… 3 unchanged lines …
  ## Key facts
  - **The first-party tool set reached GA in September 2026** as the *Dynamics 365 Customer Experience MCP Server for Service*, an independent offering carrying **90+ tools**. The inbound registration of non-Microsoft MCP servers described here is the part that remains preview — check each half's status separately rather than treating "MCP" as one maturity.
  - Validated clients for the first-party server: Microsoft 365 Copilot (including Service Agent), Copilot Studio agents, Visual Studio Code, GitHub Copilot CLI, and other HTTP-based MCP clients.
- - Tool access aligns with existing Dataverse roles and permissions — no parallel permission model to design.
+ - Connections to the first-party server are brokered by the **Agent 365 Tooling Gateway**, a Microsoft-hosted service that authenticates to your Dataverse environment and enforces Dataverse roles at **both** tool discovery and tool execution. You don't deploy it and you can't bypass it — it's in the path for every MCP client.
+ - Tool access aligns with existing Dataverse roles and permissions — no parallel permission model to design. A tool can be discoverable and still be refused at execution time if the underlying record or action isn't permitted, so discovery is not an entitlement.
+ - Tools that aren't mapped to a specific privilege are **discoverable by default**. That is the exception worth knowing about before you assure anyone that Dataverse security covers the whole surface.
  - Two directions, don't confuse them: **inbound** MCP servers bring external tools *into* Service Agent so reps can use them; the separate "Customer Service MCP Server" exposes D365 data *outward* to other MCP clients. This doc is about the inbound side.
- - First-party MCP tools cover case management, customer/account/contact lookup, knowledge search and article drafting, email draft/rewrite/translate/send, activities and notes, timelines, conversation summaries, and some admin/config actions.
+ - First-party tool categories, as of the September 2026 refresh: case management (including SLA status), customer and account context with activity timelines, knowledge (search, draft, **harvest new articles, identify knowledge gaps**, publish), email (draft, generate, rewrite, translate, send, apply templates, log activities, link to case, **create a case directly from an email**), **intelligence and recommendations** (next-best-action, response preview), **data and search** (query and update Dataverse records, cross-entity search), and admin/maker actions including registering external MCP servers and Copilot Studio agents and customising grids and views.
  - Reps and supervisors never call tools directly. The agent decides which tool to invoke and shows the result in chat, sometimes as an interactive "app-in-chat" component (grids, forms, cards) they can act on.
  - Registering a non-Microsoft MCP server needs an accessible MCP endpoint that supports **Microsoft Entra authentication**. No Entra support on the endpoint, no connection.
  - MCP servers are added through **maker mode** in Service Agent (natural-language prompts like "enter maker mode" → "Add MCP server"), scoped at **Organization** level — not the classic admin center UI.
    … 14 unchanged lines …
  - Configuration lives inside a conversational maker mode, not a settings page. It's discoverable once you know the prompts, but the modify/remove flows are still light on documented exact wording — expect some trial and error.
  - Removing a server pulls its tools out of the agent immediately. It doesn't touch the external server, but any rep workflow leaning on those tools stops working the moment you disconnect.
  - Tool prefixes matter. Register two servers with overlapping tool names and no prefixes and you'll get ambiguous behaviour.
+ - The Agent 365 Tooling Gateway is a Microsoft-hosted dependency between your MCP clients and your Dataverse data. It doesn't change the security model, but it is another service in the path and another line for the client's architecture review — expect to be asked about it and don't be surprised by it in the room.
  
  ## Consultant notes
  
    … 1 unchanged line …
  - The Entra-auth requirement is the first thing to check with the client's platform team. It's a hard gate, and retrofitting Entra onto an existing internal MCP endpoint can be a project in itself. Confirm it before you promise the integration.
  - Maker mode being conversational rather than a UI screen throws admins who expect a settings page. Walk whoever owns this through the prompts once; it's not self-evident from the admin center.
  - Governance is worth setting early: decide who can register servers and which tools get exposed. An over-permissive rollout means reps' agents can suddenly act in external systems nobody reviewed.
+ - The "discoverable by default when unmapped" rule is the one to raise with a security-minded client. Their mental model will be that Dataverse privileges gate everything; that's nearly true, and the gap is small, but it's better coming from you in design than from their penetration test.
  
  ---
  
- *Worth revisiting after the next release wave. Last refreshed 2026-09-22: the first-party tool set reached GA as an independent offering with 90+ tools, while inbound non-Microsoft MCP server registration stays preview — maker-mode modify/remove flows still aren't fully documented.*
+ *Worth revisiting after the next release wave. Last refreshed 2026-09-23: the Agent 365 Tooling Gateway documented as the connection broker, discovery-versus-execution enforcement clarified, and the first-party tool categories expanded (intelligence and recommendations, data and search, knowledge-gap identification). Inbound non-Microsoft MCP server registration stays preview.*
  

    … 1 unchanged line …
  Model Context Protocol (MCP) tools are standardised business actions that the AI agents in the desktop — chiefly Service Agent — call in the background to read and act on service data. Microsoft ships a set of first-party MCP tools (case, customer, knowledge, email, activity, admin actions), and admins can also register non-Microsoft MCP servers to expose their own tools to the agent.
  
  ## Key facts
+ - **The first-party tool set reached GA in September 2026** as the *Dynamics 365 Customer Experience MCP Server for Service*, an independent offering carrying **90+ tools**. The inbound registration of non-Microsoft MCP servers described here is the part that remains preview — check each half's status separately rather than treating "MCP" as one maturity.
+ - Validated clients for the first-party server: Microsoft 365 Copilot (including Service Agent), Copilot Studio agents, Visual Studio Code, GitHub Copilot CLI, and other HTTP-based MCP clients.
+ - Tool access aligns with existing Dataverse roles and permissions — no parallel permission model to design.
  - Two directions, don't confuse them: **inbound** MCP servers bring external tools *into* Service Agent so reps can use them; the separate "Customer Service MCP Server" exposes D365 data *outward* to other MCP clients. This doc is about the inbound side.
  - First-party MCP tools cover case management, customer/account/contact lookup, knowledge search and article drafting, email draft/rewrite/translate/send, activities and notes, timelines, conversation summaries, and some admin/config actions.
  - Reps and supervisors never call tools directly. The agent decides which tool to invoke and shows the result in chat, sometimes as an interactive "app-in-chat" component (grids, forms, cards) they can act on.
    … 26 unchanged lines …
  
  ---
  
- *Public preview capability as of mid-2026 — worth revisiting once maker-mode modify/remove flows are fully documented and any GA/licensing terms land*
+ *Worth revisiting after the next release wave. Last refreshed 2026-09-22: the first-party tool set reached GA as an independent offering with 90+ tools, while inbound non-Microsoft MCP server registration stays preview — maker-mode modify/remove flows still aren't fully documented.*