Microsoft Dataverse Skills: A Safe Guide to AI Coding Agents and MCP

The short answer

Microsoft’s Dataverse plugin is now a practical bridge between AI coding agents and enterprise business data. The July 2026 update expands the plugin across Claude, Cursor, and GitHub Copilot, while Microsoft’s open-source repository also documents Codex support. The important detail is architectural: this is not a blanket database credential. The plugin routes requests through specialist skills and existing tools—including the Dataverse MCP server, Python SDK, Power Platform CLI, and Dataverse CLI—while Dataverse continues to enforce the authenticated user’s permissions.

For teams building CRM, ERP, or internal operations software, the opportunity is to let an agent inspect schemas, answer business-data questions, create controlled records, and package solutions without turning the agent into an unreviewed administrator. The safe rollout pattern is project-scoped installation, least-privilege identities, environment allowlisting, explicit approval for destructive work, and audit review before production use.

Key takeaways

• The July announcement is an expansion: Claude and GitHub Copilot support was documented earlier; Cursor is the notable newly named marketplace surface in the July update.
• The open-source Dataverse Skills repository lists eight specialist skills and routes tasks to MCP, the Python SDK, PAC CLI, or Dataverse CLI.
• The plugin does not replace Dataverse authorization. Server-side security roles still determine what the caller can access.
• Standard MCP tools live at /api/mcp; preview capabilities use a separate /api/mcp_preview endpoint and require an administrator setting.
• Treat agent writes as production operations: start read-only, scope environments, require human approval for irreversible actions, and preserve logs.

What Microsoft actually shipped

Microsoft’s July 6 Power Platform announcement says the Dataverse plugin is available for Claude, Cursor, and GitHub Copilot. It also describes a wider MCP catalog, partner certification, and Bring Your Own MCP governance for internal tools. The April 30 developer post had already documented the Claude Marketplace listing and the setup flow for Claude Code and GitHub Copilot.

That timeline matters. The July post should not be read as three simultaneous launches. The durable developer opportunity is broader than the marketplace headline: Microsoft is turning Dataverse into a governed tool surface that coding agents can use from the environments where developers already work.

The official repository adds Codex installation instructions and exposes the implementation details that are most useful to engineering teams. It is MIT-licensed, has separate plugin directories for agent hosts, and includes evaluation and safety documentation. That makes it possible to inspect the skills rather than treating the agent behavior as a black box.

For context, this is a different layer from a generic MCP tutorial. The MCP developer guide on essamamdani.com explains the protocol itself; Dataverse Skills is a concrete, enterprise-oriented application of that protocol.

The architecture: one entry point, several execution paths

The plugin’s value is orchestration. A developer can ask for an outcome in natural language, while the routing layer chooses the appropriate execution path.

Figure 1 — Original workflow diagram based on Microsoft’s Power Platform announcement and the Microsoft Dataverse Skills repository. The key control point is server-side authorization, not the prompt router.

The repository describes eight skills:

This separation is more useful than a single “Dataverse agent” label. It gives reviewers a vocabulary for narrowing access and evaluating failures. A support analyst may need dv-query but not dv-admin; a developer may need metadata access in a sandbox but not production security-role management.

Installation surfaces and prerequisites

The repository documents these installation routes:

• Claude Code: /plugin install dataverse@claude-plugins-official
• GitHub Copilot: /plugin install dataverse@awesome-copilot
• Codex: add https://github.com/microsoft/Dataverse-skills.git as a marketplace, then install the Dataverse plugin
• Cursor: install Microsoft Dataverse from the Cursor plugin marketplace

A Dataverse environment is required. The repository points to Power Apps, Dynamics 365, Power Platform plans, and the free Power Apps Developer Plan as possible environments. The setup skill checks for the Dataverse CLI, Python SDK, PAC CLI, .NET SDK, Azure CLI, Node.js, and Git, then walks through authentication and MCP registration.

Do not give an agent a production environment as its first test. Create a disposable developer or sandbox environment, install the plugin at project scope where the host supports it, and verify the resulting configuration in version control before using it with a team.

The April Microsoft walkthrough also describes an important operational property: the connect flow is designed to be repeatable. It checks existing authentication profiles and only performs missing setup. That reduces configuration drift, but it does not remove the need to review generated files, package versions, and environment identifiers.

What the agent can and cannot do

The useful mental model is “agent-operated client,” not “agent-owned database.” Dataverse’s server-side authorization remains the boundary. The repository says requests cannot exceed the permissions of the authenticated user, and Microsoft’s documentation describes tenant consent and per-environment allowlisting for MCP access.

The standard MCP surface is available at /api/mcp. Microsoft’s preview documentation separates experimental tools behind /api/mcp_preview; enabling them is an administrator action in the Power Platform admin center. Preview tools may change, lack production-grade reliability, and fall outside normal support agreements. Do not silently mix preview behavior into a production runbook.

Microsoft also documents Dataverse agent identities as a least-privilege option. An agent user can receive dedicated security roles and auditable access rather than borrowing a powerful human administrator account. That is the stronger pattern for scheduled jobs, CI workflows, and shared team agents.

A practical permission matrix looks like this:

This fits the verification-first approach in the site’s AI-assisted Go engineering guide: let the agent accelerate inspection and implementation, but make the system prove what changed.

A safe first workflow

1. Install and inspect

Install the plugin for the agent your team already uses. Before connecting to data, inspect the repository’s skill files, safety documentation, and plugin manifest. Pin the marketplace source or Git ref when reproducibility matters.

2. Connect to a sandbox

Authenticate with a developer identity or dedicated agent identity. Confirm the environment URL, tenant, and organization before allowing tool calls. If MCP access is used, an administrator must approve the client and allow it for the specific environment.

3. Start with read-only prompts

Use prompts that produce evidence rather than mutations:

1List the tables available in this sandbox and describe the schema for accounts.
2Return only table names, column names, and data types. Do not create, update, or delete anything.

Then ask for a filtered query and verify the result against the Dataverse UI or a direct API request. A natural-language answer is not a test oracle.

4. Add a controlled write

For a non-sensitive test table, ask the agent to prepare a record but stop before submission. Review the fields, lookup references, and validation rules. Only then allow the create operation. Capture the request, actor identity, environment, result, and resulting record ID.

5. Move schema changes through solutions

Do not let an agent edit production schema as an isolated chat action. Have it create or modify a solution in a development environment, export the artifact, run checks, and send the change through the same review and deployment process used for human-authored Dataverse work.

6. Test failure modes

Deliberately test expired credentials, wrong organization URLs, denied roles, blocked environments, pagination, malformed imports, and partial failures. The right question is not whether the happy path works; it is whether the agent stops safely when a boundary is reached.

Security and privacy checklist

• Use dedicated Entra identities and least-privilege Dataverse roles for automation.
• Separate development, test, and production environments.
• Allowlist MCP clients per environment; do not rely only on tenant-level consent.
• Keep secrets in the operating system credential store or a managed secret system, never in prompts or committed files.
• Review .gitignore changes and generated .env files after setup.
• Restrict dv-security and dv-admin to a small operator group.
• Treat bulk imports as data pipelines with validation, idempotency, and rollback plans.
• Turn on and review Dataverse auditing for agent-driven changes.
• Keep preview MCP endpoints out of production configurations unless the risk owner explicitly accepts the support and change-management tradeoff.
• Log tool name, identity, environment, request purpose, approval, result, and correlation ID without copying sensitive record contents into unrelated telemetry.

Teams already using a gateway should compare the plugin’s controls with their existing AI gateway governance patterns. The question is not whether one product is universally better; it is where authorization, routing, logging, and cost controls should live in your architecture.

Common errors and debugging

The plugin is installed but no tools appear

Restart the agent host after marketplace installation. Verify the plugin appears in the host’s plugin list, then run the documented skills check. Confirm that the project is opened at the expected scope and that the MCP configuration points to the intended organization.

MCP returns an authorization or allowlisting error

Check tenant admin consent, the environment’s allowed-client setting, the signed-in identity, and the organization URL. A successful login does not prove that the MCP client is permitted for the selected environment.

The agent returns incomplete data

Check pagination and filters first. For larger reads, route the job through the Python SDK rather than asking the agent to hold a large result set in conversation. Compare counts with a direct query and record the timestamp of both checks.

A schema change works in development but fails in deployment

Inspect solution dependencies, publisher prefixes, environment variables, and privileges. Ask the agent to produce a deployment preflight report instead of repeatedly retrying the import.

Preview examples fail against /api/mcp

That may be expected. Microsoft separates standard GA tools from preview tools. Confirm whether the feature setting is enabled and whether the request is using /api/mcp_preview; do not “fix” the error by granting broader permissions.

FAQ

Is Dataverse Skills itself an MCP server?

No. It is a set of agent skills and routing instructions that can use the Dataverse MCP server alongside the Python SDK, PAC CLI, and Dataverse CLI.

Does the plugin bypass Dataverse RBAC?

The official repository says it cannot exceed the authenticated user’s permissions, and Dataverse authorizes requests server-side. That is a control to verify in your environment, not a reason to skip access review.

Should I enable preview MCP tools for production agents?

Usually no. Preview tools can change without notice and may not have production-grade reliability or full support. Keep them isolated unless a documented experiment has an owner and rollback plan.

Which agent should a team choose?

Choose the host that already fits your identity, code-review, and secrets workflow. The important decision is not Claude versus Cursor versus Copilot; it is whether the Dataverse environment, agent identity, skills, and approvals are scoped correctly.

Conclusion

Dataverse Skills is a meaningful step toward agent-assisted enterprise development because it combines natural-language workflows with recognizable engineering controls. Its strongest idea is not that an agent can query CRM data. It is that the agent can route across existing tools while Dataverse remains the authorization and audit boundary.

Start with a sandbox, read-only queries, dedicated identities, and visible approval gates. Promote schema and data changes through solutions and normal review. If the system cannot explain which skill ran, which tool was called, which identity authorized it, and what changed, it is not ready for production—regardless of how smooth the demo looks.

Sources and visual credits

• Microsoft Power Platform Blog: Dataverse Is Your Agent Data Platform — July 2026 — primary announcement and feature scope.
• Microsoft Power Platform Developer Blog: Dataverse Plugin Is Now on the Claude Marketplace — primary installation and setup walkthrough.
• Microsoft Dataverse Skills repository — official source, skill inventory, installation, and safety model.
• Microsoft Learn: Preview tools for Dataverse MCP server — official GA/preview endpoint and admin controls.
• Microsoft Learn: Dataverse agent users with Entra agent identity — official identity and least-privilege planning documentation.
• Digital Applied: Dataverse Meets Claude, Cursor and Copilot via MCP — independent technical analysis used to cross-check the timeline and routing model.

Figure 1 is an original Mermaid diagram by the author, based on the Microsoft announcement and repository. The comparison tables are original editorial synthesis; they are not Microsoft benchmark data or product screenshots.