Dataverse MCP Server Guide: Setup, Tools, and Billing (2026)

Last updated: October 23, 2026

By ZapAI Team

TL;DR: The Dataverse MCP server lets AI agents read and update Dataverse and Dynamics 365 data under each user’s own security roles. Copilot Studio connects out of the box. Claude, VS Code, and other clients need an admin to enable them per environment. The tool list changed in June 2026, and Microsoft says billing for non-Copilot Studio agents moves to usage-based charges on October 24, 2026.

Two years ago, connecting an AI assistant to your CRM meant a custom connector, an app registration, a Web API wrapper, and a developer who understood all three. Now it’s one URL per environment. Real progress. It also means a curious analyst with Claude Code can point an agent at production Dynamics 365 data in about ten minutes, and most admins we talk to haven’t decided whether that’s allowed. Some haven’t noticed yet.

This guide pulls together what Microsoft currently spreads across seven Learn articles. It covers the 15 current tools, setup for Copilot Studio, VS Code, Claude Desktop, and Claude Code, the admin switches, what it costs, and which of Microsoft’s other MCP servers you might want instead. We work on both sides of this through our Claude AI services and Power Platform practice, and everything below was checked against Microsoft documentation on October 23, 2026.

One quick disambiguation, since search engines mix them up. The MCP server at mcp.dataverse.org belongs to Harvard’s Dataverse research data project. It has nothing to do with Microsoft Dataverse.

What Is the Dataverse MCP Server?

It’s an endpoint at https://yourorg.crm.dynamics.com/api/mcp that exposes Dataverse tables and records to any client that speaks the Model Context Protocol. The agent calls tools like search, describe, and read_query, and Dataverse runs them as the signed-in user.

MCP is an open standard Anthropic released in late 2024 and later donated to the Linux Foundation’s Agentic AI Foundation. By December 2025 Anthropic counted more than 10,000 active public MCP servers and 97 million monthly SDK downloads. Microsoft has gone all in. Its July 2026 Power Platform update says the catalog holds 60+ ready MCP servers, with Dataverse supported natively in Copilot Studio and Microsoft Foundry.

Microsoft’s Dataverse server went into preview in May 2025 and reached general availability in all regions on December 15, 2025, per Microsoft Message Center notice MC1187276. Some older tutorials still call it preview. They’re out of date.

Why should Dynamics 365 shops care? Sales, Customer Service, Field Service, and Customer Insights all store their data in Dataverse. One server reaches all of it. Every table.

Which Tools Does the Dataverse MCP Server Expose?

Fifteen tools as of June 2026, covering data search, metadata, SQL-style reads, record and table changes, skills, and file transfer. The older list_tables, describe_table, and fetch tools were removed and folded into describe.

Our list comes from Microsoft’s Connect to Dataverse with MCP documentation. If you maintain an allow list or deny list by tool name in your MCP client, Microsoft says to review it, because a list written in 2025 now refers to tools that don’t exist.

Can’t find search_data in your client? Dataverse search is probably off for that environment. Turn it on in the environment settings and reconnect.

Look at that table with a security hat on. Six of the 15 tools change data or schema. An agent that can call delete_table under a system administrator’s identity is one confused prompt away from a very bad afternoon, approval prompt or not.

How Do You Connect Copilot Studio to the Dataverse MCP Server?

Add it as a tool. In Copilot Studio, open your agent, choose Tools, then Add tool, pick Model Context Protocol, select Dataverse MCP Server, and create the connection. The Copilot Studio client is enabled by default in every environment.

Microsoft’s Copilot Studio setup page walks through it in six steps, starting from make.powerapps.com. After adding it, you can open each tool through its menu and edit or disable it individually. Do that. Today. A support triage agent rarely needs create_table.

Test with three prompts Microsoft suggests. Show me the tables in Dataverse. Describe the account table. How many accounts do I have. If the third one answers, reads work.

There’s also a preview connector called Microsoft Dataverse MCP Server (Preview) that points at /api/mcp_preview, where new tools land first. Microsoft states that preview tools aren’t covered by support agreements, so keep production agents on the GA endpoint.

Building the agent itself, with instructions, evaluations, and a pilot plan, is a bigger topic. Our guide to building an AI agent for Dynamics 365 covers that end to end.

How Do You Connect Claude Desktop or Claude Code to Dataverse?

Through Microsoft’s local proxy, the npm package @microsoft/dataverse. A tenant admin grants consent once, an environment admin enables the Dataverse CLI client, and each user adds one config entry. Node.js 18 or later is required.

Every step here comes from Microsoft’s non-Microsoft clients documentation. Ignore older posts that mention a .NET tool. Current docs use the npm package only.

Admin steps, once per tenant and environment

First, a tenant admin opens this consent URL with your tenant ID filled in and signs in.

https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=0c412cc3-0dd6-449b-987f-05b053db9457

Second, in the Power Platform admin center, go to Manage, Environments, pick the environment, then Settings, Product, Features. Under Dataverse Model Context Protocol, confirm that MCP clients are allowed, open Advanced Settings, find the Dataverse CLI client with app ID 0c412cc3-0dd6-449b-987f-05b053db9457, set Is Enabled to Yes, and save. No entry? Add a new client with that app ID.

Claude Desktop

Open File, Settings, Developer, Edit Config, and add this to claude_desktop_config.json with your own environment URL.

{
  "mcpServers": {
    "dataverse-sales-prod": {
      "command": "npx",
      "args": ["-y", "@microsoft/dataverse", "mcp", "https://yourorg.crm.dynamics.com"]
    }
  }
}

Fully exit Claude Desktop and reopen it. Sign in when the browser prompt appears, then check Search and tools to confirm the server is listed. Claude Desktop lets you switch individual tools off there, which is the easiest way to run read-only. On a Mac the settings live under the Claude menu rather than File.

Claude Code

One command.

claude mcp add dataverse -t stdio -- npx -y @microsoft/dataverse mcp https://yourorg.crm.dynamics.com

Restart Claude Code, sign in when prompted, and run /mcp to check the connection. Per the Claude Code MCP documentation, the default scope is local to your user and project. Use --scope project only if you want the entry checked into the repo’s .mcp.json, and think twice before committing a production URL there.

Connection failing? Microsoft’s FAQ points to a wrong org URL or a client that isn’t enabled in the admin center as the usual causes. For anything else, run the proxy with --log-level Debug --log-file and read the log.

A naming tip from our own setups. Name each server after its environment, like dataverse-sales-prod and dataverse-sales-uat. Microsoft’s FAQ handles multiple environments as separate server entries, and with generic names Claude will cheerfully query the wrong one.

What About VS Code, GitHub Copilot, and Microsoft Foundry?

VS Code connects straight to the HTTP endpoint once an admin enables the Microsoft GitHub Copilot client. Foundry uses either the Agent 365 Dataverse MCP server for Frontier tenants or the remote endpoint with your own Entra app registration.

For VS Code, the VS Code setup page uses the command palette. Run MCP Add Server, choose HTTP, paste your instance URL with /api/mcp on the end, and pick global or workspace scope. Then open chat in agent mode. The GitHub Copilot CLI takes the same URL in ~/.copilot/mcp-config.json.

Any other client, Foundry included, can use the remote endpoint. Register an app in Microsoft Entra, grant it the mcp.tools permission under Dynamics CRM, add that client ID in the same Advanced Settings list, and point the client at /api/mcp. Foundry’s Agent 365 version uses the McpServers.Dataverse.All scope and, per Microsoft’s Foundry documentation, is only available to Frontier program tenants. Test this path before promising it to a stakeholder. Community reports of consent and 403 errors are common enough that we budget a day for it.

What Does the Dataverse MCP Server Cost?

Agents built in Copilot Studio on the standard harness pay normal Copilot Studio rates. For other clients, Microsoft says tool execution moves to usage-based billing on October 24, 2026, including for users whose Dynamics 365 Premium or Microsoft 365 Copilot licenses previously covered it.

Here’s the history, because both rules will show up in guides for a while.

• From December 15, 2025, Dataverse MCP tools were charged when agents built outside Copilot Studio called them. Users with Dynamics 365 Premium licenses (Sales, Customer Service, Finance, or Supply Chain Management) or a Microsoft 365 Copilot license weren’t charged.
• Under that rate card, search_data billed like tenant Graph grounding, which is 10 Copilot Credits on Microsoft’s Copilot Studio billing rates page. Every other tool billed at the basic AI tools rate of 1 credit per 10 responses.
• Message Center notice MC1478384 says that from October 24, 2026, Dataverse MCP tool execution incurs usage-based charges instead of the fixed rate card, and that agents on Copilot Studio’s standard harness are excluded. You still need a Dynamics 365 Enterprise or Premium license to access Dynamics 365 data.

What does that mean in dollars? Under the old card, a Claude Code session making 10 search_data calls and 40 other tool calls used about 104 credits. At the pay-as-you-go rate of $0.01 per credit, that’s about a dollar. Cheap per session. Not cheap if 200 users run that every day. Note where the money went, too. Ten search calls cost 25 times more than forty describe and read calls.

Usage-based billing meters what each call actually consumes, as described in Microsoft’s usage-based billing overview, so the per-call figure will move. We read MC1478384 through a public Message Center mirror. Check the notice in your own Microsoft 365 admin center, and pull the Copilot Credit consumption report in the Power Platform admin center after the first week rather than trusting anyone’s estimate. Our Copilot Studio pricing guide explains packs, pay-as-you-go, and how the 125% overage limit works.

We’ll update this section when Microsoft’s Learn pages reflect the October change. As of October 23 they still show the December 2025 rule.

Is the Dataverse MCP Server Secure Enough for Production Data?

It inherits Dataverse security. Every call runs as the signed-in user, with their security roles and row-level security, so an agent can’t see records the user can’t. The risk is in which clients you allow and which tools you leave on.

Microsoft’s Dataverse MCP FAQ says no additional MCP-specific access controls are needed, because Dataverse enforces the same permissions it always has. True as far as it goes. A sales rep’s agent sees only that rep’s territory. But an admin’s agent sees everything, and admins are exactly the people experimenting with Claude Code on a Friday afternoon.

Our governance checklist, built from Microsoft’s own admin guidance and what we’ve seen go wrong.

• Enable MCP only in environments where agent access makes sense. Dev and UAT first.
• Allow only the clients you’ve approved. Copilot Studio is on by default, and everything else is off until someone enables it in Advanced Settings.
• Turn on a Managed Environment if you want Advanced connector policies. They can block the whole MCP server, but per Microsoft’s connector policy docs they can’t block individual tools yet.
• Start read-only. Switch off create, update, and delete tools in the client until the use case proves it needs them.
• Never run agents as a system administrator. Build a security role for the job.
• Read Microsoft’s sample agent instructions before copying them. One sample line tells the agent not to ask for confirmation before deleting tables or records. Delete that line.
• Disabling the server stops every agent that depends on it, so announce it before you flip it off.

A last nuance from Microsoft’s configuration page. The allow list applies only to the /api/mcp entry point. Custom APIs that happen to have MCP in their names are regular Dataverse APIs and follow normal API security instead.

Which Microsoft MCP Server Do You Actually Need?

Use Dataverse MCP for Dynamics 365 customer engagement apps and Power Apps data. Use the Sales MCP server for sales-specific AI actions, the ERP MCP server for Finance and Supply Chain Management, and the Business Central MCP server for Business Central.

Two details worth pulling out. The ERP MCP documentation bills non-Copilot Studio clients 0.1 credit per tool call, with Finance Premium and Supply Chain Management Premium users exempt, and it isn’t supported on cloud-hosted development environments. And Microsoft’s ERP agent tutorial recommends Claude Sonnet 4.5 as the orchestration model in Copilot Studio. A Microsoft doc recommending an Anthropic model. Strange times. Good ones, mostly.

Should you skip MCP entirely sometimes? Yes. A nightly sync that copies orders into a warehouse doesn’t need an agent deciding what to do. Use a connector or the Web API there, and save MCP for work that needs judgment. When you’re choosing where the data should live in the first place, our Dataverse vs SharePoint lists comparison covers that call.

Community MCP servers exist too, some with 50+ tools that call the Web API directly. We’d only consider them for development tenants. You’d be trusting third-party code with your users’ tokens, and you lose Microsoft’s admin allow list.

Copilot Studio or Claude for Dataverse Agents?

Copilot Studio for agents that business users will run inside Teams or Dynamics. Claude Code or Claude Desktop for analysts and developers doing exploratory work, data cleanup, and schema questions at a desk.

Bias disclosed. We build with both, and we’d rather lose a Copilot Studio project than force one where Claude fits better. In practice, Copilot Studio wins on governance, since admins already manage it, it stays inside Microsoft’s billing, and standard harness agents avoid the October billing change. Claude wins on open-ended analysis, like asking why a pipeline report and a revenue report disagree and letting the agent work through tables until it finds out. We compared the two products more broadly in Claude vs Microsoft Copilot for business.

Most of our Dynamics 365 clients end up with both. Copilot Studio for the frontline. Claude for the people who used to export everything to Excel.

Wrapping Up

Short version? The Dataverse MCP server turns Dynamics 365 into something any modern AI agent can work with, under the security model you already have. Setup is quick. The decisions aren’t. Pick which clients to allow, which tools to leave on, and which environments to expose, then watch the bill closely through the October 2026 billing change.

ZapAI is a Microsoft Dynamics 365, Power Platform, Fabric, and AI consulting firm based in Irving, Texas, and we build Claude and Copilot Studio agents for US businesses. If you want Claude or Copilot Studio agents working against your Dynamics 365 data without opening a governance gap, our AI agent team can set up the clients, security roles, and tool restrictions, and size the credit spend before rollout.

What Admins and Developers Ask About Dataverse MCP

Is the Dataverse MCP server free?

What’s the URL?

Why did list_tables stop working?

Can an agent see records the user can’t?

Does Claude need a Microsoft 365 Copilot license to use it?

Is there an MCP server for Dynamics 365 Finance and Operations?

Can we block just the delete tools with DLP?

How do we stop Claude from querying the wrong environment?