You connect an AI agent to Dynamics 365 through Dataverse, the data platform Dynamics 365 is built on. There are three main approaches: Copilot Studio with its built-in Dataverse connector, an agent in Azure AI Foundry that calls the Dataverse Web API, or an MCP layer that exposes to the agent only predefined entities and actions. In each approach, the agent must operate within the user's permissions, and every write action must go through validation and approval.
What an AI agent can do in Dynamics 365
- Read and summarize: a customer record, open cases, service history and orders.
- Search in natural language: "Which VIP customer cases have been open for more than a week?"
- Create and update records: a case, task, note or appointment, after approval.
- Trigger existing processes, such as a Power Automate flow.
- Hand off to a human agent with the full context of the conversation.
Three ways to connect an agent to Dynamics 365
The choice depends on who uses the agent, how much control you need over its actions, and how many agents will share the same connection.
| Copilot Studio | Azure AI Foundry and Web API | MCP layer | |
|---|---|---|---|
| Best suited for | Agents for employees inside Teams and Microsoft 365 | Agents for customers and residents, in an interface with your own design | Several agents that share the same connection to systems |
| Data connection | Built-in Dataverse connector and Power Platform connectors | Dataverse Web API, through tools the agent invokes | An MCP server that exposes preselected entities and actions |
| Permissions | Based on the signed-in user in Entra ID | On behalf of the user, or an application user with a narrow security role | Only what the server exposes, with validation on every action |
| Control over actions | Actions through Power Automate | Full, in code | A closed list of defined actions |
| Development effort | Low to medium | Medium to high | Medium, built once for all agents |
Permissions and security
An agent connected to a CRM should see exactly what its user is authorized to see, and nothing more. These are the rules we work by:
- Authentication through Microsoft Entra ID, acting on behalf of the user or with a narrow security role.
- The agent receives only the entities and fields the process needs.
- Every write action goes through validation and user approval before it runs.
- Irreversible actions, such as deletion, are not exposed to the agent.
- A full log of every run, alongside Dataverse auditing.
Work stages
- Choose one process and define what the agent may read and what it may write.
- Map the Dataverse entities and fields the process touches.
- Build the connection using one of the three approaches, with the defined permissions.
- Set up an approval gate for every write action.
- Test with real user questions, including attempts to exceed permissions.
- Go live gradually, and monitor answers, actions and costs.
Project example: KESHER at Rishon LeZion Municipality
The KESHER resident bot answers on the website, on WhatsApp and by voice, and is connected to the municipality's Dynamics 365. Every conversation is logged in the CRM, a case is opened there directly when needed, and a contact center agent who joins the conversation sees the full context.
Another example: at Moroccanoil, an AI agent answers open-ended questions about Dynamics 365 F&O data through an MCP layer, without direct access to the database.
Limitations and considerations
- The Dataverse API has rate limits. An agent is suited to user-level actions, not bulk updates.
- Copilot Studio and model usage carry ongoing costs, which are worth estimating in advance based on usage volume.
- The agent is only as good as the data in the CRM. Missing or duplicate fields will show up in the answers too.
- When the process itself is not defined, start with requirements and design before connecting an agent.
Frequently asked questions
Will the agent see all the data in the CRM?
No. It sees only what its assigned permissions allow: based on the signed-in user, or on a narrow security role built for the process.
Do you need Copilot Studio to connect an agent to Dynamics 365?
Not necessarily. Copilot Studio is convenient for internal agents, but you can build an agent in Azure AI Foundry and connect it through the Web API or an MCP layer, especially when the agent serves customers.
Can the agent update records?
Yes, through predefined actions, with validation and user approval before every write, and a full log.
Does this also work with Dynamics 365 F&O?
Yes. The same principle works with Finance and Operations, as in the agent we built for Moroccanoil.
Does the agent work in Hebrew?
Yes. Zooz-tech's agents answer in Hebrew, in text and by voice.
CTO at Zooz-tech. Leads development and architecture of AI agents, Generative UI and Azure infrastructure.