> ## Documentation Index > Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up Microsoft Dataverse MCP Server > Register your Dataverse environment's hosted MCP server in TrueFoundry so agents can query, search, and update Power Platform and Dynamics 365 data. [Microsoft Dataverse](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-intro) is the data platform behind Power Platform and Dynamics 365. Every Dataverse environment exposes a [hosted MCP server](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp) at `/api/mcp` that lets agents search table schemas and data, run Dataverse SQL `SELECT` queries with `read_query`, create, update, and delete rows, and manage tables. Every request runs as the signed-in user and honors that user's Dataverse security roles. Register it on the [TrueFoundry MCP Gateway](/docs/ai-gateway/mcp/mcp-overview) and your agents reach Dataverse through one governed endpoint, with per-user OAuth, tool-level access control, tracing, and guardrails applied by the Gateway. > [!NOTE] > > Dataverse is **per-environment**: the MCP URL and the OAuth scope both embed your environment's host. Dataverse does **not** support Dynamic Client Registration (DCR), so you must register your own Entra app and add it to the environment's allowed MCP clients list. ## Using Dataverse through the MCP Gateway When you use the Dataverse MCP server through the AI Gateway, TrueFoundry provides: * **Authentication** - Clients [authenticate inbound](/docs/ai-gateway/mcp/mcp-gateway-auth-security#inbound-authentication) to the AI Gateway with a Personal Access Token, Virtual Account, or IDE OAuth flow. For outbound access, the AI Gateway runs the [OAuth2 Authorization Code flow](/docs/ai-gateway/mcp/mcp-gateway-auth-security#outbound-authentication) against your Entra app. * **Tool-level access control** - Enable or disable individual Dataverse tools from the server detail page. Disabling the write tools at the Gateway keeps an agent read-only. * **Access control** - [Collaborators and role-based policies](/docs/ai-gateway/mcp/mcp-gateway-auth-security#access-control) define who can use the server and which tools they can invoke. * **Observability** - Tool calls are traced with caller identity, tool name, inputs, and latency. Monitor server- and tool-level usage in [MCP Metrics](/docs/ai-gateway/analytics-mcp-metrics) and export traces to your observability stack via OpenTelemetry. * **Guardrails** - Apply [pre-tool and post-tool guardrails](/docs/ai-gateway/guardrails-overview) on MCP tool calls - useful here because a single `read_query` or `search_data` call can return customer records. ## Prerequisites * A TrueFoundry account with permission to add MCP servers, and your TrueFoundry control plane base URL. * A Dataverse environment and its environment URL. * The **Power Platform administrator** role, to [enable the Dataverse MCP server](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-disable) and add your app to the allowed MCP clients list for the environment. * Permission to register an application in Microsoft Entra ID, and an admin who can grant tenant-wide consent if your tenant blocks user consent. ## Adding Dataverse MCP server to TrueFoundry **1. Find your Dataverse environment URL** 1. Go to the [Power Platform admin center](https://admin.powerplatform.microsoft.com/) and select **Manage → Environments**. 2. Select your environment and copy the **Environment URL** from the details panel. The URL looks like `https://.crm.dynamics.com`. The region suffix depends on where the environment is hosted - for example `crm.dynamics.com` for North America, `crm4.dynamics.com` for EMEA, or `crm8.dynamics.com` for India. Use the host exactly as shown; this guide refers to it as `` (for example `contoso.crm4.dynamics.com`). **2. Enable the Dataverse MCP server for the environment** 1. In the Power Platform admin center, open your environment and select **Settings**. 2. Select **Product → Features** and scroll to **Dataverse Model Context Protocol**. 3. Make sure **Allow MCP clients to interact with Dataverse MCP server** is turned on. See Microsoft's [Configure the Dataverse MCP server](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-disable) for details. Leave this page open - you add your Entra app to **Advanced Settings** here in Step 5. **3. Register an Entra ID application** 1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), go to **Entra ID → App registrations → New registration**. For general guidance, see [Register an application with the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). 2. Give it a recognizable name, such as `TrueFoundry Dataverse Connector`. 3. Set **Supported account types** to **Accounts in this organizational directory only** (single tenant). 4. Under **Redirect URI**, choose the **Web** platform and enter TrueFoundry's OAuth callback: ```txt theme={"dark"} https:///api/svc/v1/llm-gateway/mcp-servers/oauth2/callback ``` Replace `` with your TrueFoundry control plane URL. It must match exactly, including the `https://` scheme. 5. Select **Register**, then copy the **Application (client) ID** and the **Directory (tenant) ID** from the overview page. 6. Open **Certificates & secrets → New client secret**, set a description and expiry, and copy the secret **Value** immediately - it is shown only once, and it is the **Value**, not the Secret ID, that TrueFoundry needs. > [!TIP] > > Store the secret in the [TrueFoundry secrets store](/docs/manage-secrets) and reference it by FQN in the server config rather than pasting it inline. Rotate it before it expires. **4. Add the Dataverse MCP permission** 1. In the app registration, open **API permissions → Add a permission**. 2. Select **Microsoft APIs → Dynamics CRM**. 3. Select **Delegated permissions**, check **mcp.tools**, and select **Add permissions**. 4. If your tenant doesn't allow users to consent to apps, select **Grant admin consent for \** and confirm. The status must turn green. **5. Add the app to the allowed MCP clients list** Dataverse only accepts tokens from MCP clients on the environment's allow list. See Microsoft's [Connect Dataverse MCP with non-Microsoft clients](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-other-clients#connect-using-the-remote-endpoint). 1. Back on **Settings → Product → Features → Dataverse Model Context Protocol**, select **Advanced Settings**. 2. Add a new client entry. Enter a name (for example `TrueFoundry`) and the **Application (client) ID** from Step 3. 3. Set **Is Enabled** to **Yes**, then select **Save & Close**. **6. Register the MCP server in TrueFoundry** In **MCP Servers**, click **Add new MCP Server**, select **Connect any Remote MCP Server**, and configure: | Field | Value | | - | - | | **Name** | `dataverse` | | **URL** | `https:///api/mcp` | | **Authentication** | `OAuth2` | | **Grant Type** | `Authorization Code` | | **Authorization URL** | `https://login.microsoftonline.com//oauth2/v2.0/authorize` | | **Token URL** | `https://login.microsoftonline.com//oauth2/v2.0/token` | | **Client ID** | Application (client) ID from Step 3 | | **Client Secret** | Client secret **Value** from Step 3 | | **Scopes** | `https:///.default` and `offline_access` | | **JWT Source** | `Access Token` | Add **Collaborators** - the users and teams that can use or manage this server - and assign each an **MCP Server Manager** or **MCP Server User** role. Then save. `https:///.default` requests the Dynamics CRM permissions configured on the app (including `mcp.tools`) for your environment. `offline_access` lets the Gateway refresh tokens; without it users have to reauthorize when the access token expires. **7. Connect and verify** Open the server's **Tools** tab and click **Connect Now**. TrueFoundry runs the authorization-code flow: you sign in with your Microsoft account, consent, and land back on the server detail page. Each user connects once with their own identity. After connecting, the **Tools** tab lists the [Dataverse MCP tools](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp#list-of-tools-available-in-dataverse-mcp-server). To confirm the round trip, click **Try** on `read_query` and run a read-only query such as: ```sql theme={"dark"} SELECT TOP 5 name FROM account ``` A JSON list of account names confirms that authentication, the allow list, and the user's Dataverse permissions are all working. ## Connecting to an MCP Client Open the **How To Use** tab on the Dataverse server detail page for your tenant-specific Gateway URL and ready-to-paste client snippets - don't build the endpoint manually. The tab includes snippets for Claude Code, VS Code, Claude Web, Claude Desktop, Cursor, Windsurf, Codex, and the Python and TypeScript MCP SDKs. Use **Show API Key** if your client requires a Gateway token in a header. For step-by-step setup in each client, see [Connect MCP from your IDE](/docs/ai-gateway/mcp/connect-mcp-from-ide). ## Tool Metrics The **Tool Metrics** tab tracks invocation count, latency, and error rates per tool. See [MCP Metrics](/docs/ai-gateway/analytics-mcp-metrics) for server- and tool-level dashboards across your Gateway. ## Disabling Individual Tools On the **Tools** tab, toggle off any [Dataverse tools](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp#list-of-tools-available-in-dataverse-mcp-server) your agents don't need. Disabled tools are hidden from MCP clients and cannot be invoked. Turning off the record, table, skill, and file-upload write tools gives you a read-only Dataverse server at the Gateway, independent of the user's Dataverse security roles. See [MCP Tool Management](/docs/ai-gateway/mcp/mcp-tool-management) for denylist and allowlist modes. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.