> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Microsoft Dataverse MCP Server

> Register your Dataverse environment's hosted MCP server in TrueFoundry so agents can query, search, and update Power Platform and Dynamics 365 data.

[Microsoft Dataverse](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-intro) is the data platform behind Power Platform and Dynamics 365. Every Dataverse environment exposes a [hosted MCP server](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp) at `/api/mcp` that lets agents search table schemas and data, run Dataverse SQL `SELECT` queries with `read_query`, create, update, and delete rows, and manage tables. Every request runs as the signed-in user and honors that user's Dataverse security roles.

Register it on the [TrueFoundry MCP Gateway](/docs/ai-gateway/mcp/mcp-overview) and your agents reach Dataverse through one governed endpoint, with per-user OAuth, tool-level access control, tracing, and guardrails applied by the Gateway.

<Note>
  Dataverse is **per-environment**: the MCP URL and the OAuth scope both embed your environment's host. Dataverse does **not** support Dynamic Client Registration (DCR), so you must register your own Entra app and add it to the environment's allowed MCP clients list.
</Note>

## Using Dataverse through the MCP Gateway

When you use the Dataverse MCP server through the AI Gateway, TrueFoundry provides:

* **Authentication** - Clients [authenticate inbound](/docs/ai-gateway/mcp/mcp-gateway-auth-security#inbound-authentication) to the AI Gateway with a Personal Access Token, Virtual Account, or IDE OAuth flow. For outbound access, the AI Gateway runs the [OAuth2 Authorization Code flow](/docs/ai-gateway/mcp/mcp-gateway-auth-security#outbound-authentication) against your Entra app.
* **Tool-level access control** - Enable or disable individual Dataverse tools from the server detail page. Disabling the write tools at the Gateway keeps an agent read-only.
* **Access control** - [Collaborators and role-based policies](/docs/ai-gateway/mcp/mcp-gateway-auth-security#access-control) define who can use the server and which tools they can invoke.
* **Observability** - Tool calls are traced with caller identity, tool name, inputs, and latency. Monitor server- and tool-level usage in [MCP Metrics](/docs/ai-gateway/analytics-mcp-metrics) and export traces to your observability stack via OpenTelemetry.
* **Guardrails** - Apply [pre-tool and post-tool guardrails](/docs/ai-gateway/guardrails-overview) on MCP tool calls - useful here because a single `read_query` or `search_data` call can return customer records.

## Prerequisites

* A TrueFoundry account with permission to add MCP servers, and your TrueFoundry control plane base URL.
* A Dataverse environment and its environment URL.
* The **Power Platform administrator** role, to [enable the Dataverse MCP server](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-disable) and add your app to the allowed MCP clients list for the environment.
* Permission to register an application in Microsoft Entra ID, and an admin who can grant tenant-wide consent if your tenant blocks user consent.

## Adding Dataverse MCP server to TrueFoundry

<Steps>
  <Step title="Find your Dataverse environment URL">
    1. Go to the [Power Platform admin center](https://admin.powerplatform.microsoft.com/) and select **Manage → Environments**.
    2. Select your environment and copy the **Environment URL** from the details panel.

    The URL looks like `https://<org-name>.crm<region>.dynamics.com`. The region suffix depends on where the environment is hosted - for example `crm.dynamics.com` for North America, `crm4.dynamics.com` for EMEA, or `crm8.dynamics.com` for India. Use the host exactly as shown; this guide refers to it as `<org-host>` (for example `contoso.crm4.dynamics.com`).
  </Step>

  <Step title="Enable the Dataverse MCP server for the environment">
    1. In the Power Platform admin center, open your environment and select **Settings**.
    2. Select **Product → Features** and scroll to **Dataverse Model Context Protocol**.
    3. Make sure **Allow MCP clients to interact with Dataverse MCP server** is turned on. See Microsoft's [Configure the Dataverse MCP server](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-disable) for details.

    Leave this page open - you add your Entra app to **Advanced Settings** here in Step 5.
  </Step>

  <Step title="Register an Entra ID application">
    1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), go to **Entra ID → App registrations → New registration**. For general guidance, see [Register an application with the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app).

    2. Give it a recognizable name, such as `TrueFoundry Dataverse Connector`.

    3. Set **Supported account types** to **Accounts in this organizational directory only** (single tenant).

    4. Under **Redirect URI**, choose the **Web** platform and enter TrueFoundry's OAuth callback:

       ```txt theme={"dark"}
       https://<tfy-control-plane-base-url>/api/svc/v1/llm-gateway/mcp-servers/oauth2/callback
       ```

       Replace `<tfy-control-plane-base-url>` with your TrueFoundry control plane URL. It must match exactly, including the `https://` scheme.

    5. Select **Register**, then copy the **Application (client) ID** and the **Directory (tenant) ID** from the overview page.

    6. Open **Certificates & secrets → New client secret**, set a description and expiry, and copy the secret **Value** immediately - it is shown only once, and it is the **Value**, not the Secret ID, that TrueFoundry needs.

    <Tip>
      Store the secret in the [TrueFoundry secrets store](/docs/manage-secrets) and reference it by FQN in the server config rather than pasting it inline. Rotate it before it expires.
    </Tip>
  </Step>

  <Step title="Add the Dataverse MCP permission">
    1. In the app registration, open **API permissions → Add a permission**.
    2. Select **Microsoft APIs → Dynamics CRM**.
    3. Select **Delegated permissions**, check **mcp.tools**, and select **Add permissions**.
    4. If your tenant doesn't allow users to consent to apps, select **Grant admin consent for \<your tenant>** and confirm. The status must turn green.
  </Step>

  <Step title="Add the app to the allowed MCP clients list">
    Dataverse only accepts tokens from MCP clients on the environment's allow list. See Microsoft's [Connect Dataverse MCP with non-Microsoft clients](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-other-clients#connect-using-the-remote-endpoint).

    1. Back on **Settings → Product → Features → Dataverse Model Context Protocol**, select **Advanced Settings**.
    2. Add a new client entry. Enter a name (for example `TrueFoundry`) and the **Application (client) ID** from Step 3.
    3. Set **Is Enabled** to **Yes**, then select **Save & Close**.
  </Step>

  <Step title="Register the MCP server in TrueFoundry">
    In **MCP Servers**, click **Add new MCP Server**, select **Connect any Remote MCP Server**, and configure:

    | Field | Value |
    | - | - |
    | **Name** | `dataverse` |
    | **URL** | `https://<org-host>/api/mcp` |
    | **Authentication** | `OAuth2` |
    | **Grant Type** | `Authorization Code` |
    | **Authorization URL** | `https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize` |
    | **Token URL** | `https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token` |
    | **Client ID** | Application (client) ID from Step 3 |
    | **Client Secret** | Client secret **Value** from Step 3 |
    | **Scopes** | `https://<org-host>/.default` and `offline_access` |
    | **JWT Source** | `Access Token` |

    Add **Collaborators** - the users and teams that can use or manage this server - and assign each an **MCP Server Manager** or **MCP Server User** role. Then save.

    `https://<org-host>/.default` requests the Dynamics CRM permissions configured on the app (including `mcp.tools`) for your environment. `offline_access` lets the Gateway refresh tokens; without it users have to reauthorize when the access token expires.
  </Step>

  <Step title="Connect and verify">
    Open the server's **Tools** tab and click **Connect Now**. TrueFoundry runs the authorization-code flow: you sign in with your Microsoft account, consent, and land back on the server detail page. Each user connects once with their own identity.

    After connecting, the **Tools** tab lists the [Dataverse MCP tools](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp#list-of-tools-available-in-dataverse-mcp-server). To confirm the round trip, click **Try** on `read_query` and run a read-only query such as:

    ```sql theme={"dark"}
    SELECT TOP 5 name FROM account
    ```

    A JSON list of account names confirms that authentication, the allow list, and the user's Dataverse permissions are all working.
  </Step>
</Steps>

## Connecting to an MCP Client

Open the **How To Use** tab on the Dataverse server detail page for your tenant-specific Gateway URL and ready-to-paste client snippets - don't build the endpoint manually.

The tab includes snippets for Claude Code, VS Code, Claude Web, Claude Desktop, Cursor, Windsurf, Codex, and the Python and TypeScript MCP SDKs. Use **Show API Key** if your client requires a Gateway token in a header. For step-by-step setup in each client, see [Connect MCP from your IDE](/docs/ai-gateway/mcp/connect-mcp-from-ide).

## Tool Metrics

The **Tool Metrics** tab tracks invocation count, latency, and error rates per tool. See [MCP Metrics](/docs/ai-gateway/analytics-mcp-metrics) for server- and tool-level dashboards across your Gateway.

## Disabling Individual Tools

On the **Tools** tab, toggle off any [Dataverse tools](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp#list-of-tools-available-in-dataverse-mcp-server) your agents don't need. Disabled tools are hidden from MCP clients and cannot be invoked. Turning off the record, table, skill, and file-upload write tools gives you a read-only Dataverse server at the Gateway, independent of the user's Dataverse security roles. See [MCP Tool Management](/docs/ai-gateway/mcp/mcp-tool-management) for denylist and allowlist modes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.