Finance | Project Operations, Human Resources, ...

D365 ERP MCP Agent Bypasses User Security Roles — How to Enforce Permissions?

(3) Share

Report

Posted on by CuriousMind

Background: We have added some custom logic in the OOB Copilot for Finance and Operations Agent in Copilot Studio to create and manages routes and in D365 F&O. The agent structure is:

OOB "Copilot for Finance and Operations" agent — surfaced in the D365 F&O Copilot sidecar
D365 ERP MCP connected as a tool to the OOB agent
Custom instructions and knowledge document added to the OOB agent covering route creation steps and business logic
Agent correctly uses D365 ERP MCP tools for live data operations

Problem: Observed that the D365 ERP MCP does not account for the logged-in user's D365 security roles.

Specifically:

We removed the security role that grants route creation access from a test user
That user cannot manually create routes in D365 F&O (blocked as expected)
However, when the same user uses the Copilot sidecar agent, routes are created successfully bypassing the security restriction entirely

Questions:

What credentials does the D365 copilot agent run under - the logged-in user's session, or a separate service account?

Is there a way to configure the agent to enforce the logged-in user's D365 security roles?

As a workaround, can the agent query SecurityUserRoleV2 or a similar entity to check if the current user has the required role before proceeding with record creation?

Is this a known limitation of the D365 ERP MCP, and if so, what is the recommended approach for enforcing security in agent-driven workflows?

Any guidance from the community would be appreciated.

Categories:

Dynamics 365 Finance

I have the same question (0)

All responses (5)

Answers (0)

Sort by

Suggested answer

André Arnaud de Cal... 306,376 Super User 2026 Season 1 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi CuriousMind,

The Sidecar is executing with the users credentials and performs actions with his permissions only. In case you have a child agent, check if this one will be triggered inheriting the user or if the user is fixed for the child agent.

The MCP server is honoring the permissions of the user that runs the (child) agent. Depending on your version, the MCP is using form interactions, data entities or SQL, based on the entities. In case the user does not have permissions on the forms via the menu items, but it has access via data entities, then it can still create the routes. So, check the security role for permissions on both menu items and data entities.

Was this reply helpful? Yes No
Suggested answer

Giorgio Bonacorsi 3,532 on at

Like
a
(0)

Report
Copy link

Link copied!

Hello,

You need to link your MCP to a user with System Administrator credentials in D365FO:

Once this is done, for the embedded agent you need to specify in the instructions that the MCP already has authorization, so it does not ask the user to authorize.
For more details, see this article:https://dax365fo.org/2026/06/25/copilot-studio-troublesoot-error-code-integratedauthenticationnotsupportedinchannel/

Thank you,

Giorgio

Was this reply helpful? Yes No
CuriousMind 80 on at

Like
a
(0)

Report
Copy link

Link copied!

@André Arnaud de Calavon @Giorgio Bonacorsi

In the Copilot studio agent, when connecting to the Dynamics 365 ERP MCP as a tool, I have configured to use End user credentials (screenshot attached). Authenticate with Microsoft is the authentication setting on the agent (screenshot attached).
When I test using the test panel in copilot studio, or after publishing the agent, while testing in the copilot sidecar in D365FO, the agent is performing operations that they don't have permissions for. I verified to see the user doesn't have permissions on the menu items (UI) and data entities required for the route operations. Why could this be happening?

Does it mean the MCP has superior privileges irrespective of what permissions the user using the agent has?

My understanding was that the agent honors the permissions of the user as configured in D365FO, even while using the agent.

Was this reply helpful? Yes No
André Arnaud de Cal... 306,376 Super User 2026 Season 1 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi CuriousMind,

Have you doublechecked the permissions for the user on data entities? In case the MCP server decides to use data tools, it is not navigating through the forms via menu items.

Was this reply helpful? Yes No
CuriousMind 80 on at

Like
a
(0)

Report
Copy link

Link copied!

@André Arnaud de Calavon Yes, I confirmed that the user has no access to data entities and menu items.

Was this reply helpful? Yes No