Applied AI & Cloud ERP Architecture

Deploying an AI Support Agent in Microsoft Copilot Studio with Real-Time Business Central Order Lookups

In mid-market manufacturing, wholesale distribution, and retail, up to 60% of inbound customer support volume boils down to one persistent question: “Where is my order?” (WISMO). While customers wait in phone queues or submit email tickets, support agents manually log into Microsoft Dynamics 365 Business Central, look up sales order headers, check warehouse shipment lines, copy carrier tracking numbers, and type out status updates.

Microsoft Copilot Studio Generative AI agent interacting with ERP data architecture
Figure 1: Microsoft Copilot Studio generative agent conversational runtime connected to Dynamics 365 Business Central via Power Platform connectors.

With the advent of Microsoft Copilot Studio (formerly Power Virtual Agents) and generative AI orchestration, enterprises can now replace static, rule-based chatbot decision trees with autonomous, context-aware AI support agents. By connecting Copilot Studio directly to Business Central using Power Automate cloud flows and secure OData APIs, your support agent can interpret complex customer natural language inquiries, authenticate the requestor, retrieve live ledger and shipment tracking records, and render interactive Adaptive Cards in under 8 seconds.

68%
Tier-1 WISMO Ticket Deflection
< 8s
Average Resolution Latency
100%
Data Security & Email Verification
24/7
Omnichannel Autonomous Support

In this architectural guide, our Power Platform Engineering Practice details the end-to-end blueprint for configuring, securing, and deploying an autonomous order lookup agent in Copilot Studio connected to Business Central SaaS.

1. The Copilot Studio + Business Central Agent Architecture

A common misconception is that AI agents in Copilot Studio merely search static knowledge base documents or PDF manuals. In enterprise ERP scenarios, an agent must take autonomous actions against living relational databases.

The end-to-end integration architecture operates across five tightly orchestrated layers:

  1. Omnichannel Channel Layer: The customer interacts through your website live chat widget, Power Pages B2B customer portal, Microsoft Teams, or WhatsApp.
  2. Copilot Studio Generative Orchestrator: The AI model evaluates user intent, identifies required parameters (e.g., Sales Order Number, Customer Email, Billing ZIP), and prompts for missing variables conversationally without rigid scripting.
  3. Integration Middleware (Power Automate Flow): An automated cloud flow receives inputs from Copilot Studio, authenticates against Entra ID, executes security authorization checks, and queries Business Central APIs.
  4. ERP Core (Business Central OData / Custom API Page): Business Central processes the authenticated API query, reads Sales Header, Sales Line, or Posted Sales Shipment records, and returns structured JSON payloads.
  5. Adaptive Card UI Rendering: Copilot Studio formats the JSON response into a rich, branded Adaptive Card displaying tracking numbers, line items, and delivery status pills directly in the chat stream.
๐Ÿ”’ Enterprise Security Principle: Identity Verification Before Data Disclosure

Never allow an AI agent to look up order details solely based on a naked Order Number. Anyone guessing a sequential number (e.g., SO-10042) could view customer addresses and purchase history. Our architecture enforces a dual-key authentication check: the agent requires both the Order Number and the matching Customer Email (or billing ZIP code) registered on the Business Central sales document before releasing any shipment details.

Power Automate Cloud Flow querying Business Central APIs and returning JSON to Copilot Studio
Figure 2: Power Automate flow architecture bridging Copilot Studio natural language variables with Business Central OData REST queries.

2. Configuring Copilot Studio: Topic Design & Generative Actions

In Microsoft Copilot Studio, create a dedicated custom topic named “Order Status & Shipment Tracking”. While generative AI dynamically routes conversations, configuring structured trigger phrases and entity extraction guarantees high accuracy.

Sample Trigger Phrases

  • “Where is my order?”
  • “Track package for order SO-10492”
  • “Has my shipment left the warehouse yet?”
  • “Check status of order 893201”
  • “When will my pallet arrive?”

Configuring Entity Extraction

Define two conversational inputs within the topic canvas:

  • OrderNumber: Entity type Pre-built Regex or String. System Prompt: “Please provide your 6-digit order confirmation number (e.g., SO-10293 or 10293).”
  • CustomerEmail: Entity type Pre-built Email. System Prompt: “For security verification, what is the email address associated with this order?”

If the customer supplies both in their opening prompt (“Can you track order SO-10492 for sarah@allgrowtech.com?”), Copilot Studio’s slot-filling engine automatically extracts both parameters and proceeds directly to the action node without asking repetitive questions.

3. Building the Power Automate Flow & Business Central Query

To keep the architecture maintainable and secure, add a “Call an action” node in Copilot Studio that connects to a dedicated Power Automate solution flow named BC-Agent-LookupOrderStatus.

Step 1: Flow Trigger & Variable Declaration

The flow begins with the trigger “Run a flow from Copilot” accepting two string inputs: OrderNumber and CustomerEmail.

Step 2: Business Central API Query

Using the official Dynamics 365 Business Central Connector or a direct HTTP with Microsoft Entra ID action, execute an OData filter on the standard salesOrders endpoint:

// OData Filter Expression in Power Automate HTTP Action
GET https://api.businesscentral.dynamics.com/v2.0/{TenantId}/{Environment}/api/v2.0/companies({CompanyId})/salesOrders?$filter=number eq '@{triggerBody()?['OrderNumber']}'&$expand=salesOrderLines

Step 3: Dual-Key Security Validation

Add a Condition control in Power Automate comparing the customer-provided email against the Business Central record:

// Condition Expression
toLower(trim(triggerBody()?['CustomerEmail'])) == toLower(trim(items('Apply_to_each')?['customerEmail']))

If the email matches, proceed to retrieve line item details and carrier tracking URLs. If the email fails to match, return a sanitized error code: {"status": "AUTH_MISMATCH", "message": "The email provided does not match the order records."}.

4. Rich Conversational UX: Rendering Dynamic Adaptive Cards

Plain text responses (“Your order is Shipped with tracking 1Z99999”) look amateurish and frequently lead to follow-up questions. By sending back an Adaptive Card payload, your Copilot agent delivers an executive-grade experience.

Interactive Adaptive Card displayed in Copilot Studio showing order status, items, and tracking link
Figure 3: Branded Adaptive Card returned to the customer with real-time fulfillment status, warehouse line items, and carrier deep links.

Adaptive Card JSON Template

In Copilot Studio, insert an Adaptive Card node with the following dynamic schema:

{
  "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
  "type": "AdaptiveCard",
  "version": "1.4",
  "body": [
    {
      "type": "TextBlock",
      "text": "๐Ÿ“ฆ Order Details: ${OrderNumber}",
      "weight": "Bolder",
      "size": "Medium",
      "color": "Accent"
    },
    {
      "type": "FactSet",
      "facts": [
        { "title": "Status:", "value": "${FulfillmentStatus}" },
        { "title": "Order Date:", "value": "${OrderDate}" },
        { "title": "Carrier:", "value": "${ShippingAgentCode}" },
        { "title": "Tracking No:", "value": "${PackageTrackingNo}" }
      ]
    },
    {
      "type": "TextBlock",
      "text": "Items in this shipment: ${SummaryLines}",
      "wrap": true,
      "size": "Small",
      "color": "Dark"
    }
  ],
  "actions": [
    {
      "type": "Action.OpenUrl",
      "title": "Track Carrier Package โ†’",
      "url": "${TrackingUrl}"
    }
  ]
}

5. Enterprise Governance, Security & Access Control

Connecting conversational AI to your core financial and operational system of record introduces governance obligations that every IT Director must address:

Security Domain Architecture Best Practice Risk Mitigated
ERP Permission Sets Create a dedicated Service Principal in Microsoft Entra ID with a strictly read-only Business Central Permission Set (e.g., D365 READ ONLY on Sales Header/Line). Prevents rogue agent updates, accidental record deletion, or prompt injection exploits altering pricing.
Anti-Hallucination Constraints Set the Copilot Studio system instruction: “You are an enterprise support assistant. Only provide order statuses using parameters returned by the BC flow. Never invent dates, items, or tracking numbers.” Eliminates hallucinated fulfillment dates that compromise customer trust.
Rate Limiting & Throttling Cache frequent lookups in Azure Table Storage or Dataverse for 5 minutes if the same order is polled repeatedly. Protects Business Central SaaS API tenant limits (600 requests/min).
Human Escalation Hand-Off Implement an escalation node transferring the conversation transcript to a human representative via Dynamics 365 Customer Service Omnichannel or Microsoft Teams. Ensures edge cases (damaged freight, wrong items delivered) transition gracefully to human specialists.

6. The 4-Week Production Deployment Roadmap

At Allgrow Technologies, our engineering team deploys Copilot Studio ERP agents using an agile, phased approach that eliminates project risk:

  • Week 1: API & Security Audit: Inspect Business Central API endpoints, establish Microsoft Entra Service Principal credentials, and verify customer field indexing for fast lookups.
  • Week 2: Power Automate & Dual-Key Validation Flow: Build, test, and exception-harden the cloud flows handling document retrieval, carrier tracking synthesis, and authentication checks.
  • Week 3: Copilot Studio Topic & Adaptive Card Engineering: Configure intent recognition, slot filling, branded Adaptive Card UI rendering, and fallback escalation channels.
  • Week 4: User Acceptance Testing (UAT) & Channel Launch: Deploy into your website live chat, B2B customer portal, or internal Teams channels with live telemetry logging in Azure Application Insights.
๐Ÿš€ Applied AI & Power Platform Engineering Practice

Ready to Deploy an Autonomous AI Support Agent for Business Central?

Allgrow Technologies architects and builds production-grade Copilot Studio agents, Power Automate enterprise workflows, and custom Business Central integrations. Reduce support overhead by up to 70% while giving your customers instant, 24/7 self-service.

Frequently Asked Questions

Can Copilot Studio access on-premises Dynamics NAV or Business Central on-prem?
Yes. While Business Central SaaS connects seamlessly via cloud APIs, on-premises Dynamics NAV or Business Central environments can connect to Copilot Studio using an On-Premises Data Gateway paired with Power Automate, or via an Azure API Management gateway exposing secure REST endpoints.
How do we prevent customers from viewing another company's order information?
We enforce a dual-key authentication check inside the Power Automate middleware. Before returning any sales data, the flow verifies that the customer-supplied email address or billing postal code exactly matches the Sell-to E-Mail or Bill-to Post Code stored on the Business Central document. If it does not match, the query is rejected without disclosing any information.
What Microsoft licensing is required to run Copilot Studio with Business Central?
You need a Microsoft Copilot Studio tenant license (or Microsoft 365 Copilot with Studio access) and standard Power Automate / Business Central API access. External customers interacting through web chat widgets or Power Pages portals do not require individual Business Central user licenses; requests execute securely under a single registered Service Principal API user.
Can the AI agent handle complex tasks like return merchandise authorizations (RMA)?
Yes. Beyond read-only lookups, Copilot Studio flows can initiate Sales Return Orders, generate prepaid return shipping labels via carrier API connectors (FedEx/UPS), and update Business Central return document queues subject to manager approvals via Teams Adaptive Cards.