VANGELDER SOLUTIONS MCP Guard · Help NederlandsFrançais Product

docs.vangeldersolutions.be/mcp-guard/troubleshoot-rules-licences

Troubleshoot Rules and Licences

This article covers the messages that the MCP Guard extension shows in Microsoft Dynamics 365 Business Central when you make a rule on the MCP Guard User Settings page, when a rule grants too little, when a user switched the AI assistant off in a sandbox, and when a licence is missing. Each heading is the message as the user sees it. The words in italics stand for a value that differs per case.

Choose the user this setting applies to.

Cause: The line has User in the Applies To field, and the User Name field is empty.

Solution: Fill in User Name, or choose Security Group in the Applies To field.

Choose the security group this setting applies to.

Cause: The line has Security Group in the Applies To field, and the Security Group Code field is empty.

Solution: Fill in Security Group Code, or choose User in the Applies To field.

User name does not exist in this environment.

Cause: The value in the User Name field is not the user name of a user in this environment.

Solution: Choose the user from the lookup in the User Name field. The lookup shows the enabled users.

Security group code does not exist in this environment.

Cause: The value in the Security Group Code field is not a security group in this environment.

Solution: Choose the group from the lookup in the Security Group Code field. A group that is missing from the lookup is not a security group in this environment.

Company name does not exist in this environment.

Cause: One of the names in the Allowed Companies field is not a company in this environment. Rules are per environment, so a company of another environment is not known here.

Solution: Choose the assist button in the Allowed Companies field and select the companies on the Select Companies page.

MCP server configuration name does not exist in this environment.

Cause: The name in the MCP Configuration field is not an MCP configuration in this environment.

Solution:

  1. Choose the value in the MCP Configuration field to open the list of MCP configurations.
  2. Check the exact name of the configuration, or create it.
  3. Enter that name in the MCP Configuration field.

Field cannot be negative. Use 0 for no limit.

For example:

Daily Call Limit cannot be negative. Use 0 for no limit.

Cause: A negative number was entered in the Daily Call Limit or Daily Change Limit field.

Solution: Enter 0 or a positive number. 0 means no limit. See Daily Limits.

The User Permission Set column shows Not found

Cause: No permission set assigned to the user includes MCP GUARD - USER. Without it the user cannot read their rule, and the BC MCP Pro connector refuses the connection. The column does not check permission sets that come through a security group, so Not found can also mean that the user gets the set through a group.

Solution: Assign MCP GUARD - USER to the user, or check that a security group of the user grants it. See Permission Sets.

Your MCP Guard rule gives you level access to module, and this needs level. Ask your administrator to change the rule on the MCP Guard User Settings page.

For example:

Your MCP Guard rule gives you Read access to Production, and this needs Modify. Ask your administrator to change the rule on the MCP Guard User Settings page.

Cause: The user tried to create, change, delete, run an action or post through one of the extension's API pages, and the access level on the user's rule is lower than the operation needs. A user without a rule has Read. A user whose rule comes from a security group also has Read when the group membership could not be read from Microsoft Entra ID.

Solution:

  1. Open the MCP Guard User Settings page.
  2. Find the line for the user, or the line for the user's security group.
  3. Raise Production Access, Planning Access, Assembly Access or Project Access to the level the message names. See Access Levels per Module.

Managing MCP Guard settings requires a MCP Guard licence. Ask your administrator to assign you one in the Microsoft 365 admin center.

Cause: You tried to add, change or delete a rule, and no MCP Guard licence is assigned to you. The permission set MCP GUARD - ADMIN alone is not enough.

Solution: Ask an administrator to assign you an MCP Guard licence in the Microsoft 365 admin center. See Assign Licences.

No MCP Guard licence is assigned to you. In a production environment every user of MCP Guard needs one.

Cause: The user connects to a production environment without an MCP Guard licence.

Solution: Assign a licence to the user in the Microsoft 365 admin center. See Assign Licences.

No MCP Guard rule applies to you in this sandbox environment. Ask an administrator with a MCP Guard licence to add a rule for you.

Cause: The user has no MCP Guard licence and connects to a sandbox environment. Without a licence, a sandbox environment is only open to users that a rule applies to.

Solution: An administrator with an MCP Guard licence adds a line for the user, or for a security group the user is a member of, on the MCP Guard User Settings page. As an alternative, assign a licence to the user.

No MCP Guard rule applies to you in this sandbox environment right now: you switched off the AI assistant for yourself here. Switch it on again on the page My MCP Guard in this environment.

Cause: The user turned off AI Assistant in This Sandbox on the My MCP Guard page in this sandbox environment. The extension then answers as if no rule applies, so the BC MCP Pro connector leaves the sandbox out.

Solution: When the user wants the sandbox back, the user opens My MCP Guard in this sandbox environment and turns AI Assistant in This Sandbox on. The sandbox is back for the AI assistant within ten minutes. An administrator sees the switch in the Switched Off by User column, but cannot change it. See Switch the AI Assistant On or Off in a Sandbox.

The switch only works in a sandbox environment.

Cause: The switch on the My MCP Guard page was changed in a production environment. A production environment ignores the switch.

Solution: None needed. Change the switch in the sandbox environment itself.

Your license does not grant you the following permissions on Page number name: Execute.

Cause: This is a message of Business Central itself. The user called one of the extension's API pages without an MCP Guard licence.

Solution: Assign an MCP Guard licence to the user. See Assign Licences.