In mid-market manufacturing, wholesale distribution, and retail, up to 60% of inbound customer support volume boils down to one persistent question: “Where is my order?” (WISMO). While customers wait in phone queues or submit email tickets, support agents manually log into Microsoft Dynamics 365 Business Central, look up sales order headers, check warehouse shipment lines, copy carrier tracking numbers, and type out status updates.
With the advent of Microsoft Copilot Studio (formerly Power Virtual Agents) and generative AI orchestration, enterprises can now replace static, rule-based chatbot decision trees with autonomous, context-aware AI support agents. By connecting Copilot Studio directly to Business Central using Power Automate cloud flows and secure OData APIs, your support agent can interpret complex customer natural language inquiries, authenticate the requestor, retrieve live ledger and shipment tracking records, and render interactive Adaptive Cards in under 8 seconds.
In this architectural guide, our Power Platform Engineering Practice details the end-to-end blueprint for configuring, securing, and deploying an autonomous order lookup agent in Copilot Studio connected to Business Central SaaS.
1. The Copilot Studio + Business Central Agent Architecture
A common misconception is that AI agents in Copilot Studio merely search static knowledge base documents or PDF manuals. In enterprise ERP scenarios, an agent must take autonomous actions against living relational databases.
The end-to-end integration architecture operates across five tightly orchestrated layers:
- Omnichannel Channel Layer: The customer interacts through your website live chat widget, Power Pages B2B customer portal, Microsoft Teams, or WhatsApp.
- Copilot Studio Generative Orchestrator: The AI model evaluates user intent, identifies required parameters (e.g., Sales Order Number, Customer Email, Billing ZIP), and prompts for missing variables conversationally without rigid scripting.
- Integration Middleware (Power Automate Flow): An automated cloud flow receives inputs from Copilot Studio, authenticates against Entra ID, executes security authorization checks, and queries Business Central APIs.
-
ERP Core (Business Central OData / Custom API Page): Business Central processes the authenticated API query, reads
Sales Header,Sales Line, orPosted Sales Shipmentrecords, and returns structured JSON payloads. - Adaptive Card UI Rendering: Copilot Studio formats the JSON response into a rich, branded Adaptive Card displaying tracking numbers, line items, and delivery status pills directly in the chat stream.
Never allow an AI agent to look up order details solely based on a naked Order Number. Anyone guessing a sequential number (e.g., SO-10042) could view customer addresses and purchase history. Our architecture enforces a dual-key authentication check: the agent requires both the Order Number and the matching Customer Email (or billing ZIP code) registered on the Business Central sales document before releasing any shipment details.
2. Configuring Copilot Studio: Topic Design & Generative Actions
In Microsoft Copilot Studio, create a dedicated custom topic named “Order Status & Shipment Tracking”. While generative AI dynamically routes conversations, configuring structured trigger phrases and entity extraction guarantees high accuracy.
Sample Trigger Phrases
- “Where is my order?”
- “Track package for order SO-10492”
- “Has my shipment left the warehouse yet?”
- “Check status of order 893201”
- “When will my pallet arrive?”
Configuring Entity Extraction
Define two conversational inputs within the topic canvas:
-
OrderNumber: Entity type Pre-built Regex or String. System Prompt: “Please provide your 6-digit order confirmation number (e.g., SO-10293 or 10293).” -
CustomerEmail: Entity type Pre-built Email. System Prompt: “For security verification, what is the email address associated with this order?”
If the customer supplies both in their opening prompt (“Can you track order SO-10492 for sarah@allgrowtech.com?”), Copilot Studio’s slot-filling engine automatically extracts both parameters and proceeds directly to the action node without asking repetitive questions.
3. Building the Power Automate Flow & Business Central Query
To keep the architecture maintainable and secure, add a “Call an action” node in Copilot Studio that connects to a dedicated Power Automate solution flow named BC-Agent-LookupOrderStatus.
Step 1: Flow Trigger & Variable Declaration
The flow begins with the trigger “Run a flow from Copilot” accepting two string inputs: OrderNumber and CustomerEmail.
Step 2: Business Central API Query
Using the official Dynamics 365 Business Central Connector or a direct HTTP with Microsoft Entra ID action, execute an OData filter on the standard salesOrders endpoint:
// OData Filter Expression in Power Automate HTTP Action
GET https://api.businesscentral.dynamics.com/v2.0/{TenantId}/{Environment}/api/v2.0/companies({CompanyId})/salesOrders?$filter=number eq '@{triggerBody()?['OrderNumber']}'&$expand=salesOrderLines
Step 3: Dual-Key Security Validation
Add a Condition control in Power Automate comparing the customer-provided email against the Business Central record:
// Condition Expression
toLower(trim(triggerBody()?['CustomerEmail'])) == toLower(trim(items('Apply_to_each')?['customerEmail']))
If the email matches, proceed to retrieve line item details and carrier tracking URLs. If the email fails to match, return a sanitized error code: {"status": "AUTH_MISMATCH", "message": "The email provided does not match the order records."}.
4. Rich Conversational UX: Rendering Dynamic Adaptive Cards
Plain text responses (“Your order is Shipped with tracking 1Z99999”) look amateurish and frequently lead to follow-up questions. By sending back an Adaptive Card payload, your Copilot agent delivers an executive-grade experience.
Adaptive Card JSON Template
In Copilot Studio, insert an Adaptive Card node with the following dynamic schema:
{
"$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
"type": "AdaptiveCard",
"version": "1.4",
"body": [
{
"type": "TextBlock",
"text": "๐ฆ Order Details: ${OrderNumber}",
"weight": "Bolder",
"size": "Medium",
"color": "Accent"
},
{
"type": "FactSet",
"facts": [
{ "title": "Status:", "value": "${FulfillmentStatus}" },
{ "title": "Order Date:", "value": "${OrderDate}" },
{ "title": "Carrier:", "value": "${ShippingAgentCode}" },
{ "title": "Tracking No:", "value": "${PackageTrackingNo}" }
]
},
{
"type": "TextBlock",
"text": "Items in this shipment: ${SummaryLines}",
"wrap": true,
"size": "Small",
"color": "Dark"
}
],
"actions": [
{
"type": "Action.OpenUrl",
"title": "Track Carrier Package โ",
"url": "${TrackingUrl}"
}
]
}
5. Enterprise Governance, Security & Access Control
Connecting conversational AI to your core financial and operational system of record introduces governance obligations that every IT Director must address:
| Security Domain | Architecture Best Practice | Risk Mitigated |
|---|---|---|
| ERP Permission Sets | Create a dedicated Service Principal in Microsoft Entra ID with a strictly read-only Business Central Permission Set (e.g., D365 READ ONLY on Sales Header/Line). |
Prevents rogue agent updates, accidental record deletion, or prompt injection exploits altering pricing. |
| Anti-Hallucination Constraints | Set the Copilot Studio system instruction: “You are an enterprise support assistant. Only provide order statuses using parameters returned by the BC flow. Never invent dates, items, or tracking numbers.” | Eliminates hallucinated fulfillment dates that compromise customer trust. |
| Rate Limiting & Throttling | Cache frequent lookups in Azure Table Storage or Dataverse for 5 minutes if the same order is polled repeatedly. | Protects Business Central SaaS API tenant limits (600 requests/min). |
| Human Escalation Hand-Off | Implement an escalation node transferring the conversation transcript to a human representative via Dynamics 365 Customer Service Omnichannel or Microsoft Teams. | Ensures edge cases (damaged freight, wrong items delivered) transition gracefully to human specialists. |
6. The 4-Week Production Deployment Roadmap
At Allgrow Technologies, our engineering team deploys Copilot Studio ERP agents using an agile, phased approach that eliminates project risk:
- Week 1: API & Security Audit: Inspect Business Central API endpoints, establish Microsoft Entra Service Principal credentials, and verify customer field indexing for fast lookups.
- Week 2: Power Automate & Dual-Key Validation Flow: Build, test, and exception-harden the cloud flows handling document retrieval, carrier tracking synthesis, and authentication checks.
- Week 3: Copilot Studio Topic & Adaptive Card Engineering: Configure intent recognition, slot filling, branded Adaptive Card UI rendering, and fallback escalation channels.
- Week 4: User Acceptance Testing (UAT) & Channel Launch: Deploy into your website live chat, B2B customer portal, or internal Teams channels with live telemetry logging in Azure Application Insights.
Ready to Deploy an Autonomous AI Support Agent for Business Central?
Allgrow Technologies architects and builds production-grade Copilot Studio agents, Power Automate enterprise workflows, and custom Business Central integrations. Reduce support overhead by up to 70% while giving your customers instant, 24/7 self-service.
Frequently Asked Questions
Sell-to E-Mail or Bill-to Post Code stored on the Business Central document. If it does not match, the query is rejected without disclosing any information.
