Microsoft gave business software agents a major upgrade this week at Convergence 2025, announcing that its Dynamics 365 Enterprise Resource Planning connector now supports a dynamic protocol that can surface more than 200,000 distinct business functions directly to AI agents. The shift, detailed in a company blog post today, turns the existing static catalog into an adaptive framework that allows agents to discover and interact with live forms, fields, and actions across the ERP system — the same ones human workers use.

This is not a cosmetic update. The new dynamic Model Context Protocol (MCP) server for Dynamics 365 ERP, coupled with a newly previewed analytics MCP server and expanded capabilities in Copilot Studio, signals that Microsoft is pushing hard to make "agentic business applications" a practical reality, not just a slide deck promise. If you run finance, supply chain, or customer operations on Microsoft’s stack, what happened at Convergence 2025 will shape your automation roadmap for the next two years.

What’s Actually New at Convergence 2025

Forget broad visions — here are the concrete deliverables and previews that matter.

The Dynamic ERP MCP Server

The existing ERP MCP shipped with a small, hand-curated set of static actions for Finance and Supply Chain. That was fine for proofs of concept, but it meant agents could only touch the few operations Microsoft had pre-wired. The dynamic server destroys that ceiling. It can discover and present hundreds of thousands of forms, fields, and server-side functions, effectively offering agents the same operational surface a human user sees inside Dynamics 365.

Microsoft’s blog post talks about supporting “millions of ERP actions,” but more conservative technical documentation points to “hundreds of thousands” of functions. For a typical enterprise with heavy customizations, the actual number will depend on the specific modules and custom logic deployed. Still, even the lower bound is a leap from the handful of actions available before.

Why does dynamic discovery matter? Because it means you no longer have to manually wrap every business process in custom APIs just to let an agent touch it. The MCP runtime automatically turns existing ERP logic into agent-accessible tools — assuming permissions and governance are set correctly.

Analytics MCP Server (Public Preview in December 2025)

Agents don’t just act; they need to reason over numbers. The new analytics MCP server exposes governed measures, dimensions, and semantic models from Dataverse and Fabric. An agent can now pull near-real-time metrics using the same definitions your BI teams trust, without the lag of a stale data export. Public preview is set for this month.

Copilot Studio Becomes the Agent Control Center

Copilot Studio is now the hub for building, testing, and governing agents. Notable additions include:

  • Autonomous triggers — agents can respond to events (a new sales order, a late payment) and run flows without a human pushing a button.
  • Multi-agent orchestration — agents can hand off tasks to each other, coordinating across domains like HR, finance, and supply chain.
  • “Computer use” actions — when an app lacks an API, an agent can interact with it by mimicking mouse clicks and keystrokes (a fallback for legacy systems, but one that raises reliability and security questions).
  • Agent identities — every agent gets its own identity in the tenant, with the same role-based access controls a human employee would have. Activity analytics let admins see what agents are doing and where they fail.

Embedded Agents Inside Business Applications

Small and mid-sized businesses running Dynamics 365 Business Central are getting first-party agents baked directly into the product:

  • Sales Order Agent — creates, validates, and updates sales orders, cutting manual data entry.
  • Payables Agent — automates vendor invoice processing and reconciliations.

Larger deployments of Dynamics 365 Finance & Operations get agents for time and expense entry, supplier outreach, field technician scheduling, and more. A new Product Change Management Agent Template, built on Copilot Studio, is now in public preview, aimed at manufacturers who want to speed up engineering change approvals.

Partner-Built Agents Show the Ecosystem in Motion

Microsoft showcased a handful of partner agents that connect through the MCP:

  • Shop Floor by RSM — brings production signals, quality checks, and machine data into a Copilot interface.
  • PayFlow Agent by HSO — handles vendor payment inquiries by pulling live payment status from Dynamics 365.
  • Quality Impact Recall Agent by Cegeka — traces product quality issues through inventory and shipments.
  • Factorial — uses the Business Central MCP to automate expense workflows across systems.
  • Zensai — converts operational data into goal-setting and performance check-ins inside Microsoft 365.

These prove the model works, but remember: they are vendor case studies. Your mileage will vary depending on data quality, customizations, and how well you govern the agent identities.

What This Means for Your Business

The shift from static catalogs to a dynamic, discoverable protocol changes the automation game for three audiences.

For business leaders and process owners: You can now automate far more of your day-to-day ERP operations. Instead of asking IT for custom integrations every time you want an agent to check inventory or approve a purchase order, the agent can navigate the same forms your team uses — if you trust it to do so. The immediate win is speed: processes that used to take hours of manual clicking can now run autonomously, with humans stepping in only for exceptions.

But trust is the catch. An agent that can open any form can also make mistakes at scale. Start with bounded processes (e.g., sales order creation from a known customer) where errors are cheap and reversible. Scale up only after you’ve measured accuracy and built failsafes.

For IT and security teams: This announcement should trigger a serious conversation about identity hygiene. Agents now act as first-class principals in your tenant. If an attacker compromises an agent’s OAuth tokens or tricks someone into granting malicious permissions, the blast radius is enormous. Microsoft provides tools — agent identities, conditional access, Purview data protection — but these are not on by default. You must configure them.

Immediate steps: require admin consent for application permissions, enforce multifactor authentication, assign least-privilege scopes to every agent, and audit agent activity logs regularly. Recent security research has shown that social engineering attacks targeting agent consent flows are already happening. Treat agent identities like privileged user accounts.

For developers and solution architects: The MCP reduces integration plumbing. Instead of building and maintaining a thick layer of custom APIs, you can let Copilot Studio agents call ERP functions directly through the MCP endpoint. However, you’ll still need to design guardrails. Test agents rigorously with synthetic and production-mirrored data, especially for UI-driven interactions on legacy or heavily customized forms, which can break unexpectedly. Plan migration from the old static MCP to the dynamic server: Microsoft has signaled a timeline, though precise dates are still to come.

How We Got Here

Agents inside Dynamics 365 are not new. For two years, Microsoft has been adding Copilot-powered assistants for sales, service, and finance. But until now, those agents were limited to a handful of scripted actions — essentially, the same few API calls a developer would code by hand. The MCP was introduced last year as a way to standardize those connections, but its static nature meant it couldn’t keep up with customizations or rarely used screens.

The push toward a dynamic server accelerated after Microsoft saw partners and customers hitting that wall. At Ignite 2025 in November, the company previewed the dynamic MCP concept and announced the analytics MCP, but Convergence 2025 marks the operational delivery: public previews, concrete timelines, and a clear governance framework in Copilot Studio.

The broader industry context helps explain the urgency. Salesforce, SAP, and Oracle are all racing to embed AI agents into their platforms. By making its MCP an open protocol and stitching together ERP, CRM, Dataverse, Fabric, and Microsoft 365, Microsoft is betting that its end-to-end data estate will be the decisive advantage.

Your To-Do List for the Agentic Era

Adopting agentic applications responsibly isn’t a flip-a-switch exercise. Here’s a pragmatic, phased approach.

  1. Pick one high-value, low-risk process. Don’t try to automate everything at once. Start with a repetitive task that has clean data and low error costs — for example, sales order validation, basic vendor invoice matching, or simple time-entry approvals.

  2. Invest in data hygiene. Agents rely on trustworthy data. If your customer master or inventory records are messy, agents will make bad decisions. Use the Dataverse‑Fabric mirroring to create a single source of truth for metrics, and standardize master data definitions.

  3. Lock down identities before you deploy. For every agent you create, assign a dedicated identity with the fewest permissions it needs. Turn on conditional access and multifactor authentication. Configure Purview sensitivity labels so that agents can’t leak PII or financial data into ungoverned channels like email or Teams chats.

  4. Pilot with human-in-the-loop. Use Copilot Studio triggers that require a person to approve non-routine actions. Log every agent action with full traceability, and build rollback procedures for transactions that go wrong.

  5. Measure, then scale. Track cycle time, error rate, and user satisfaction. Only expand agent scope once you’ve proven value in your pilot. When you do expand, bring in partners who have experience with MCP and Copilot Studio for complex integrations, especially if you run on-prem legacy systems.

  6. Don’t forget non-technical change management. Agents will change how people work. Finance clerks, dispatchers, and supply chain planners may resist if they fear for their jobs. Frame agents as tools that remove drudgery and elevate their roles into exception-handling and strategic tasks. Retrain, don’t replace.

What Comes Next

Convergence 2025 has set a clear direction, but the roadmap still has missing pieces. The analytics MCP server enters public preview this month, and the dynamic ERP MCP will presumably follow a similar path into general availability next year. Keep an eye on:

  • GA dates and migration guides for the dynamic MCP. Microsoft must publish a concrete timeline for moving off the static server.
  • Third-party adoptions. If independent software vendors start building their own MCP servers that plug into this framework, the ecosystem will accelerate dramatically.
  • Incident reports. As enterprises push agents into production, expect headlines about costly mistakes. Those failures will teach the industry where the guardrails need to be higher.

The era of agentic business applications isn’t coming — it’s here. But it will reward organizations that treat it as an operational discipline, not a magic bullet.