Dynamics Community Forum Thread Details

D365 ERP MCP Agent Bypasses User Security Roles — How to Enforce Permissions?

Background: We have added some custom logic in the OOB Copilot for Finance and Operations Agent in Copilot Studio to create and manages routes and in D365 F&O. The agent structure is:

OOB "Copilot for Finance and Operations" agent — surfaced in the D365 F&O Copilot sidecar
D365 ERP MCP connected as a tool to the OOB agent
Custom instructions and knowledge document added to the OOB agent covering route creation steps and business logic
Agent correctly uses D365 ERP MCP tools for live data operations

Problem: Observed that the D365 ERP MCP does not account for the logged-in user's D365 security roles.

Specifically:

We removed the security role that grants route creation access from a test user
That user cannot manually create routes in D365 F&O (blocked as expected)
However, when the same user uses the Copilot sidecar agent, routes are created successfully bypassing the security restriction entirely

Questions:

What credentials does the D365 copilot agent run under - the logged-in user's session, or a separate service account?

Is there a way to configure the agent to enforce the logged-in user's D365 security roles?

As a workaround, can the agent query SecurityUserRoleV2 or a similar entity to check if the current user has the required role before proceeding with record creation?