How to use ChatGPT with Dynamics 365 Finance and Supply Chain
Short answer
There are three routes: paste or upload exports for one-off analysis, build a custom GPT or app whose actions call a thin API in front of FSCM, or run a private model for sensitive data. The right choice depends on how live the answers must be and what your data policy allows to leave the tenant.
People in FSCM environments are already using ChatGPT, often quietly. A planner exports an on-hand inventory grid to Excel, pastes it into a chat and asks which items look overstocked. It works, and it is also an uncontrolled data transfer of item costs, vendor names and customer orders.
The better pattern gives ChatGPT a defined, narrow window onto the ERP: an API with a handful of operations, authenticated per user, with an audit trail. That turns a copy-and-paste habit into a governed capability, and it makes answers current instead of a day-old spreadsheet.
Not every FSCM customer should connect a hosted model to production data. If your records carry export-controlled technical data, customer-restricted information or defence supply chain detail, a private model may be the more defensible architecture. This page covers both sides honestly.
What teams use it for
Explain a variance in plain language
A controller exports a cost variance report and asks why standard versus actual moved for a product family, getting a narrative to edit rather than starting from blank.
Draft supplier communications
Using a PO line export, a buyer asks for a polite escalation email to a vendor with three late lines, written in the buyer's tone.
Custom GPT for order status
Sales support asks a custom GPT for the status of a sales order, which calls a small API that reads the sales order header, lines and shipment status.
Analyse a data management export
A data analyst uploads a DMF export of released products and asks which have missing default order settings or inconsistent units of measure.
Write X++ or OData query help
A developer asks for an OData filter or a data entity extension sketch, with no ERP data shared at all, only the question.
Microsoft Dynamics 365 Finance and Supply Chain integration surface
- Exports from grids to Excel and from the data management workspace as packages or files, the lowest-friction route and also the one with the least control.
- OData v4 data entities under the environment /data endpoint, which an API wrapper can expose as a small set of read operations for a custom GPT action.
- Custom X++ services under the /api/services path when an action should run business logic rather than read raw rows.
- Microsoft Entra ID OAuth for service-to-service access; user-delegated flows need care because a GPT action calls from the provider's servers, not from your network.
- Power Automate and custom connectors as an intermediary that can sanitise or limit what is returned before it reaches an external model.
How it works
- 1
Classify the data first
Decide which entities may ever reach a hosted model: item names and generic order status are low risk, cost data, customer pricing and technical data may not be.
- 2
Build a narrow API facade
Put a small service between ChatGPT and FSCM that exposes a few read operations with strict field lists. The model never sees the raw OData surface.
- 3
Describe it with an OpenAPI schema
A custom GPT action needs an OpenAPI description. Keep operation names explicit and parameters typed so the model calls them correctly.
- 4
Authenticate each user
Use OAuth so calls are made as the individual and respect their FSCM roles. A single shared key makes everyone as privileged as the key.
- 5
Apply workspace data controls
Use a business or enterprise ChatGPT plan with its data-usage terms and admin controls, and verify the retention and training settings that apply to your agreement.
- 6
Monitor and review usage
Log action calls at the facade and review them for sensitive fields or unusual volumes.
Example flows
Sales order status GPT
Trigger: A support rep asks, where is order SO-100234?
- The GPT calls the facade operation get_order_status.
- The facade queries sales order lines and shipment data through OData.
- It returns only status, promised date and carrier fields.
- The GPT answers in plain language and flags a line past its confirmed date.
Result: Support gets a live answer without FSCM access and without cost fields leaving the tenant.
Monthly variance narrative
Trigger: The controller wants a first draft of the variance commentary.
- Export the variance grid with sensitive columns removed.
- Upload it to an approved enterprise workspace.
- Ask for the top five drivers and a draft paragraph each.
- The controller verifies against the ledger and edits.
Result: A reviewed commentary in less time, with an export you chose to share.
Keeping data on-prem
A hosted ChatGPT cannot reach an FSCM environment that sits behind your firewall, and for on-premises (local business data) deployments you would have to expose an endpoint, which many security teams will reject. If the data cannot leave your boundary, run an open-weight model such as Llama, Qwen or gpt-oss on your own GPUs with vLLM or Ollama and give it the same facade API. You keep a ChatGPT-like experience, with the model, prompts and extracted rows inside your network. For genuinely mixed policies, use ChatGPT for non-sensitive drafting and the private model for anything touching cost, customer or technical data.
Security checklist
- Treat any export pasted into a consumer chat as a data disclosure; require business or enterprise accounts with admin-managed data terms.
- Limit the facade to explicit fields and rows; do not pass through a generic OData query parameter from the model.
- Authenticate per user with OAuth so FSCM security roles and data area restrictions still apply.
- Strip or mask vendor bank data, personal data and customer pricing before anything reaches an external model.
- Keep an audit log at the facade of who asked what and which fields were returned.
Ways to get it done
Governed exports into an enterprise ChatGPT workspace
Effort: Policy and training work; no engineering.
Good for analysts doing occasional analysis on non-sensitive data, with no integration to build.
Custom GPT or app with actions over an API facade
Effort: A few weeks to build and secure the facade and OpenAPI schema.
Fits live read-only questions such as order and inventory status for a defined group of users.
Private model over the same facade, built with a partner such as Netray
Effort: Pilot on one use case, then widen once accuracy and access controls are verified.
Fits regulated manufacturers who cannot send ERP data to a hosted model but want the same conversational experience.
Pitfalls
- !Letting staff paste costed BOMs or customer price lists into a personal account because no approved route exists.
- !Giving the action a service account with broad read access, so every user effectively sees every legal entity.
- !Trusting numbers the model computes from a partial export; totals and rounding should come from the ERP, not the chat.
- !Forgetting that actions are called from the provider's infrastructure, so your endpoint must be reachable and hardened.
Frequently asked questions
Can ChatGPT connect directly to Dynamics 365 FSCM?
Not out of the box in a way you should rely on. The usual route is a custom GPT or app whose actions call an API you control, which in turn queries FSCM through OData or a custom service. That facade is where you limit fields, enforce authentication and log usage.
Is exporting to Excel and pasting into ChatGPT acceptable?
Only if your policy allows that data in the chosen service. Use a business or enterprise workspace with admin-controlled data terms, remove sensitive columns, and verify any figures against the ERP. Pasting costed or customer-restricted data into a personal account is the common failure.
What about Microsoft Copilot instead?
Copilot in Dynamics 365 runs inside the Microsoft tenant boundary and uses the application's own context, which can be simpler for standard scenarios. ChatGPT makes sense if you already standardise on it or need custom actions. Compare features and data terms for your licensing before choosing.
How do we keep FSCM security roles in force?
Authenticate each user through OAuth so the facade calls FSCM as that person, or map users to least-privilege service roles per group. A single shared credential bypasses role design. Also pass the legal entity explicitly rather than letting the model pick it.
When should we choose a private model?
When data is export-controlled, customer-restricted, or simply not allowed to leave your network, or when the on-premises FSCM deployment cannot be exposed. An open-weight model on your own GPUs behind the same facade gives similar usability with data kept inside your boundary.
More for Microsoft Dynamics 365 Finance and Supply Chain
Want ChatGPT working on your Microsoft Dynamics 365 Finance and Supply Chain?
A free 30 minute assessment: we map the integration path for your version and setup, and where it should run.
Get a free assessment