Quick answer
The GA Dynamics 365 Customer Experience MCP Server for Service works through Microsoft Agent 365 Tooling Gateway and can be reached from Microsoft and third-party MCP hosts. Client support does not equal blanket data access: OAuth establishes identity, ATG fronts the server, and Dataverse roles still decide which service records and operations the signed-in user may use.
Use the setup guide for the exact server URL and connection sequence. This page focuses on the client and permission boundaries.
Supported-client matrix
| Client or surface | Connection pattern | Identity and consent boundary |
|---|---|---|
| Microsoft 365 Copilot / Service Agent | Microsoft-managed experience using the service capability | Microsoft 365 and Dynamics administration plus the user’s Dataverse access |
| Copilot Studio | Custom connector to the ATG server URL | Single-tenant confidential app, delegated McpServers.D365Service.All, admin consent, and a protected secret |
| Visual Studio Code | HTTP server entry in .mcp.json | OAuth protected-resource discovery and interactive Microsoft sign-in |
| GitHub Copilot CLI | MCP server URL in the host’s configuration | OAuth discovery and interactive sign-in; current host support must be verified |
| Cursor | MCP server URL | OAuth discovery and signed-in user permissions |
| ChatGPT or Claude Code | HTTP MCP connection supported by the host | OAuth discovery where available; destination governance and retention apply |
Microsoft’s July 30 GA announcement describes MCP-compatible clients, while its current Learn page gives the operational setup. Product UI and enterprise controls can change independently, so verify that the chosen host supports remote HTTP MCP and Microsoft OAuth discovery in the tenant’s current version.
Four permission layers
1. Tenant consent
The Agent 365 Tooling Gateway resource requires delegated permission granted in advance. Microsoft says it does not support dynamic incremental consent. A tenant or delegated administrator must approve the required scope before users can complete sign-in.
Copilot Studio additionally uses a single-tenant confidential application and the delegated McpServers.D365Service.All permission. Treat the app registration, secret, owner, and expiry as production infrastructure.
2. Gateway authentication
ATG is the Microsoft-hosted front door. It publishes OAuth protected-resource metadata, accepts a token for the gateway audience, and connects the authenticated identity to the environment-specific Dynamics service MCP server.
The server address binds three important values: the ring host, Dataverse environment ID, and server name mcp_D365CX_Service. A valid sign-in against the wrong ring or environment is not a safe fallback; correct the configuration instead.
3. Dynamics roles
Microsoft identifies System Administrator or Omnichannel Administrator as setup roles, and Customer Service Representative or Customer Service Representative Manager as runtime roles. Those names are a starting point, not a reason to grant broad access.
Review the actual security roles, business units, teams, field security, and record ownership in the target Dataverse environment. Test both a record the user may access and a record they must not access.
4. Host action and data policy
The MCP host decides how users invoke tools, whether approval is required, what context is sent to a model, and how activity is retained. Dynamics authorization can reject an unauthorized operation, but it cannot define the external host’s retention, model-use, prompt-injection, or human-approval policy.
For every enabled client, record:
- accountable owner and approved business purpose;
- user or workload identity and target environment;
- allowed tool categories and prohibited actions;
- external data destination, residency, retention, and deletion path;
- logging, incident response, credential rotation, and revocation steps.
Least-privilege rollout
Start in a non-production environment. Use a representative low-privilege customer-service role, enumerate available tools, test allowed reads, prove denied access, and exercise only a reversible write. Inspect Dataverse audit records and the host’s activity history before widening the cohort.
Do not use a shared administrator credential for convenience. It obscures who requested a tool call and can expose far more customer data than the task requires. Separate development and production app registrations, rotate secrets, and remove stale client connections.
Microsoft says the server exposes more than 90 tools across cases, customer context, knowledge, email and activities, intelligence, search, and administration. Tool discovery is an inventory, not an authorization decision.
External-data boundary
If a third-party MCP client receives Dynamics content, the destination’s terms, compliance commitments, and data-residency controls govern that copy. Validate model training or improvement settings, subprocessors, log access, retention, deletion, and regional processing before approving the client.
For US government tenants, Microsoft explicitly warns that enabling the connection can move data outside the FedRAMP High boundary. Treat that as an administrative compliance decision, not a user preference.
The independent product guide maps the available capability categories. The Service Agent comparison explains when the packaged Microsoft 365 experience is a better starting point.
Frequently asked questions
Which clients support the Dynamics 365 Customer Experience MCP Server for Service?
Microsoft lists Microsoft 365 Copilot and Service Agent, Copilot Studio, VS Code, GitHub Copilot CLI, and HTTP MCP hosts such as ChatGPT and Claude Code. Exact setup varies: discovery-capable hosts can use the server URL and OAuth discovery, while Copilot Studio uses an app registration and custom connector.
Does Agent 365 Tooling Gateway bypass Dataverse roles?
No. Agent 365 Tooling Gateway authenticates access to the MCP server, but the signed-in user’s existing Dataverse roles and permissions still control accessible records and operations.
Should one service account be shared across MCP clients?
No. Use attributable user or workload identities, least-privilege roles, environment-specific applications, short credential lifetimes, and auditable consent. A shared high-privilege account weakens record-level authorization and incident response.
Official sources
- Microsoft Learn: Connect Dynamics 365 CX MCP Server - Service through Agent 365 Tooling Gateway
- Microsoft: Dynamics 365 Customer Service MCP server general availability
Source check: August 3, 2026. Recheck the current client list, delegated permission, OAuth flow, roles, data-boundary notice, and host controls before deployment.