MCP security model
How Plur-e MCP servers handle identity, scopes, approvals, audit and data — per-user Entra ID sessions, read/write scopes per role, approval for writes, full logging, no training on customer data.
Quick answer
Every tool call runs under the signed-in user (Microsoft Entra ID), so Business
Central and Dataverse permissions apply unchanged. Tools carry a read or write scope
enabled per role; write tools can require an explicit approval. All calls are logged.
Customer data is not used to train models.
Identity
- Users sign in with Microsoft Entra ID (the same app registration as the Admin Center). Only accounts that already exist as users of the tenant in the Admin Center can connect; the server never creates users.
- The tenant is resolved from the token — a tenant user's Entra tenant must match the Plur-e customer — never from a tool argument. Plur-e staff and partners pick the tenant with
select_tenant. - The server calls Business Central with Plur-e's application credentials, limited to the one environment and company the tenant administrator configured in the Admin Center (AI & MCP → Scopes). On-premise environments are excluded unless the administrator opts in.
- Per-user delegated access (Business Central seeing the real user) is on the roadmap.
Scopes and approvals
| Scope | Examples | Default |
|---|---|---|
| read | search_customers, get_availability | Read for every role unless the administrator sets None |
| write | create_sales_quote, create_sales_order | None; granted per role (admin, partner, sa) or per user |
Write tools additionally follow the tenant's write policy: administrator approval (the call is parked and runs once approved in AI & MCP → Approvals, or expires after 24 hours), or, when the administrator allows it and the client supports it, a confirmation prompt to the user (MCP elicitation).
Audit
Each call logs user, tool, arguments (secrets redacted), result summary, duration and outcome. Logs are available to the customer's administrators.
Data handling
- Data flows from the MCP server to the client (Claude) only for the current request.
- Anthropic does not train on API data by default.
To be validated
Log retention period and the list of subprocessors are being confirmed for the published server.
Related: Site security · Product page
Last updated on
Edit on GitHubDocs MCP
A public, read-only Model Context Protocol server over the Plur-e documentation with search_docs, get_page and list_sections. Live at plur-e.com/api/mcp/docs.
Connect Claude
How to connect Claude Desktop, Claude Code, claude.ai and custom agents to a Plur-e MCP server (remote MCP over Streamable HTTP).