Enterprise software is crossing a line that deserves more attention than it's getting: AI agents are being given write access to ERP.
Microsoft's agentic ERP roadmap for Dynamics 365 runs through March 2027, and the plumbing is already generally available — the Dynamics 365 ERP Model Context Protocol (MCP) server and the Copilot Cowork plugin give agents working in Microsoft 365 a supported route to read and act on ERP records. Operations agents can identify a supply issue from predefined signals, update the system of record, file a remediation ticket, and notify stakeholders with context. Commerce and scheduling are following the same pattern.
This is a genuine step change, and the risk profile changes with it. Read a report wrong and you have a bad meeting. Post to the ledger wrong and you have a restatement.
What actually changed
Agents in Microsoft 365 were, until recently, mostly readers — summarising, drafting, answering. The shift is from an agent that tells you about the purchase order to one that creates it. Three pieces made that practical:
- MCP servers for ERP, giving agents a standardised, supported interface to business data instead of bespoke one-off integrations.
- Agent connectors that are generally available rather than preview — meaning supported, governed paths rather than someone's clever workaround.
- Copilot Studio's low-code building, which we covered when autonomous agents arrived in Microsoft 365 — so the people building these won't all be in IT.
Where it genuinely pays
The opportunity is exactly the unglamorous, high-volume work that moves the P&L: the month-end close, reconciliation and exception handling, supplier chasing, and the endless small updates that keep a system of record accurate. This is the same wedge as our bank reconciliation build — repetitive, rules-heavy, measurable, and currently consuming expensive human attention.
Four things to settle before you let one write
- Make reversibility the design question. Drafting a purchase order is reversible — let the agent run. Posting a journal, releasing a payment, or changing a supplier's bank details is not — a human approves. Autonomy is granted per action, not wholesale, which is the heart of closing the agent governance gap.
- Treat each agent as a non-human identity. It will hold real ERP permissions. Give it scoped credentials and a named owner, not a shared service account nobody can trace back to a person.
- Fix master data first. An agent acting on stale supplier or pricing data doesn't produce a wrong dashboard — it produces a wrong transaction, at machine speed, repeatedly. Data quality stops being a reporting concern the moment something acts on it.
- Rewrite segregation of duties for non-human actors. Most SoD matrices assume the thing taking an action has a manager, a login and a job title. Agents have none of those. If an agent can both raise and approve, you've engineered a control failure without noticing.
The honest framing
"The agent can do it" and "we would let the agent do it unsupervised" are different questions, and only the first is about technology. The organisations that get value here in 2027 will be the ones that started with the smallest, most reversible, most auditable ERP task, proved the controls held, and widened the mandate from evidence rather than enthusiasm.
The bottom line
Agentic ERP is arriving on a published roadmap through March 2027, and the connectors are shipping now — so this is a planning question for your next budget, not a future one. The prerequisites are unglamorous: reversibility by design, agent identities with owners, clean master data, and SoD that accounts for non-human actors. Get those right and the close gets faster every quarter. That combination of enablement and governance is exactly how we scope Copilot & Power Platform work.
Thinking about letting agents into your ERP? Let's plan it properly.