Dynamics 365 Finance: Business performance - MCP for ERP Analytics

🚨 The Signal: Dynamics 365 Finance now allows AI agents structured access to ERP analytics data, metrics, and tools. This enables agents to use consistent definitions, potentially increasing data exposure and the risk of unauthorised information access.

The Impact

Admins and security teams are affected by new agent data access, increasing the risk of sensitive ERP data exposure.

• Security teams: Increased risk of sensitive ERP data exposure via AI agents.
• Admins: New agent identities require careful access control and monitoring.
• Data owners: Need to validate agent access aligns with data classification policies.
• Compliance teams: Must update data handling policies for AI agent interactions.

The Action

1. Review and update data classification policies to include AI agent access considerations.
2. Implement least privilege access for all AI agent identities accessing ERP data.
3. Establish monitoring and auditing for AI agent interactions with sensitive ERP analytics.
4. Develop incident response procedures for potential AI agent data misuse or exfiltration.
5. Consult ASD ISM controls for AI system governance and data protection.

Domain: Agentic-AI · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898