VANGELDER SOLUTIONS MCP Guard · Help NederlandsFrançais Product

docs.vangeldersolutions.be/mcp-guard/install

Install the MCP Guard Extension

You install the MCP Guard extension from Microsoft Marketplace into each Microsoft Dynamics 365 Business Central environment where users work with an AI assistant. After the installation you assign licences and permission sets, and you add the API pages of the extension to an MCP configuration. When that is done, an administrator can make rules and an MCP client can read them.

Prerequisites

  • Business Central online, 2026 release wave 1 (version 28) or later.
  • The MCP server feature of Business Central is enabled in the environment.
  • MCP Guard licences for the users, bought through Microsoft Marketplace.
  • Rights to install extensions in Business Central and to assign licences in the Microsoft 365 admin center.

Install the app

  1. In Business Central, choose the search icon (Tell Me), enter Extension Marketplace, and then choose the related link.
  2. Search for MCP Guard by Vangelder Solutions and install it.
  3. Repeat this in every environment users should reach. The extension and its rules live in the environment, so an environment without the extension has no rules.

Give users access

  1. Assign a licence to each user in the Microsoft 365 admin center. See Assign Licences.
  2. In Business Central, assign the permission set MCP GUARD - USER to every user who works through an AI assistant.
  3. Assign MCP GUARD - ADMIN to the people who manage the rules.

MCP GUARD - USER also gives access to the production, planning, assembly and project API pages. What a user may do there is the access level of the user's rule, not a separate permission set. Neither permission set grants anything on business data. See Permission Sets for what each set contains.

Add the API pages to an MCP configuration

An MCP client only sees the API pages that the MCP configuration exposes.

  1. Choose the search icon (Tell Me), enter MCP Server Configurations, and then choose the related link.
  2. Open the configuration that users get.
  3. Add the page MCP Guard Eff. Permissions (73633175) with Allow Read turned on. As an alternative, turn on Discover Additional Objects for dynamic tool mode.
  4. Add the production, planning, assembly and project API pages that you want to offer. See MCP Configurations for the options per page.

Make the first rule

  1. Choose the search icon (Tell Me), enter MCP Guard User Settings, and then choose the related link.
  2. Add a line for a user or a security group. See Set Up Rules per User and Security Group.

A user without a rule gets every company they have permissions in, the default MCP configuration of the environment, and the access level Read for every module. A new rule starts at Read for every module and for General Access. Raise the levels on your own rule first. See General Access.

The MCP Guard Administration page brings the administrator's pages together. See The MCP Guard Administration Page.

Usage retention

When the extension is installed or upgraded, it adds a retention policy of one year for the usage lines in every company. See Usage per User.

Verify the setup

Sign in as a user with the permission set MCP GUARD - USER and connect through the MCP client. With the BC MCP Pro connector, the connection opens in the company and with the MCP configuration that the user's rule names. If the connection fails, the message names the reason. See Troubleshoot the BC MCP Pro Connector.