoft partner first, get the Anthropic subprocessor approval through your data protection review before enabling it, and model Copilot Credit consumption against your actual monthly receipt volume before committing budget.
Where This Goes Next
Business Central 2026 release wave 2, expected from October 2026, is set to extend automated order processing beyond sales quotes into integrated business-to-business order handling across email, Microsoft Teams, Shopify, and EDI, alongside the retirement of legacy SOAP web services in favor of modern OData v4 REST APIs.
Expense Agent's own roadmap runs on a similar trajectory: Microsoft describes public preview as an ongoing journey rather than a single milestone, with regular capability additions and expanding language and country coverage planned throughout the year. The direction across all three agents is consistent: more of the order-to-cash, procure-to-pay, and now employee-expense cycle becomes agent-assisted by default, and the API surface underneath it keeps modernizing to support that. Businesses that build governance muscle now, on one or two agents, will be far better positioned for wave 2 and for Expense Agent's general availability than those adopting agents for the first time when the next release lands.
The Short Version
Business Central's built-in agents and its MCP server are not a future roadmap item. They are shipping now, in your license, on Microsoft's default configuration of read-only access. The decision in front of most businesses is not whether to use AI agents in Business Central. It is which agent to activate first, what approval threshold sits behind it, who in finance signs off before write access is enabled, and how you will explain the change to your auditor before they ask. Get that sequencing right on one process and the rest of the agentic roadmap becomes a repeatable playbook rather than a series of one-off risk decisions.
Where to Start
If your team is weighing whether to activate Sales Order Agent, Payables Agent, or a custom agent built on the Business Central MCP server, the highest-value first step is usually an honest audit of what is actually exposed in your environment today and what your approval thresholds should be before you touch the configuration.
Dynamics Square's team has published a longer walkthrough of both built-in agents, including cost and rollout mechanics, in our , and our outlines how our implementation and consulting teams approach agent governance as part of a broader Business Central engagement. If you are still scoping budget for this stage of your ERP investment, our is a reasonable starting point for a directional estimate ahead of a formal quote.
UK-based teams evaluating the same rollout should account for VAT treatment on any consumption-based agent licensing added mid-contract-term, a detail worth confirming directly with your Microsoft CSP; our UK team has covered the practical case for agent adoption in , and our covers how Copilot and agent capabilities sit together across the wider Dynamics 365 estate.
Canadian businesses should similarly confirm GST/HST treatment and CAD-denominated agent capacity pricing with their Microsoft partner before budgeting, since consumption-based AI features are priced and taxed differently across regions. Our Canadian team's breakdown in and our are useful starting points for scoping a rollout in the Canadian market.
None of this replaces your own legal, tax, or compliance advisor's review of how agent-initiated transactions affect your specific regulatory obligations. Treat the figures and thresholds in this article as a starting framework, confirm them against your current Microsoft agreement, and adjust based on your organization's actual risk tolerance.
Frequently Asked Questions
What is an MCP server in Dynamics 365 Business Central?
It is a standardized connection point, built on the open Model Context Protocol, that lets AI clients such as Copilot Studio, GitHub Copilot, Claude, and ChatGPT read and, if configured, write Business Central data through a single endpoint, using your existing Microsoft Entra ID permissions.
Do AI agents in Business Central cost extra?
Copilot itself is included with a Business Central license at no additional charge. Higher-volume use of built-in agents such as the Payables Agent, and custom agents built through the Agent Designer, are commercial questions Microsoft continues to refine through 2026. Confirm current agent capacity pricing directly with your Microsoft partner rather than assuming it is bundled.
Is data accessed by an AI agent in Business Central secure and auditable?
Every MCP-initiated action runs under a real user identity using OAuth 2.0 with PKCE through Microsoft Entra ID, and it is bound by that user's existing permissions, so your existing audit trail continues to show who performed each action. Security still depends on how you configure API page permissions and which applications you register for non-Microsoft clients, so the underlying framework being auditable does not remove the need for your own configuration review.
What is the difference between Copilot and an AI agent in Business Central?
Copilot in Business Central responds to a person's request within a session, drafting text, summarizing data, or suggesting an action for a user to approve. A built-in agent such as the Sales Order Agent or Payables Agent operates more autonomously against a defined process, reading incoming documents and preparing or, if permitted, completing transactions with configurable human checkpoints.
How should a business start with AI agents in Business Central without risking data integrity?
Begin with the default read-only MCP configuration, pilot one built-in agent in a shadow or draft-only mode, define approval thresholds in writing before granting any write access, and involve your finance or controls owner in the Payables Agent decision specifically, since it sits closest to cash and vendor payment risk.
What is Expense Agent and how is it different from the other Business Central agents?
Expense Agent automates employee expense capture, categorization, and reporting. It is built for people who often do not hold a Business Central license at all, submitting receipts through a dedicated web app, a shared mailbox, or Outlook rather than inside the ERP itself. Unlike Sales Order Agent and Payables Agent, it runs on Anthropic models under a formal subprocessor approval. It is billed per receipt through Copilot Credits, rather than bundled with a user license. As of mid-2026 it is in preview, initially limited to English-language use in the United States. UK and Canadian availability is expanding from July 2026 onward, so confirm current regional rollout with your Microsoft partner before budgeting for it.