Nobody at that company ran a transformation program. There was no readiness assessment, no phased roadmap, no statement of work with a discovery phase attached. The capability arrived the way everything arrives in a cloud ERP now — as part of a routine service update.
Two scoping notes first, because both matter. This is largely a Business Central story; on Dynamics 365 Finance, as the second half sets out, agents still arrive the old way. And it concerns Microsoft’s first-party agents — agents your own team builds in Copilot Studio sit on a different governance surface entirely, with its own connectors and data loss prevention policy, and are outside what follows.
The Delivery Path Has No Approval Gate
Business Central online receives minor updates every month except April and October, with major updates in those two months. Those updates are mandatory. For a major version an administrator controls the timing — a preview period from the March or September before release, an update window that can be rescheduled, a grace period, then an enforced period in which blocking extensions can be uninstalled automatically. What an administrator does not control is whether the update happens.
Layered on that, Copilot features in Business Central have been activated by default since update 25.0. Microsoft’s framing is that Copilot is ready to use without configuration unless you deactivate specific features, though not every individual capability ships switched on.
None of that means an agent starts working on its own. Agents are the documented exception and still need setting up. What it means is narrower and, for a finance function, more awkward: the capability is present, discoverable and a short configuration away from live, and nothing in the delivery path contains an approval step. The decision still gets made. It just gets made by whoever notices the tile.
What Actually Landed, and When
Sales Order Agent reached general availability in November 2025. It watches a designated mailbox, reads inbound customer requests, locates the customer, checks item availability including capable-to-promise dates, and drafts a quote it emails back — and on confirmation it can create or update the sales order itself. Since July 2026 you can run more than one per company. Payables Agent reached general availability the same month: it monitors a mailbox for vendor invoices, extracts the data, identifies the vendor, and creates draft purchase invoices with suggested lines. Business Central’s Expense Agent, still in preview, is following the same path.
Then the drip continued. Purchase invoice matching to orders in February 2026. Known Senders in Payables Agent on 7 August 2026, eleven days before this was written.
The item that makes the point most clearly shipped in July 2026. Microsoft’s release plan describes a free trial mode for Payables Agent that a user can start “without help from an administrator or having paid credits”, with no email account to configure and fifty invoice uploads included. The setup documentation is more precise about who that user is: configuring the agent still requires either the Can configure setting on the agent’s user access list, or the Configure All Agents permission. What the trial removes is not the permission. It is the two steps that used to force a conversation with IT — the Exchange mailbox grant and the billing setup.
Read that as a product decision and its effect is clear, whatever the intent: the approval step a transformation program would have imposed is simply not in the path.
The Mid-Market Was Never Going to Run a Program Anyway
This lands on a segment that was never the audience for the program version. RSM’s 2026 Middle Market AI Survey — fielded 5 to 16 March 2026 across 1,030 companies in the US and Canada, ±3.1 points — found 45 per cent focused on implementing AI where it delivers clear value today, against 17 per cent pursuing enterprise-wide transformation. At the lower end of that band, a finance function does not have a transformation office. It has a controller with a queue, an IT manager with four other priorities, and a CFO who would like the close to be shorter.
Set against that, Gartner’s November 2025 survey of 183 CFOs and senior finance leaders found AI adoption in the finance function essentially flat between 2024 and 2025, 58 to 59 per cent, with accounts payable process automation the second most implemented use case at 37 per cent. That flat line is a useful corrective: capability arriving by update is not the same as capability being adopted. What has changed is not the rate of adoption but who makes the decision, and whether the decision leaves a trace.
What the Project Used to Decide
An ERP project was tedious and expensive, and it did one thing quietly and well. It forced a set of decisions, because the plan had a line for each: who owns this, who approves, what gets logged, what happens when it is wrong, who is trained.
Who the agent is. In Business Central, agents are modelled as users. They have an agent user security ID, appear on an Agents page, and hold permission sets like anyone else. Microsoft’s agent permissions documentation — still marked prerelease — puts the key control plainly: a task runs with the intersection of the scheduling user’s permissions and the agent’s, so agents “never exceed the privileges of the user who scheduled the task”.
That bound applies to work a person initiates. When the agent acts on its own trigger there is no scheduling user, and the bound is the agent’s own permission set. Payables Agent ships with a system-managed, read-only set that can be copied and customised but not edited in place — and a copy is no longer system-managed, so it will not inherit Microsoft’s later changes. Over a year of monthly releases that is drift in the exact object that defines what the agent may do. Re-diff the copy against the shipped set at each major update.
What review means. Payables Agent creates drafts and nothing posts automatically; a supervisor approves before posting. The reviewer sees, per section, how many fields still need review, and each of those fields carries a tip describing the agent’s reasoning for the value it set. The question to put to your auditor is whether an in-product review indicator meets your evidence-of-review requirement, or whether you need change-log retention behind it that survives the document being edited afterwards. We have written separately about what an auditor actually sees when an agent does the work.
How much supervision the team can absorb, which is finite and almost never counted — the constraint we examined in how many agents one finance team can supervise. And which process should go first, because when agents arrive by tile rather than by roadmap, sequencing happens by accident. That is the decision we set out how to approach in what to automate first.
Finance and Operations Is Still a Project
Everything above describes Business Central. On Dynamics 365 Finance the picture inverts, and the two are not interchangeable — a proposal that treats them as one product is worth a second read.
Agent management there does not exist until someone turns it on, and it is not one switch. The finance and operations administrator enables the Immersive Home feature in the Feature management workspace, which changes the home experience for every user in the environment and is therefore a change-management item rather than a quiet toggle. Alongside it, Microsoft’s prerequisites are:
- version 10.0.44 or later, with all pending Lifecycle Services updates installed — noting that Microsoft froze new LCS project creation in February 2026 and is migrating environment management to the Power Platform admin center;
- a linked Dataverse environment with the Copilot for finance and operations apps solution installed at a minimum version;
- the Copilot feature flag enabled in the Power Platform admin center, and billing enabled with credits assigned.
The first belongs to the ERP administrator; the rest belong to Power Platform administration. Two personas, often reporting to different people.
The Account Reconciliation Agent goes further. It remains in production-ready preview, currently handles two exception types rather than reconciliation in general, renders its suggested-action summaries only in US English, and at the time of writing Microsoft activates it manually in response to a request form linked from the setup documentation. That is a snapshot with a short shelf life: the 2026 release wave 1 plan lists general availability for the enhanced agent in September 2026, with autonomous exception classification and bulk actions alongside it. On this front the gap is narrowing from the Finance side, not widening.
One control gap is worth naming while it lasts. Microsoft’s agent management documentation states plainly that “there’s no direct UI-based administrative override for individual user actions”; administrators monitor agent activity through batch jobs and cancel it by deleting the associated jobs. Business Central is ahead here — since April 2026 it carries a Stop all active tasks action on the agent itself. If reconciliation is a key control in your environment, that difference is a question you will eventually be asked.
None of which makes the gated model worse. For a regulated, multi-entity finance function, a deployment that cannot happen without two administrators agreeing is arguably the safer design. It is simply not the one that arrives by itself.
“No Program” Is Not the Same as “No Work”
Even on the Business Central side the frictionless story has edges. Turning a capability on at environment level from the Copilot & agent capabilities page requires SUPER or an equivalent administrator role — Microsoft notes there are not yet granular, object-level permissions for Copilot configuration — though an administrator can delegate the per-agent Can configure setting to a finance lead, which is usually the right answer. Beyond the trial, paying for agent actions means a pay-as-you-go billing policy against an Azure subscription, and separately a one-to-one link between the Business Central environment and a Power Platform environment in the same Azure geography; once linked, the Business Central environment cannot be deleted. Payables Agent in full mode also needs a Microsoft 365 mailbox with Read and manage (Full Access) granted — an Exchange action finance cannot perform and Business Central cannot delegate, and in our experience the most common reason a go-live date slips.
Multi-entity groups have more to think about than most realise. Agents are configured and permissioned per company, and Microsoft’s documented pattern for a group is one shared mailbox with rules routing invoices into company-specific subfolders, one agent per subfolder. Two related details: every PDF the agent picks up becomes an Inbound E-Documents record, so the agent lands inside the e-invoicing framework wherever that is configured; and because agents draft against the base purchase document, heavy customisation or an ISV that adds mandatory fields is what breaks agent drafts in practice.
Then the question that arrives first in the room and usually last in the article: where the data goes. Microsoft’s answer is more specific than most people expect. Prompts and responses are retained for 20 days and stored alongside your Business Central company data inside the same geographic and compliance boundary. The catch is upstream — Azure OpenAI Service is not available in every Business Central geography, and where it is not, an administrator must allow data movement across geographies. Since update 25.0, that setting is on by default. Find out which side of that line your environment sits on before the first invoice, not after.
And the mid-market’s own stated obstacle is not enablement at all. Among RSM respondents whose pilots delivered only moderate or limited success, the top barrier to scaling is data quality at 53 per cent, ahead of integration at 47 per cent. An agent whose job is vendor matching and line suggestion inherits every weakness in your master data, which is the argument we made in why integration comes before intelligence.
The Case for Doing Nothing
There is a reasonable opposing position, and it deserves stating properly rather than being waved at. Microsoft has engineered a good deal of the governance in already. Payables Agent produces drafts and posts nothing. The permission intersection rule means a scheduled task cannot exceed the person who scheduled it. The default permission set is system-managed and read-only. A human approves every document before it reaches the ledger. On that reading, a controller could conclude the existing approval control already covers the risk, and that adding ceremony to a smart mail parser is overreach.
The answer is volume and attention. Approval controls degrade predictably when the number of things to approve rises and each one arrives pre-filled with a plausible answer. The failure mode is not an agent posting something it should not have. It is a reviewer approving fifty drafts in the time they used to spend on five, and the control quietly becoming a formality while every log still records that it operated. Nothing in the product addresses that, and it is the reason the decisions below are worth half a day.
The Meter Is a Process, Not a Line Item
Agent actions consume Copilot Credits, listed at $0.01 each on the pay-as-you-go meter, with Copilot Credit packs at $200 per tenant per month for 25,000 credits (US list pricing as published in August 2026; a separate one-year pre-purchase plan offers tiered discounts at unpublished rates). Credits sit on top of the Business Central licence, not inside it. Payables Agent consumes 50 credits per invoice plus 5 per line, so Microsoft’s worked example of 100 invoices a month at three lines each comes to 6,500 credits — roughly $65 by our own calculation at list, before discount or tax.
The cost is not the risk. The behaviour at exhaustion is. For the mailbox-driven agents — Microsoft documents this explicitly for Sales Order Agent — the agent stops processing when credits run out but stays active, and on renewal picks up all the unread mail that accumulated meanwhile, which can consume a great deal of credit quickly. Microsoft’s guidance is to deactivate the agent before credits run out and to clear or archive stale email before reactivating.
That is a small operational discipline. It is also exactly the kind of thing a project would have assigned to somebody by name.
Putting the Decisions Back Without Building a Program
None of this argues for switching agents off. It argues for putting back, deliberately, the decisions the project used to force.
- Inventory what is already on. The Copilot & agent capabilities page lists every feature and whether it is active. Read it before someone else tells you what it says.
- Use the preview window, and know what it is. Major updates in April and October can be previewed in a sandbox from the month before; minor monthly updates cannot — they give you a reschedulable window, not a preview. The gate is twice a year, not twelve times. And disable job queues, outgoing email and integrations in the sandbox copy first, or a Sales Order Agent in your test environment will reply to real customers from a real mailbox.
- Name an owner for each active agent, including the credit meter, and write the name down.
- Delegate configuration properly, using the per-agent Can configure setting so day-to-day ownership sits with finance rather than with whoever holds SUPER.
- Define what review means for each agent, confirm the trace is enough for your controls before a period closes on it, and agree what happens to unapproved drafts if the agent is deactivated.
- Decide the exception path — what happens when the agent is wrong, who detects it, who corrects it, how quickly.
- Re-test segregation of duties, which has a new shape. The agent is a user, so ask four questions rather than one. Does its permission set combine things you would never combine in a person, such as vendor master maintenance and invoice creation? Is whoever configures the agent also an approver of its output? Who can amend that permission set, and is the change logged? And who holds the SUPER right that can quietly alter any of the above?
- Set a standing review date. Capability that ships monthly needs a recurring agenda item, not a one-off assessment.
Six of those eight are an afternoon. Two — what review means, and where segregation of duties now sits — are a real conversation with your auditor. That is still not a transformation program. It is a quarter’s agenda item with a named owner, which is precisely the thing monthly delivery quietly removed.
The organisations that handle this well over the next year will not be the ones with the most capable agents. They will be the ones that noticed the project was missing and put back the two or three decisions that actually mattered. DAX Software Solutions works with mid-market finance teams on exactly that conversation — short, cheap to have now, and expensive to reconstruct after a period closes. We have also written about where the close actually stalls, which is usually the process an agent is brought in to shorten.
Scope and caveat. Product capability, preview status, availability and pricing described here reflect Microsoft’s published documentation as at 18 August 2026 and change frequently; confirm the current position for your region, version and licensing before acting. Prices quoted are US list. This article describes general practice and is not audit, accounting, tax or legal advice. Requirements differ by jurisdiction, regulatory regime, auditor and entity — confirm treatment with your own auditors and qualified advisers.
If an agent is already running somewhere in your finance function and nobody has been named to own it, that is the conversation worth having first. Get in touch.