The next phase of ERP modernization will not be defined by more dashboards, menus or integrations. It will be defined by how safely business intent can be translated into action.
Enterprise resource planning has traditionally been built around a simple sequence: an employee makes a decision, navigates the system and records the result. The ERP then becomes the authoritative history of what happened. That model is reliable, but inherently reactive.
AI agents introduce a different operating pattern. Instead of waiting for a user to locate the right page, assemble information and complete each step, an agent can interpret a business request, retrieve relevant context and – within defined boundaries – initiate work. Microsoft describes this as the evolution of business applications from systems of record into systems of action, while retaining human-defined controls, business rules, permissions and audit trails. Business Central now combines assistive Copilot capabilities with autonomous agents and the flexibility to connect custom AI solutions.
This does not make the ERP less important. It makes the ERP’s role more consequential. When AI can act, the quality of the transaction system, its data, controls and process design determine whether that action is useful, trustworthy and commercially sound.
MCP Changes the Economics of Connecting AI to ERP
Historically, connecting an external application to an ERP process often meant creating a tightly defined integration: mapping fields, building an endpoint, scripting logic and maintaining the connection as requirements evolved. This approach remains appropriate for stable, deterministic, high-volume transactions. But it becomes expensive when users need flexible access to many different business objects or when the required interaction changes frequently.
The Model Context Protocol (MCP) addresses a different integration problem. It is an open standard through which AI applications discover available data sources and tools, understand their descriptions and invoke authorized operations. In Business Central, the MCP Server can expose API-based capabilities to Copilot Studio, Visual Studio Code and other compliant hosts through a standardized interface.
This matters because an agent no longer needs a separately designed connector for every possible natural-language request. The agent can identify an appropriate tool at runtime, retrieve information and combine multiple capabilities into a plan. Copilot Studio’s generative orchestration layer is designed to interpret intent, select tools and knowledge, and execute multistep plans within configured policies.
The distinction is important: MCP does not eliminate integration engineering; it changes where the intelligence resides. The focus shifts from specifying every conversational route in advance to designing a governed catalogue of reliable business capabilities that an agent can use.
ERP is Becoming an Operational Interface, not Merely a Destination
Natural language is often presented as a more convenient search box. Its greater value is that it can reduce the distance between a business question and an operational response.
A sales representative, for example, may need a customer’s balance, order history, available stock and current commercial status before committing to a delivery. In a conventional workflow, that information may be spread across several pages and filtered views. An MCP-enabled agent can retrieve the permitted records, combine the results and return a company-specific response. Where write permissions are enabled, it may also prepare or create the relevant sales document. Purchasing scenarios can similarly include retrieving vendor information and preparing purchase invoices.
The architecture supporting this experience is more disciplined than the conversational interface makes it appear. The user interacts with an agent; the agent interprets intent and selects tools; the MCP Server translates those requests into structured Business Central operations; and Business Central remains the source of transaction data, business rules and audit evidence.
As illustrated below, governance must span the full interaction, not only the final ERP transaction
Figure 1: An MCP-enabled Business Central operating model: conversational intent moves through an orchestrated agent and governed tool layer into the ERP transaction core, with controls strengthening as autonomy increases.
For users, this creates the possibility of an ERP experience organized around outcomes rather than navigation. For architects, however, it introduces a new responsibility: each tool’s name, purpose, inputs, outputs, permissions and error behaviour must be sufficiently clear for both humans and AI orchestration to interpret correctly. Microsoft’s own guidance recommends a curated set of high-quality tools rather than an exhaustive catalogue containing overlapping or irrelevant choices.
Context is the Value – and the Risk
Traditional automation is effective when the business rule is explicit: if one defined condition occurs, perform one defined action. AI agents offer value where the request requires contextual selection across several sources. They can combine operational information, knowledge and interaction history to formulate a response or plan.
But access to data is not the same as understanding the business. An agent may retrieve a field accurately while misunderstanding what that field represents operationally. A stock quantity may be technically correct but commercially unavailable. A customer balance may require interpretation in the context of disputed transactions, credit arrangements or group exposure. A discount may be mathematically valid but inconsistent with an unwritten commercial convention. These are examples of the semantic gap between data and intent.
This is why data readiness for agentic ERP involves more than cleansing master records. Organizations must make business meaning more explicit through accurate metadata, well-described tools, documented policies, validated inputs and deterministic rules for critical decisions. Microsoft notes that semantic search accuracy itself depends on the quality of metadata, while Copilot Studio relies heavily on tool names, descriptions and defined parameters when constructing plans.
The strategic lesson is clear: an agent cannot reliably compensate for ambiguous process design. In many cases, AI adoption will expose operational inconsistencies that users previously resolved through experience, informal communication or manual intervention.
Governance is Part of the Product Design
The most reassuring aspect of the Business Central MCP model is that access is not automatically equivalent to authority. By default, the MCP Server provides read-only access to exposed Business Central API pages. Create, modify, delete and bound actions must be enabled through MCP Server configurations, and available capabilities depend on both the configuration and the user’s existing permissions. Operations authenticate through Microsoft Entra ID and are performed with the user’s identity, supporting attributable audit trails.
That provides a strong foundation, but permissions alone are not a complete governance model. Copilot Studio also provides data policies, connector controls, environment routing, audit logging, usage monitoring and visibility into agent dependencies. Business Central’s enhanced MCP Server adds telemetry for configuration changes and tool calls, including the host, tool, execution result, duration and failure reason.
Organizations should therefore treat an agent as a governed operational actor. Every production agent should have:
- A named business owner accountable for its purpose and outcomes
- A limited tool and data scope aligned to a specific process.
- Defined autonomy boundaries separating read, draft, approve and execute activities
- Human confirmation or workflow approval for financial material, destructive or exceptional actions
- Telemetry and review routines covering failures, unexpected tool selection, cost and behavioural drift
- A controlled lifecycle across development, sandbox, testing and production environments
These practices align with Microsoft’s secure-by-default approach, which emphasizes trusted servers, least-privilege access, consent before significant changes, a maintained inventory and continuous monitoring for drift. External cybersecurity guidance also warns that MCP’s flexibility can introduce new risks where implementations have weak authentication, insecure tool execution, poor approval design or insufficient logging.
The Strongest Agent Strategies will be Deliberately Narrow
The temptation is to expose every available table, field and operation so that the agent can “do anything.” In practice, broader access can produce slower orchestration, higher consumption and less reliable tool selection. Business Central’s MCP configuration includes dynamic tool discovery to support larger tool sets, while Copilot Studio guidance still recommends removing irrelevant, overlapping or risky capabilities.
ERP validation also remains intentionally strict. An agent cannot simply reason its way around posting rules, mandatory fields, credit controls or other Business Central validations. If a tool returns a technical error, the conversational experience may struggle unless the implementation translates that condition into a useful recovery path. This is not an argument for weakening ERP controls; it is an argument for designing better exception handling around them.
The best starting points are consequently bounded processes with clear inputs, observable outcomes and manageable exceptions: answering a defined operational question, preparing a draft transaction, classifying an incoming document or assembling information for human approval. Microsoft similarly recommends deterministic flows for irreversible actions, hybrid control for medium-risk processes and greater generative freedom for lower-risk information and planning tasks.
The Future of ERP will be Measured in Decisions, not Clicks
Over the coming years, ERP user experience is likely to become less dependent on knowing where a function lives and more dependent on expressing what needs to happen. Some users will continue working inside Business Central; others will initiate ERP-backed processes through Teams, Copilot or specialized operational interfaces. MCP makes that flexibility possible without separating the agent from the governed transaction layer.
Success, however, should not be measured simply by how many actions an agent can perform. More meaningful measures include cycle-time reduction, fewer hand-offs, improved first-time-right processing, lower exception volumes, faster access to operational insight and better use of specialist employees.
At Linc, our perspective is that agentic ERP should be approached as operational redesign, not feature activation. The organizations that gain the greatest value will be those that begin with a real business constraint, clarify the data and rules behind it, assign appropriate autonomy, and expand only after the process is secure, observable and trusted. Linc helps organizations evaluate these cases, design the necessary Business Central and Microsoft governance foundations, and move from controlled experimentation to responsible adoption, without losing the human judgement on which sound business decisions still depend.
For businesses who want to see these capabilities demonstrated rather than described, watch the full video on Linc’s YouTube channel: https://youtu.be/R2WtHjGv1C0?si=MsSES6F1MEUIQyVR
