Almanac
Microsoft/dataversePower Platform

Consultant KB for Microsoft Dataverse, the data layer under Dynamics 365 and the Power Platform: data model, security model, business logic, APIs and integration, search and queries, analytics and Fabric, ALM and solutions, administration, governance and compliance, and Dataverse as an agent data platform, plus cross-cutting decision guides. Implementation notes, configuration decisions and the gotchas that bite on real projects. Populated by the daily author agent from the Dataverse release plans, docs repo and product blog, plus the author's own consultant notes.

dataverse/04-apis-and-integration/feature-dataverse-mcp-server.md
feature-dataverse-mcp-server.mdv1 · history
CurrentApplies to DeveloperUpdated last monthSource Microsoft Learn ↗

What it does

Dataverse exposes itself as a Model Context Protocol server, so agents and coding tools can discover and call a defined set of tools against an environment's data and schema. The endpoint is https://{org}.crm.dynamics.com/api/mcp, and clients include Copilot Studio agents, GitHub Copilot in VS Code and the Copilot CLI, Claude desktop and Claude Code, and any other MCP-compatible client.

Key facts

  • The generally available tool surface as documented in June 2026: search_data, search, create_record, update_record, delete_record, create_table, update_table, delete_table, read_query, describe, upsert_skill, delete_skill, init_file_upload, commit_file_upload and file_download.
  • The tool shape changed. describe_table, list_tables and fetch were removed and replaced by describe. The old search tool that searched data was renamed search_data, and search now searches metadata — table schemas and business skills. If you maintain allow or deny lists by tool name, they mean something different than they used to.
  • delete_record and delete_table are documented as requiring explicit user approval.
  • read_query runs Dataverse SQL SELECT queries, with restrictions on supported keywords that the tool description itself carries.
  • The Copilot Studio client is enabled by default in every environment. Every other client has to be enabled individually in the Power Platform admin center under Settings > Product > Features > Dataverse Model Context Protocol, then per-client under Advanced Settings.
  • Managing the server through advanced connector policies requires the environment to be a Managed Environment.
  • Allow-listing applies only to the /api/mcp entrypoint. Custom APIs that happen to have MCP in the name are ordinary Dataverse APIs and aren't governed by this setting.
  • Preview tools are additive and live on a separate endpoint, https://{org}.crm.dynamics.com/api/mcp_preview, enabled by a separate environment setting. Preview tools aren't covered by support agreements and can change without notice.
  • Since 15 December 2025, Dataverse MCP tools are charged when accessed by AI agents created outside Copilot Studio. search_data bills at the Tenant graph grounding Copilot Credit rate; the rest, including the metadata search tool, bill at the Text and generative AI tools (basic) per-10-response rate. Holders of Dynamics 365 Premium licences or a Microsoft 365 Copilot USL aren't charged for accessing Dynamics 365 data from outside Copilot Studio. Microsoft defers the actual rates to the Copilot Studio billing documentation.
  • Separately from the server, Microsoft ships a Dataverse plugin for coding agents that routes requests across the MCP server, the Python SDK, PAC CLI and the Dataverse CLI. As of July 2026 it's available for Claude, Cursor and GitHub Copilot, built on an open-source skill architecture.

When to use / skip

Turn it on for a development environment straight away — having a coding agent that can read your schema, run a SELECT and describe a table removes a genuine amount of tab-switching, and it respects existing Dataverse RBAC while doing it. Be much more deliberate about production. The tool list includes delete_record and delete_table, and the metered billing outside Copilot Studio means an enthusiastic agent loop is a cost as well as a risk. Skip it entirely on environments holding regulated data until you've had the governance conversation, because the default posture is that Copilot Studio is already enabled everywhere.

Configuration decisions

  • Which environments have the server on at all, and whether production is one of them.
  • Which clients are allowed per environment, remembering that Copilot Studio is on by default and everything else is opt-in.
  • Whether preview tools are enabled, on which environments, and who accepted that they can change without notice.
  • What the agent identity is and which security role it holds, since RBAC is the actual control surface here — the tool list is not.
  • Whether the environment is a Managed Environment, which is a prerequisite for governing the server through advanced connector policies.
  • Agent instructions, which Microsoft treats as a first-class configuration artefact rather than a nicety. The published sample explicitly tells the agent not to ask for confirmation on deletes; read it before you copy it.

Gotchas

  • Microsoft's own sample agent instructions include "do not ask confirmation for delete table or delete record operation, you can delete". That's a sample, not a recommendation, and it will end up in someone's production agent if nobody reads it.
  • The tool rename is a live breaking change for anyone with name-based allow lists. A list permitting search used to mean data access and now means metadata access.
  • Copilot Studio access being enabled by default means most tenants already have this on somewhere without anyone deciding to.
  • The billing boundary is drawn at "created outside Copilot Studio", not at "non-Microsoft client". A GitHub Copilot session and a Claude Code session both fall outside it.
  • Preview and GA are different endpoints and different Copilot Studio connectors. Testing against mcp_preview and deploying against mcp will give you a different tool surface.
  • Disabling the server stops every agent and tool depending on it, immediately. It's not a soft toggle.

Consultant notes

  • Lead the client conversation with identity and RBAC, not with the tool list. The agent acts as a Dataverse user; the honest question is what that user can already do.
  • Get the environment posture written down: which environments, which clients, preview on or off, who approves changes. This is the sort of thing that drifts because it's easy to enable and nobody owns it.
  • Flag the December 2025 billing change explicitly if the client's developers are using Claude or GitHub Copilot against Dataverse — it's metered, and finance will find out eventually.
  • This area is moving fast. The tool surface changed materially between the 2025 launch and mid-2026, so treat any statement about specific tool names as having a short shelf life and check the current list before you write a design document.

Re-check the tool list and the preview endpoint before quoting either — this surface changed twice in the twelve months to July 2026.

Was this accurate?
Related
Dataverse Plugin for AI Coding Agents10-ai-and-agentsDataverse as a knowledge source for agents10-ai-and-agentsDataverse search05-search-and-queriesDataverse as an agent data platform10-ai-and-agentsVirtual table data providers04-apis-and-integrationMicrosoft Dataverse KB — Features & Changelog_root