Dataverse can act as an MCP server, so an AI client such as Claude, Copilot Studio or VS Code can query and change your data in plain language. The Dataverse MCP server reached general availability on 15 December 2025. The agent inherits your security roles, so it reaches exactly what the account it signed in as reaches, and no more.
What the Dataverse MCP server is
Model Context Protocol is an open standard for connecting a language model to data and tools it did not ship with. Dataverse implements the server half. Point a client at it and the client gets a set of named tools it can call, with descriptions, instead of you writing an integration.
The remote endpoint follows one pattern: https://{yourorg}.crm.dynamics.com/api/mcp. Clients that Microsoft names explicitly include Copilot Studio agents, GitHub Copilot in VS Code, the GitHub Copilot CLI, Claude Desktop and Claude Code.
It went to public preview on 20 May 2025 and generally available on 15 December 2025, which is recent enough that half the blog posts you will find describe a local setup that has since been replaced by the hosted one.
The tools an agent gets
Once connected, the client sees this surface:
| Tool | What it does |
|---|---|
search_data | Search structured and unstructured data |
search | Search table schemas and business skills by keyword |
describe | Get details for tables, records, schemas, skills and apps |
read_query | Run supported Dataverse SQL SELECT queries |
create_record / update_record | Insert a row and return its GUID, or update an existing row |
delete_record | Delete a row, only after explicit user approval |
create_table / update_table | Create a table with a schema, or change an existing one |
delete_table | Delete a table, only after explicit user approval |
upsert_skill / delete_skill | Add, update or remove a Dataverse business skill |
init_file_upload / commit_file_upload / file_download | Generate SAS URLs and commit file transfers |
The tool names changed after GA. describe_table, list_tables and fetch were removed and folded into describe, and the old data-searching search became search_data. If you keep allow or deny lists by tool name in your client, they need revisiting.
Switching it on, and who is allowed to connect
Copilot Studio is allowed by default in every environment. Everything else has to be let in by an administrator, one client at a time.
In the Power Platform admin center, go to Manage > Environments, pick the environment, then Settings > Product > Features. Scroll to Dataverse Model Context Protocol, confirm that Allow MCP clients to interact with Dataverse MCP server is on, open Advanced Settings, open the client record you want and set Is Enabled to Yes. You need the Power Platform administrator role to see any of that.
For a client like Claude Code, the supported route is a local proxy. A tenant admin grants consent once for the Dataverse CLI application, then you run npx @microsoft/dataverse mcp https://yourorg.crm.dynamics.com and the proxy handles the auth. The Dataverse CLI client also has to be enabled in the environment, and if it is missing from the client list you can add it by its application ID.
The alternative is your own Microsoft Entra app registration with the mcp.tools permission under Dynamics CRM, connecting straight to the remote endpoint. More setup, no npm dependency, and a client ID you control.
One footnote that matters for governance: the allow list applies to the /api/mcp entrypoint only. Custom APIs that happen to have MCP in the name are ordinary Dataverse APIs and this setting does not touch them.
What it can reach, and what it cannot
The Dataverse MCP server respects security roles and row-level security. An agent reaches what the signed-in account reaches, and nothing beyond it. There is no separate MCP permission model to configure and no MCP-shaped hole in the one you already have.
Which means the security question is the same one you already know how to answer: what can this account see? If you want a narrow blast radius, sign the agent in as a service account with a narrow role rather than as your own admin login. That is a five-minute job and it is the difference between an agent that can read the contacts table and one that can delete it. Worth reading how Dataverse security roles work before you decide.
The destructive tools have a second guard. Both delete_record and delete_table run only after explicit user approval, so a wrong turn in a conversation cannot quietly drop a table.
What it costs
From 15 December 2025, Dataverse MCP tools are charged when they are called by an AI agent built outside Copilot Studio. Hold qualifying Dynamics 365 Premium licences or a Microsoft 365 Copilot user subscription licence and access to Dynamics 365 data is not charged.
In practice that splits into two cases. An agent you built in Copilot Studio calling Dataverse is covered by the Copilot Studio metering you already understand. The same server called from Claude Code or VS Code is metered separately unless one of those licences applies. Check the rate before you point anything that loops at it.
Where it earns its keep, and where it does not
It is very good at the first hour in an unfamiliar environment. Asking "what tables are in here", "describe the account table" and "how many open opportunities do we have" replaces twenty minutes of clicking through the maker portal, and describe gives you the schema without exporting anything.
It is a poor fit for bulk work. Microsoft's own guidance routes large writes away from MCP and towards the Python SDK, because MCP is a conversation and a 5,000-row import is not. The Dataverse skills for coding agents encode that routing rule so the agent picks correctly on your behalf.
It also does not replace a solution, a source-controlled schema or a deployment pipeline. An agent that can create a table is a faster way to make a mess in an environment with no ALM, so put the dev environment and the solution in place first.
Common questions
Can the Dataverse MCP server see tables my user cannot?
No. It respects Dataverse security roles and row-level security, so an agent reaches exactly what the authenticated account reaches. Restricting the agent means restricting the account it signs in as.
Do I pay to use the Dataverse MCP server?
From 15 December 2025 Dataverse MCP tools are charged when an agent built outside Copilot Studio calls them. Qualifying Dynamics 365 Premium licences or a Microsoft 365 Copilot user subscription licence cover access to Dynamics 365 data.
Thinking about pointing an agent at your data
The technology here is the easy half. The question worth answering first is which account it runs as and what that account can reach, because that decision is the whole security model. If you want a second opinion on it before you switch anything on, book a free 30-minute call.