Dynamics 365 Sales AI connector: IT approval and security
Dynamics 365 Sales' MCP server can read and change data. The vendor's setup notes include an admin or IT step. This page covers what it can reach and change, how it signs in, who approves it and how to turn it off.
Listing name: Dynamics 365 CX MCP Server - Sales.
- Server URL
- One URL per Dataverse environment, not one public URL. Source: learn.microsoft.com, checked 2026-11-02
https://agent365.svc.cloud.microsoft/mcp/environments/<environment-id>/servers/mcp_D365CX_Sales - Access
- Read + writeSource: microsoft.com, checked 2026-10-30
- Sign-in
- Microsoft Entra ID OAuth 2.0 through the Agent 365 Tooling Gateway (admin consent required; on-behalf-of exchange to Dataverse) Source: StackMCP listing, checked 2026-10-30
- Read-only option
- Not confirmed
- How to revoke
- Not confirmed
- Admin approval
- YesSource: learn.microsoft.com, checked 2026-10-30
A tenant admin grants admin consent first. A System Administrator configures the server.
No means the vendor's docs name no admin step. It does not mean an admin cannot block the connection.
- Setup
- Needs admin or ITAn admin or IT has to act first, for example by approving or enabling the integration. Don't plan on connecting it alone. Source: learn.microsoft.com, checked 2026-10-30
- Credits
- Credits not confirmed
- Plan
- Not confirmed
What data can it reach?
Dynamics 365 Sales' docs list these tools for its MCP server:
- Opportunity management (summaries, stages, close, reopen, clone)
- Accounts and contacts
- Lead management (search, qualify, disqualify, assign)
- Activities, notes, email and meetings
- Product and pricing
- Quotes and orders
- A tenant admin has to grant admin consent before a client can connect. A System Administrator configures the server. Source: learn.microsoft.com, checked 2026-11-02
- Sign-in uses a Microsoft Entra app ID. The gateway performs an on-behalf-of exchange that allows the request to reach Dataverse. Source: learn.microsoft.com, checked 2026-11-02
- Microsoft gives one server URL per Dataverse environment. There is no single public URL. Source: learn.microsoft.com, checked 2026-11-02
- Microsoft says connections to services outside Dynamics 365 let data leave the Dynamics 365 FedRAMP High boundary. Data flowing to other services will be processed and stored according to the terms, compliance commitments, and data residency and handling requirements of the destination service. Source: learn.microsoft.com, checked 2026-11-02
What can it read, and what can it change?
Read + write Some Dynamics 365 CX MCP Server - Sales MCP tools change data, not just read it.
Things it can do in your Dynamics 365 CX MCP Server - Sales account:
- updates, advances, closes, reopens and clones opportunities
- updates, qualifies, disqualifies and assigns leads
- creates and completes activities and notes
- drafts and sends email
- schedules meetings
- manages product lines and recalculates pricing
- creates quotes, revises or activates them, and converts them to orders
- maintains accounts and contacts
Review each change before you approve it, especially anything that sends messages or edits records other people rely on.
On Read vs write, this server is in Sends email.
From the read vs write page: can draft and send email. Source: microsoft.com, checked 2026-11-02
Delete column on that page: Not stated. That page has no sourced yes or no for this server.
Which actions should wait for a person's OK?
Have a person approve each change listed above before it runs. Every StackMCP recipe follows this rule: read freely, but create, change or send only after you approve it.
How does it sign in?
Sign-in method (from the StackMCP listing): Microsoft Entra ID OAuth 2.0 through the Agent 365 Tooling Gateway (admin consent required; on-behalf-of exchange to Dataverse)
Does an admin need to approve it?
What Dynamics 365 Sales' docs confirm about admin controls:
- An admin must approve or enable the connectionYesSource: learn.microsoft.com, checked 2026-10-30
- Scopes or permissions can limit what it reachesYesSource: microsoft.com, checked 2026-10-30
- Individual tools can be turned offNot confirmed
- MCP activity shows in an audit logNot confirmed
No means the vendor's docs name no admin step. It does not mean an admin cannot block the connection.
Those rows are controls Dynamics 365 Sales provides. A switch inside Claude or ChatGPT is in the section below, not in this table.
How do we turn it off?
In Dynamics 365 Sales
The Dynamics 365 Sales docs we checked don't say how to revoke MCP access. Ask your Dynamics 365 Sales admin.
In the AI assistant
- For other assistants, check that assistant's settings or ask your admin.
Does it use credits or quota?
Not confirmed Dynamics 365 CX MCP Server - Sales' docs don't say whether MCP calls use credits or paid usage.
Compare plans and credits. Read vs write.
What do Claude and ChatGPT add?
These rows are the AI app's own controls. They do not mean this server is confirmed for that app. Plan sentences are the quotes on the cost page.
This listing confirms ChatGPT, Claude Code, Cursor, and Copilot. claude.ai is not confirmed for this server. The Claude rows below are Claude's own settings.
| Claude | ChatGPT | |
|---|---|---|
| Who enables connectors | On Team and Enterprise, an Owner or Primary Owner enables directory connectors before members use them. For a custom connector, Team is limited to Owners and Primary Owners. On Enterprise, a custom role that includes Manage access to Libraries can add one too. Source: support.claude.com, checked 2026-11-02Source: support.claude.com, checked 2026-11-02 | On Business, only admins and owners create and publish custom MCP servers. Enterprise and Edu can use role-based access to grant creation, and admins choose who can use each app. Source: help.openai.com, checked 2026-11-02 |
| Who can block writes | On Team and Enterprise, owners can set each tool to Always allow, Needs approval, or Blocked for the organization. Source: support.claude.com, checked 2026-11-02 | Admins turn read actions and write actions on. Users can choose Always ask or Allow read actions. Allow all is not in the standard workspace-wide selector. New actions can be left off. Source: help.openai.com, checked 2026-11-02 |
| Training on connected data | Commercial plans: inputs and outputs are not used for training by default. On consumer plans, raw connector content is excluded from the training data described in the privacy article, unless it is copied into the chat. Source: privacy.claude.com, checked 2026-11-02Source: privacy.claude.com, checked 2026-11-02 | Business, Enterprise, and Edu workspace content, including information from apps, is not used for training by default. A consumer-plan default is not confirmed on this page. Source: help.openai.com, checked 2026-11-02 |
| Audit log | Not confirmed | The Compliance Platform is only for eligible Enterprise and Edu workspaces. The quote does not say it records MCP tool calls. Source: help.openai.com, checked 2026-11-02 |
| Plan for a custom connector | Free, Pro, Max, Ultra, Team, and Enterprise. A Free account can add one custom connector. Source: support.claude.com, checked 2026-11-02 | Full custom MCP support is for Business and Enterprise or Edu on the web. Pro can connect with read and fetch permissions. Source: help.openai.com, checked 2026-11-02 |
In Claude, each person still signs in. A custom connector with a shared credential reaches whatever that credential can access. Enterprise-managed auth for Claude is in beta. Custom connectors are called from Anthropic's cloud, so the server has to be reachable on the public internet. Connected services process data on their own infrastructure. Source: support.claude.com, checked 2026-11-02
On Claude Enterprise, owners can keep verified-domain connectors inside the org. In Claude, connector requests are on by default on Team and off on Enterprise. ChatGPT Enterprise can ask OpenAI to limit connections from a verified company domain. ChatGPT admins can refresh a custom MCP app's tool list from workspace settings. Open Plugins in Admin Console, or the Apps page if Plugins is unavailable. That article does not say this turns an app off. Source: support.claude.com, checked 2026-11-02Source: help.openai.com, checked 2026-11-02
Send this to IT
Copy this, fill in the parts in [brackets] and send it.
Subject: Request: connect Dynamics 365 Sales to [your AI assistant] for my sales work Hi [name], I'd like to connect Dynamics 365 Sales to [your AI assistant] using Dynamics 365 Sales' official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval for a tenant admin to grant admin consent, and for a System Administrator to configure the server, before anyone connects. - Any admin step Dynamics 365 Sales needs before I can connect. How I'll use it: - I'll approve each action that creates, changes or sends something before it runs. - I'll disconnect it if you ask, or when I stop using it. Quick facts: - Access: Read + write - Sign-in: Microsoft Entra ID OAuth 2.0 through the Agent 365 Tooling Gateway (admin consent required; on-behalf-of exchange to Dataverse) - Setup: Needs admin or IT - Who approves: A tenant admin grants admin consent first. A System Administrator configures the server. - Read-only option: Not confirmed - How to revoke: Not confirmed - Credits: Not confirmed The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/dynamics-365-sales Thanks, [your name]
Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. The date beside each source is the day we last found that quote on the page. StackMCP listing facts on this page were checked on Oct 30, 2026.
All the facts on one page, with sources: Dynamics 365 Sales MCP server.
Other one-pagers: HubSpot · Salesforce · Gong · Slack · Apollo · Pipedrive · Close · Attio
Something out of date on this page? Report a correction, with a link to the vendor page that shows the right information.