Watch first Your browser does not support embedded video. Download the video instead. Twenty seconds: what the agent does, and why per-user CRM security is the part that is actually hard. 01Summary A Houston-based cybersecurity firm wanted their sales team to ask plain-language questions about CRM data, “how many active leads do we have”, “summarise this account’s open opportunities”, without opening Dynamics 365 and building a view for every question. We built it as an Azure AI Foundry agent connected to Microsoft Dataverse over the Model Context Protocol (MCP). No custom data layer, no synchronised copy of CRM, no bespoke API surface. Dataverse itself is the MCP server, and Foundry’s Agent Service calls it as a tool. The agent runs on GPT-4.1 and took an afternoon to wire up. The two things that actually cost time were an OAuth redirect URL that Foundry generates after you click Connect, and an architecture decision we got wrong the first time: the tenant your agent lives in decides whether per-user CRM security is achievable at all. 02In This Blog A practitioner walkthrough of connecting Foundry to Dynamics 365 over MCP, written around the two failures that cost us the most time rather than the happy path alone. The Scenario: A sales team that wanted answers from CRM without building a view for every question. The Approach: Use Dataverse as a first-party MCP server rather than building an API layer and hand-written function schemas. The Action: Environment enablement, an Entra app registration, the MCP tool with OAuth identity passthrough, and the redirect URL nobody warns you about. The Outcome: Per-user security enforced by Dataverse itself, with no parallel permission model to maintain. The connection is an afternoon. The question of whose identity the agent is acting as decides whether any of it survives contact with production. Table of Contents 01Summary→ 02In This Blog→ 03Why MCP Changes the Shape of This Problem→ 04Enable the MCP Server and Allow Your Client→ 05Register the Entra App→ 06Add the MCP Tool to the Agent→ 07Close the Redirect URL Loop→ 08Consent, and the Consent Loop→ 09Calling the Agent From Your Own Application→ 10The Tenancy Trap→ 11Licensing→ 12Impact→ 13Conclusion→ 14FAQ→ 15Get in Touch→ 03Why MCP Changes the Shape of This Problem Before MCP, connecting an LLM to Dynamics 365 meant building glue: an API layer, a set of hand-written function definitions describing each operation, schema documentation maintained by hand, and a deployment to own forever. Every new table meant another function. The Model Context Protocol replaces that with a contract. The server advertises its tools, the model discovers them at runtime, and the plumbing is the same whichever client connects. Microsoft ships Dataverse as a first-party MCP server, so the glue layer is simply gone. Dataverse MCP endpointurl https://{organisation}.crm{n}.dynamics.com/api/mcp A preview endpoint exists at /api/mcp_preview with additional tools, gated behind a separate environment setting. Check your region number Environment URLs are not always .crm. Ours has been .crm4 on other engagements, and pointing at the wrong host produces an authentication failure that looks like a permissions problem. Confirm it in Power Apps under Settings, Session details. The tool surface Tool What it does search Searches table schemas and business skills by keyword search_data Searches structured and unstructured data describe Returns details for tables, records, schemas, skills and apps read_query Runs supported Dataverse SQL SELECT queries create_record Inserts a row, returns the Gcfb-mcp7fd update_record Updates an existing row delete_record Deletes a row, only after explicit user approval create_table, update_table, delete_table Schema operations upsert_skill, delete_skill Manages Dataverse skills and playbooks init_file_upload, commit_file_upload, file_download SAS-based file handling The tool names changed, and older tutorials are wrong describe_table, list_tables and fetch were removed and folded into describe. The tool previously called search, which searched data, is now search_data, and search now searches metadata. If you maintain an allow list or deny list by tool name in your client, this rename silently changes what your agent can do. Review it. 04Step 1: Enable the MCP Server and Allow Your Client This is admin work in the Power Platform admin center, not maker work, and it is where most failed attempts stall. Open the environment settingsPower Platform admin center, then Manage, then Environments. Open the target environment and select Settings on the command bar. Turn on the MCP serverExpand Product, select Features, find Dataverse Model Context Protocol, and enable Allow MCP clients to interact with Dataverse MCP server. Open the allowed client listSelect Advanced Settings. This is where non-Microsoft and custom clients are registered individually. Add your client and enable itCreate an Allowed MCP Client record carrying the Application Id of the app registration you create in Step 2, then set Is Enabled to Yes. Copilot Studio is enabled by default. Nothing else is. Your Foundry agent is not Copilot Studio, so it needs an explicit entry. This is the single most common cause of “the connection succeeded but the agent never calls the tool”. Field Value Name A readable label, for example Foundry Dataverse Agent Unique Name A unique identifier for the record Application Id The client (app) ID of the Entra app registration from Step 2 Is Enabled Yes Figure 1: The Allowed MCP Client record. Is Enabled defaults to No. Is Enabled defaults to No Saving the record is not the same as enabling it. A disabled record behaves identically to no record at all, and produces no error anywhere. Set it to Yes before you save. This is a chicken-and-egg with Step 2: you need the Application Id before you can fill this in. Create the app registration first, then come back. Two constraints worth knowing before you plan the rollout: Managing the MCP server through Advanced connector policies requires the environment to be a Managed Environment. The allow list applies only to the /api/mcp agent entrypoint. MCP-named custom APIs are ordinary Dataverse APIs and are not restricted by this setting. If you want the preview tools, enable Allow MCP clients to interact with Dataverse MCP server (Preview version) as a … Continue reading How We Connected an Azure AI Foundry Agent to Dynamics 365 Using the Dataverse MCP Server for a Texas Industrial Cybersecurity Company →

The Warning Signs Were Always There – Project Risk Engine Summary On most delivery projects, the warning signs appear well before the escalation. They sit in email threads, support case notes, overdue invoice reminders, and resource utilization reports – scattered across systems that nobody has the time to cross-reference every week. By the time a project gets formally marked at risk, it is usually already a difficult conversation. This post shares what we built at CloudFronts to solve that problem from the inside. The Project Risk Engine uses a multi-model AI approach running on Azure Databricks to read unstructured project communication, score project health, and flag projects in RED – all surfaced to project managers inside Microsoft Teams through Databricks Genie, in plain English. We built it for our own PMO first. This article walks through why we built it, how it works, and what it changed. Table of Contents 01 Where This Started 02 Where Project Health Actually Lives 03 What the Risk Engine Does 04 How It Works – Four Layers 05 How a Project Gets Flagged RED 06 Genie in Teams 07 What Changed for the Team 08 Who It Helps 09 How to Implement This 10 Challenges We Faced 11 FAQs 12 Conclusion Where This Started This did not start as a product idea. It started as a recurring frustration inside our own team – the group at CloudFronts responsible for delivery and billing excellence. Three things kept happening. Early warning signs were buried in long email chains, so risks only surfaced after they had grown. Project managers had no quick way to assess project health, which meant the team reviewed each project by hand every week just to work out where things stood. And because we run many projects simultaneously, it was easy for a real problem to slip through unnoticed. Here is a real example. One of our clients had a support agreement coming up for renewal. It is the kind of thing everyone assumes someone else is tracking – but it was not flagged until almost the last day. If that client had decided not to renew, leadership would have had no early warning at all. The information was there. It just was not in front of anyone in time. In another case, a project had two phases and the client had not yet confirmed the scope for the second. That was a clear risk to the final payment. Most of us were aware of it in some abstract way – but the project was not formally flagged until the invoice was already due. A few weeks earlier would have made a real difference. “The warning signs were already there. They were just scattered, and easy to miss until it was too late.” Where Project Health Actually Lives A project’s health is not in one place. It is spread across four areas – and any one of them, left unmonitored, can become a risk that affects cash flow, client relationships, or delivery quality. Booking Contract renewals, new work coming in, and MSA status. A contract quietly approaching expiry is a risk most teams only notice when it is almost too late. Billing & Delivery Project status, open risks, support tickets, internal notes, and the client emails tied to them. This is where the unstructured signals sit. Collection What has been invoiced, what is outstanding, and what is running overdue. Delayed invoicing and unpaid milestones are early indicators of a project in trouble. Resource & Utilization Who is working on what, how busy they are, and where allocation gaps are forming. Low utilization on a contracted engagement is a billing risk waiting to happen. Any one of these on its own does not tell you much. You only see the full picture when you put all four together – and that is exactly what the engine does. What the Project Risk Engine Does 1Unifies the data – Delivery, support, billing, and resourcing data from Dynamics 365 CRM and Outlook is pulled into one governed dataset on Azure Databricks, structured through a Medallion Architecture (Bronze → Silver → Gold). 2Reads the unstructured signals – AI reviews client emails, internal notes, and case history to surface hidden threats: delays, blockers, escalation patterns, and unanswered client requests that never make it into a status field. 3Scores and flags – Every project receives a health score from zero to ten, along with a risk summary, identified threats, and next recommended actions. Projects meeting RED criteria are automatically flagged. 4Makes it conversational – Project managers can ask questions about any project in plain English, directly inside Microsoft Teams through Databricks Genie. No dashboards to open, no reports to pull. How It Works – A Multi-Model, Four-Layer Approach The risk analysis is not a single AI call. It is a deliberate, layered process – lightweight checks first, heavy AI only where it is needed. This keeps it fast and cost-efficient while ensuring accuracy on the things that matter. Layer1 Rule-Based Pre-Filter No AI involved. Simple rules filter out inactive email threads not part of any recent communication, eliminating noise before any model is engaged. Layer2 Lightweight AI Triage A smaller model sorts remaining threads into four categories: active, completed, informational, or waiting. Only active and waiting threads move forward. Layer3 Deep Risk Analysis A larger model – Claude Sonnet 4.5 – runs deep analysis on threads that survived the first two layers. It is used here because this stage requires stronger reasoning: detecting underlying threats, assessing likelihood, and estimating impact. Layer4 Executive Summary Everything is rolled up into a project health score (0–10), top threats, and recommended next actions – a clear, evidence-backed picture of where each project stands. Solution Architecture Here is how the full architecture fits together – from data sources through to the project manager asking a question in Teams. Data flows from Dynamics 365 CRM and Outlook → Azure Logic Apps → ADLS Gen2 Medallion layers → Azure Databricks → Genie AI → Microsoft Teams … Continue reading How CloudFronts Built a Project Risk Assessment Engine with Databricks Genie →

Summary Enterprises have spent years solving the data extraction problem — moving SAP data into warehouses, lakes, and reporting platforms. But extraction is largely a solved problem. The real challenge now is making that data understandable, trustworthy, and useful — to both business users and AI systems. That shift requires business context, metadata, and governance, not another connector. This blog shares observations from an enterprise data modernization assessment and offers a perspective on how SAP Business Data Cloud should be evaluated — not as just another extraction tool, but as a capability that can bring SAP data, business semantics, metadata, and governance closer together. It also examines why zero-copy data sharing, while valuable, is only part of the answer, and why metadata strategy should be defined before any platform is selected. The central argument is straightforward: AI without trusted business context produces answers that are technically valid but business-wrong. Before any AI layer is added, the foundation must be right — and that means starting with the right question: not “which tool?” but “what does this organization need its data platform to become?” Table of Contents 01 Introduction 02 Extraction Is No Longer the Challenge 03 BDC Is Not Just a Connector 04 Metadata Is the Foundation 05 Zero-Copy — Important but Incomplete 06 From Technical Data to Business Data 07 The AI Conversation 08 Evaluate the Outcome, Not the Tool 09 So, Why SAP Business Data Cloud? 10 FAQs 11 Conclusion Introduction Most conversations about SAP data integration start in the wrong place. They begin with extraction — which tool moves data fastest, which connector supports CDC, which platform has the best SAP adapter. These are reasonable technical questions, but they are increasingly the wrong ones to be leading with. The organizations genuinely advancing their data capabilities are not asking “how do we get SAP data out?” They are asking “how do we make SAP data understandable, trustworthy, and useful — to both our people and our AI systems?” This blog shares observations from an enterprise data modernization assessment and offers a perspective on how we should be thinking about SAP Business Data Cloud — not as just another extraction option, but as part of a broader conversation about metadata, business context, and what modern enterprise data platforms actually need to deliver. Data Extraction Is No Longer the Biggest Challenge Over the years, organizations have invested heavily in moving data from ERP systems into data warehouses, data lakes, and reporting platforms. The architecture often becomes: SAP → Extraction → Staging → ETL → SQL → Semantic Model → Power BI It works. But over time, every additional layer introduces another copy of data, another technology to maintain, another process to monitor, and another place where business logic can be implemented. In one enterprise modernization assessment, the existing landscape included SAP, DP Agents, SAP Datasphere, SSIS, SQL Server, and Power BI. The challenge was not a shortage of technology. The challenge was multiple movement layers, duplicated logic, and no single place where the data could be understood as a whole. That is where the conversation about SAP BDC needs to start. BDC Is Not Just Another SAP Connector If we compare SAP BDC only on extraction capability, the difference becomes difficult to justify. Most modern tools — BDC, Datasphere, and various DBT-based approaches — can all support data extraction and incremental or CDC scenarios to varying degrees. But when we introduce another dimension — business context — the discussion changes entirely. A modern enterprise data platform needs to answer: 1What does this field actually mean in business terms? 2Is this a customer, vendor, product, or financial measure? 3What is the agreed business definition — and who owns it? 4Which KPIs depend on this data element? 5How does this business object relate to others? 6Can this data be trusted — and can an AI agent understand its context? This is where metadata stops being a nice-to-have and becomes the foundation on which everything else depends. Metadata Is the Foundation Metadata should be one of the first things defined before selecting a data platform. Technology should follow business requirements — not the other way around. A modern metadata strategy needs to cover: Business Metadata Technical Metadata Relationships Business Glossary Semantic Definitions Data Quality Ownership Lineage Classification & Change Why does this matter? Because the direction of enterprise analytics is shifting: From “Where is my data?” To “What does my data mean?” And eventually “Can AI understand my data and give me a trusted answer?” That progression requires context — and context requires metadata. You cannot shortcut this by starting with AI. “The future of analytics is not about finding data faster. It is about understanding data better — and making that understanding available to both people and AI systems.” Zero-Copy Is Important — But It Is Not the Whole Story One of the strongest technical capabilities highlighted in the assessment is BDC’s managed zero-copy data sharing approach. It can reduce unnecessary data movement while allowing SAP data to participate in the broader enterprise data architecture without being physically duplicated across systems. This matters because data movement has a cost — in infrastructure, in latency, in maintenance, and in the accumulation of inconsistent versions of the same data sitting in different places. But zero-copy should not be positioned as the only reason to choose BDC: Zero-copy solves the movement problem — reducing duplication and infrastructure cost Metadata and business semantics solve the understanding problem — making data meaningful and trusted The second problem is becoming increasingly important, and it is the one most extraction-focused evaluations fail to address. From Technical Data to Business Data A traditional data platform is typically designed around tables and pipelines. A modern data platform needs to move closer to business objects and business domains. Instead of asking a business user to understand technical SAP table names like VBAK, VBAP, KNA1, or MARA, the platform should provide business-level concepts: Customer → Sales Order → Product → Revenue → … Continue reading SAP Business Data Cloud: More Than a Data Platform →

Summary We built a Databricks Genie agent for our own PMO at CloudFronts, running on Dynamics 365 data held in a Databricks lakehouse. Project managers ask a question in plain English and get an answer back across resource utilization, time tracking, billing and milestones, tickets and cases, and project status. This blog covers what the agent does, what email sentiment analysis shows that the numbers do not, and how it works inside Microsoft Teams. Table of Contents Introduction The Challenge The Solution See It in Action Business Impact Frequently Asked Questions Conclusion Introduction This started inside our own PMO — the Billing and Delivery Excellence function at CloudFronts. We learned about a project risk when someone escalated it. The warning signs came earlier than that, in email threads and internal notes, but reading every thread across every project each week was not work anyone could take on. The rest of the picture was split across systems. Billing held the invoice that had passed its due date, delivery held the milestone that had moved, support held the ticket that had been open for weeks. No one screen put those next to each other, so the PMO opened each project every week and compiled the status by hand. So we built the agent for ourselves first: a Databricks Genie agent running on Dynamics 365 data held in a Databricks lakehouse, which project managers query in plain English. The Challenge Dynamics 365 Project Operations holds everything a project manager needs — resource assignments, logged hours, billing milestones, project budgets, and delivery timelines. The data is there. The challenge is that getting specific answers from it still requires navigating multiple modules, running reports manually, and in many cases, exporting to spreadsheets to piece things together. This created a set of questions that were surprisingly hard to answer: Identifying which resources are overutilized or sitting idle requires pulling allocation data and comparing it manually against actual hours logged Understanding whether a project is at risk means cross-referencing milestone progress, budget consumption, and team capacity — a process that can take hours Billing questions — what has been invoiced, what is pending, what is approaching a milestone — require moving between finance and project views that are not always aligned Status updates for leadership need to be manually compiled, often pulling from data that was accurate yesterday but may have shifted today The result is that project managers operate on a lag — making decisions based on reports that reflect the past, not the present, and spending time producing those reports instead of acting on them. The Solution — A Genie Agent Built on Databricks and D365 Project Operations We built a Genie agent on Azure Databricks, connected to Dynamics 365 Project Operations. Project managers can now ask questions in plain English and get answers drawn directly from their project data — without building a single report. The agent is designed around the areas that matter most to project managers on a daily basis: a. Resource UtilizationThe agent can answer questions about who is overallocated, which resources have capacity available, and how utilization is trending across the team or a specific project. What previously required pulling allocation reports and comparing them against timesheets can now be answered in a single question. b. Time TrackingProject managers can ask which team members have not logged hours for the week, where hours are being spent versus what was planned, and whether a specific project is tracking within its estimated effort. The agent surfaces this from logged timesheet data in D365. c. Billing and MilestonesThe agent connects billing milestone data with project progress, allowing project managers to ask what is due for invoicing, which milestones are approaching, and whether any billing triggers are at risk of being delayed. This brings finance and delivery into the same conversation. d. Tickets and CasesThe agent surfaces open tickets and cases linked to a project — how many are open, which are overdue, how they are distributed across team members, and whether any are blocking delivery. Project managers can ask for a snapshot of issue health across one or multiple projects without navigating case queues manually. e. Email Sentiment AnalysisOne of the more telling signals of how a project is going is often hiding in the inbox. The agent analyses email communication patterns and sentiment across project stakeholders — flagging when tone is shifting, when a client’s responses are becoming shorter or more urgent, or when concerns are being raised repeatedly. This gives project managers an early, qualitative read on relationship health before it shows up in a formal escalation. f. Project StatusInstead of assembling a status report, a project manager can ask for a summary of where a project stands — budget consumed, milestones completed, risks flagged, and remaining timeline. The agent compiles this from D365 data and presents it in plain language, ready to share or act on. The conversation does not stop at one question. A project manager can ask a follow-up — drill into a specific resource, filter by project phase, or compare two projects side by side — and the agent follows the thread, refining its response at each step. Available directly in Microsoft TeamsThe Genie agent is also available as a Databricks App inside Microsoft Teams — meaning project managers do not need to switch tools to get answers. They can ask questions about their projects, resources, and billing directly from the Teams interface they already work in every day. See It in Action Weekly Work Summary — Time Tracking in ActionA project manager asks Genie for a summary of work completed last week. The agent returns a full breakdown — total hours logged, billable vs non-billable split, project-wise distribution, and key observations — in seconds. Case Detail View — Tickets and Cases in ActionA project manager asks for details on a specific case. The agent surfaces the full case record — status, owner, priority, activity timeline, and a follow-up alert — without the manager needing to … Continue reading From Project Reporting to Project Intelligence: How AI is Transforming Project Management →

Using Dataverse MCP with Claude to Unlock Business Insights for Senior Leaders Summary MCP Servers are making their way into the mainstream, connecting AI applications together with the AI tool of your choice to utilize them. One such powerful MCP Server, amongst several built by Microsoft, is the Dataverse MCP server. This post walks through what Dataverse MCP brings to users across five capability areas, practical use cases by role, the operational efficiency gains we’ve seen internally at CloudFronts, and answers to the questions this naturally raises around data security and scope. Table of Contents 01 Summary 02 A Quick Recap on MCP Servers 03 Dataverse MCP Capabilities 04 Use Cases by Role 05 Business Impact 06 FAQs 07 Conclusion A Quick Recap on MCP Servers Like several business and personal applications have come up with their own MCP Server, one such powerful MCP Server amongst many by Microsoft is the Dataverse MCP server. Before talking about some use cases, here’s a quick recap of what MCP Servers in general are, to set some context for readers stumbling upon “MCP Servers” for the first time: 1They are an API connection between applications, but capable of understanding human language to connect and execute. 2Don’t need technical knowledge to connect different applications and interact with each other functionally, operating on natural language. 3Widely used by AI Agents to talk to each other and get things done. 4Continue to work after the initial setup. So, given that, here’s what Dataverse MCP brings to users. Dataverse MCP Capabilities Briefly, there are 5 main categories in which Dataverse MCP Servers help: 1Discovery — Use Dataverse MCP to explore the schema of your Dynamics 365 CE / Dataverse environment. Assuming you are a technical team member, you need to explore behind the scenes when customizing solutions, which is where Dataverse MCP can be useful. It’ll go under the hood and make sense of your query to bring you the technical details, instead of you having to remember how it is set up and collate that information. Useful for Solution Architects. 2Query — Query data in simple language by just describing, in human language, what you would otherwise design an Advanced Find for. And when it returns this data, it can go a step further and process or work on the info you asked it to fetch (maybe package it in an Excel file, ready to download from your AI application). 3Record CRUD — Although it’ll ask you for permissions, you can ask your AI tool, connected through Dataverse MCP, to create, update, and delete records. The other day, I just made my Time Entries for the week and asked it to collect Invoice information for a custom entity and bulk-update a custom status on some contacts. So, anything that would need you to go into the system and scrub through forms can be done using Dataverse MCP. 4Schema — I would advise using this carefully. Dataverse MCP is capable of also updating the schema, like creating new tables, fields, etc. If done correctly, with the correct publisher and established naming conventions, this is possible. But I did find myself stuck with incorrect schema creation and a bit of a mess. So, this one is to be used carefully. At times, the schema definition is misunderstood, and you’ve already altered what’s set. 5Skills/Playbooks — Upsert and Delete Skills. This topic on Dataverse Skills deserves a separate blog post in itself. Use Cases by Role To keep things simple, here are some common use cases by role on how Dataverse MCP can be useful: 1Solution Architect — you can use Dataverse MCP to query metadata/schema to help identify what the developers have done, if going through developer documentation is too much to go through. 2Manager — if you want to query some data, you can do this by simply establishing some common vocabulary as context first, and then letting Dataverse MCP query what you need, then process that info retrieved within the chat context to make better sense of what you need. 3Developer — if you want to create a series of tables and a templatized field-set in those, you can simply do so by uploading an Excel file and utilizing Dataverse MCP to create the right fields and schema based on the customizations described. Doing this at scale for multiple customers is painstaking and time-consuming, so utilize Dataverse MCP to get this turned around quickly. 4Even your own data — to identify pitfalls and take measures immediately. Every Monday I need to check where I should pay attention the most and get sticking issues out of the way, and this gives me a good understanding, or a high-level picture, of where I need to pay attention. A weekly check-in: asking Claude, connected via Dataverse MCP, to review time entry compliance over the last 90 days. Business Impact We have enabled Dataverse MCP for all team members to help with their operational efficiencies. Business Impact here is operational efficiency gains — if this saves me an hour a day, it saves me 20 hours a month, and about 240 hours a year, which is a significant gain on a broader time horizon. So, if I multiply this by 15 team members, then we are collectively saving 3,600 hours a year, which can be taken back to focus on growth and client projects more so. FAQs Now, this naturally brings some questions to mind, which I thought to anticipate and answer: 1Is the data being used by Claude? No data is copied over to Claude or its models — only MCP (Model Context Protocol) is used to have a conversation with your existing data, in this case Dataverse. No data is sent anywhere. 2Will users be able to query and modify data belonging to someone else? No — only data which belongs to self is available for any operation. It follows the security architecture of the hosting SaaS application itself, in this case Dynamics 365 CRM / Dataverse. … Continue reading Using Dataverse MCP with Claude to Unlock Business Insights for Senior Leaders →

How We Built a Real-Time Lightweight Financial Statement Reporting Experience Directly Inside Microsoft Dynamics 365 Project Operations Summary Designed and deployed a lightweight, real-time financial statement reporting solution directly inside Microsoft Dynamics 365 Project Operations for a Texas-based Cybersecurity & AI Business Solutions firm. Eliminated dependency on heavy paginated reporting and large-scale Power BI datasets for operational financial visibility. Built an interactive HTML + JavaScript reporting framework embedded natively within Dynamics 365 CRM. Enabled dynamic filtering, instant report rendering, and printable customer-ready statements directly from the CRM interface. Introduced popup-based full-screen report rendering for detailed review and print-ready output without leaving Dynamics 365. Integrated funding balances, allocations, transactions, installment schedules, and financial snapshots into a single operational reporting experience. Reduced reporting development complexity, minimized data transformation overhead, and improved scalability compared to traditional BI-heavy architectures. Created a highly maintainable reporting model that scales efficiently as operational datasets grow without introducing significant Power BI licensing or performance constraints. Table of Contents Introduction The Business Problem The Solution Architecture Real-Time CRM-Native Reporting Lightweight Front-End Reporting Framework Popup-Based Printable Report Experience Data Model and Reporting Components Design Principles Business Impact Why This Approach Worked FAQs Conclusion 1. Introduction As organizations scale, operational reporting often becomes increasingly difficult to maintain. For a Texas-based Cybersecurity & AI Business Solutions firm operating on Microsoft Dynamics 365 Project Operations, this challenge became especially visible in financial agreement tracking and customer funding visibility. The business already had access to reporting platforms such as Power BI and paginated reports. However, these approaches introduced several operational problems: Long development cycles Heavy data-cleaning requirements Complex transformation pipelines Delayed visibility into operational data Increasing licensing costs as datasets expanded Slow report rendering for operational users Dependency on external reporting infrastructure Instead of another external BI layer, the organization wanted a lightweight operational reporting experience directly inside Dynamics 365 CRM itself. The Goal: Build a real-time, CRM-native financial reporting experience that renders instantly, supports dynamic filtering, enables printing, and scales without heavy BI infrastructure. 2. The Business Problem The organization manages multiple long-running service agreements, funding allocations, installment schedules, and customer financial balances across cybersecurity services, managed services, and AI solution engagements. Operational users needed a consolidated statement experience that could answer questions such as: What is the customer’s current available balance? Which transactions impacted the balance during a selected period? Which allocations are currently active? How much funding has been consumed vs allocated? Which installments are pending, paid, or overdue? What does the latest funding snapshot look like? Can the report be reviewed and printed directly from CRM? Paginated Reporting Limitations Increasing query complexity Performance degradation with larger datasets Heavy formatting maintenance Limited interactivity Rigid deployment cycles Power BI Challenges Significant Power Query transformations Data-cleaning pipelines Incremental refresh considerations Dataset refresh latency Licensing growth with scale Overengineering for transactional operational reporting 3. The Solution Architecture The reporting framework was designed as a native Dynamics 365 embedded reporting experience using: HTML Web Resources JavaScript Dynamics 365 Web API Native CRM navigation APIs Real-time entity retrieval Popup-based print rendering Embedded Operational Report Apply filters Select funding records Choose reporting periods Generate statements instantly Navigate operational financial data Popup Print Report Detailed review Executive presentation Customer-facing statements Printing and PDF generation 4. Real-Time CRM-Native Reporting One of the most important architectural decisions was avoiding external data replication entirely. Instead of pushing transactional data into a separate reporting warehouse, the report retrieved data directly from Dynamics 365 using the native Web API. Real-time visibility Zero synchronization lag Reduced infrastructure complexity Lower maintenance overhead Faster deployment cycles Everything rendered on demand inside the CRM session itself. 5. Lightweight Front-End Reporting Framework The reporting experience was intentionally designed to behave more like a modern application than a traditional report. Dynamic Filter Bar Users could dynamically filter reports using: This Month Last Month This Quarter Current Year Custom Date Ranges Funding Status Funding Selection The report regenerated instantly without page reloads. Responsive Report Rendering The reporting layout dynamically populated: Account Summary Transaction Details Allocation Summary Installment Details Detailed Account Summary Each section rendered independently based on live API responses. Intelligent Empty-State Handling Instead of showing blank tables or errors, the framework displayed contextual empty-state messaging such as: “No transactions during this statement period” “No active allocations” “No installment details available” This significantly improved usability for operational teams. 6. Popup-Based Printable Report Experience A major requirement was enabling users to thoroughly review and print reports directly from CRM. To solve this, the solution introduced a dedicated popup rendering architecture. Users could click: “Expand Report” This launched a fullscreen popup using Dynamics 365 navigation APIs with: Large-format rendering Print-optimized layout Full customer statement formatting Multi-page support Consistent branding Printable tables Customer reference guides The popup approach delivered several advantages: Better readability Cleaner print formatting Improved executive review experience Isolation from CRM form clutter Easier PDF generation Most importantly, the popup still worked entirely against live CRM data. 7. Data Model and Reporting Components The report consolidated multiple operational areas into a single experience. Account Summary Provided a high-level balance overview including: Balance Forward Total Credits Total Debits Closing Balance This gave immediate visibility into customer financial standing. Transaction Details Displayed detailed running balance activity including: Document date Transaction description Service type Credits Debits Running balance Transactions dynamically recalculated balances during rendering. Allocation Summary Tracked funding allocation activity including: Allocated funds Consumed funds Remaining balance Allocation status Returned allocations were handled separately with custom date logic. Installment Tracking Displayed installment lifecycle visibility including: Invoice dates Due dates Payment dates Payment terms Installment status The report intelligently handled future-dated payments and pending statuses. Detailed Funding Snapshot Displayed operational funding metrics including: Starting Balance Contracted Funds Total Budgeted Funds Collected Funds Used Funding Available Funds Allocated Funds Unallocated Funds This created a complete operational funding overview within a single screen. 8. Design Principles Several architectural principles guided the solution. Real-Time Over Batch Processing Operational reporting should reflect current business activity immediately. The solution avoided overnight refresh cycles entirely. Lightweight Over Heavy BI Not … Continue reading How We Built a Real-Time Lightweight Financial Statement Reporting Experience Directly Inside D365 PO for a Texas-Based Cybersecurity Firm →

Building a Controlled Booking-to-Time Entry Import Framework Inside Dynamics 365 Project Operations Summary Two Texas-based firms — one in Cybersecurity, another in Operational Security — required a streamlined and controlled Time Entry (TE) creation process inside Dynamics 365 Project Operations. Native D365 Project Operations limitations around Project Task visibility, booking-driven TE creation, and inconsistent resource submissions created operational inefficiencies. A fully customized solution was implemented directly inside Dynamics 365 CRM using HTML Web Resources, JavaScript, Dataverse Web API, Ribbon Enable Rules, and custom plugins. The solution centralized TE creation under Project Managers and Project Approvers, enabling controlled and secure booking-based TE management. A custom booking import framework dynamically surfaced only authorized projects and resources based on Project Approver relationships. Custom plugin logic and Resource Assignment–based task resolution automated Project Task mapping for accurate Time Entry creation. Key capabilities delivered included controlled booking imports, role-based visibility, automated task association, external comments support, and bulk TE creation. Dynamic filtering ensured Project Managers could only access resources and bookings associated with projects they were authorized to manage. The entire experience operated natively inside Dynamics 365 Project Operations without external portals, Power Apps screens, or third-party applications. The implementation reduced manual effort, improved TE submission reliability, increased operational flexibility, and enabled more accurate tracking of actual project work. Table of Contents Introduction The Business Problem & Pain Points The Solution Architecture Implementation Design Principles Business Impact Why This Approach Worked FAQs Conclusion 1 Introduction Two Texas-based firms operating in the Cybersecurity and Operational Security space relied heavily on Dynamics 365 Project Operations for project delivery tracking, resource management, and operational execution. As project operations scaled, Project Managers and Project Approvers required a faster and more controlled mechanism for creating Time Entries (TEs) directly from resource bookings. The organizations needed a solution that could simplify booking imports, improve Project Task mapping, enforce role-based visibility, and reduce the dependency on individual resources for manual TE submissions. Operationally, Project Managers were often responsible for validating and entering actual work performed, making the standard TE process inefficient and time-consuming. Key Challenges Standard Dynamics 365 Project Operations behavior did not fully support project-task-aware Time Entry creation from bookings. Project Task values were not consistently available across Resource Requirements and bookings in several PO environments. Resource-driven TE submission resulted in inconsistent and delayed operational reporting. Project Managers lacked centralized visibility and controlled access to resource bookings across approved projects. Native booking import and TE creation workflows lacked flexibility for operational governance and scalability. Goals of the Solution Centralize Time Entry creation under Project Managers and Project Approvers. Enable controlled booking imports with role-based project visibility. Automate Project Task association during TE creation. Allow bulk creation of booking-driven Time Entries directly inside CRM. Improve operational accuracy, flexibility, and governance without relying on external applications or custom portals. 2 The Business Problem & Pain Points 1. Native Booking-to-Time Entry Limitations Standard Dynamics 365 Project Operations behavior did not consistently expose Project Task information through Resource Requirements and Bookings. This created gaps in task-aware Time Entry creation and forced users to manually reconstruct operational context during the TE process. 2. Lack of Controlled Booking Visibility Default system behavior provided broader booking visibility than operationally required. The organizations needed a controlled access model where only designated Project Managers and Project Approvers could view and manage booking imports for authorized projects. 3. High Manual Effort in Time Entry Creation Project Managers and operational teams spent significant time manually entering project references, tasks, durations, and external comments for each Time Entry. This increased administrative overhead and reduced operational efficiency. 4. Inconsistent Resource-Driven Submission Process The organizations faced reliability challenges with resource-submitted Time Entries, leading to delays, missing entries, and inconsistencies in operational reporting. Project Managers required centralized ownership over TE creation to ensure accurate work tracking. 5. Fragmented User Experience Users were required to navigate across multiple Dynamics 365 screens and entities to complete routine booking import and Time Entry operations, making the process cumbersome and inefficient for daily operational usage. 6. Scalability and Maintainability Concerns The firms required a lightweight and scalable solution that could operate natively within Dynamics 365 Project Operations without introducing unnecessary Power Apps layers, external portals, or high-maintenance custom applications. 3 The Solution Architecture Architecture Diagram and Flow Figure: Complete Frontend – Backend behaviour of the TE Automation Module. Dynamics 365 Ribbon Workbench A custom “Import Resource Bookings” ribbon action was introduced to provide controlled access to the booking import process only for authorized Project Managers and Project Approvers. JavaScript + Dataverse Web API JavaScript and Dataverse Web API were used to handle dynamic project filtering, approver validation, booking retrieval, task mapping, and automated Time Entry creation directly inside CRM. HTML Web Resources Two custom HTML-based interfaces were developed: Resource Selection Interface — controlled resource visibility and selection Booking Import & TE Creation Interface — booking imports, task selection, external comments, and bulk Time Entry creation Dataverse Plugin Layer A lightweight custom C# plugin was implemented to support Project Task resolution, task validation, and booking-to-Time Entry automation scenarios not fully supported natively in Dynamics 365 Project Operations. Dataverse Entities Involved The solution leveraged multiple Project Operations entities: msdyn_project msdyn_projectteam msdyn_resourceassignment msdyn_projecttask bookableresource msdyn_resourcerequirement bookableresourcebooking msdyn_timeentry Together, these entities enabled secure, project-aware, and task-aware operational workflows directly inside Dynamics 365 CRM. Entity Relationships Figure: Relationships and associations of the involved entities. 4 Implementation 1. Role-Controlled Ribbon Visibility A custom ribbon action was implemented to ensure only authorized Project Managers and Project Approvers could access the booking import functionality. Visibility was dynamically controlled based on project approval relationships inside Dynamics 365. Figure: Case 1: When Logged in as a Project Approver/Manager. Figure: Case 2: When NOT Logged in as a Project Approver/Manager. 2. Resource Selection Experience A custom resource selection interface was developed to display only eligible resources associated with projects managed by the logged-in approver. This provided secure and simplified operational visibility. Figure: Bookable Resource Selection from a list of Active Bookable Resources, which are under any Project, where the current … Continue reading Building a Controlled Booking-to-Time Entry Import Framework Inside Dynamics 365 Project Operations for Texas-Based Operational Security & Cybersecurity Firms →

Summary Designed a two-page Power BI Income Pipeline Report for a Texas-based Cybersecurity & AI Business Solutions firm using Microsoft Dynamics 365 Project Operations. Unified visibility across Opportunity, Unbilled Income, Billed Income, and Paid Income in a single view. Introduced Average Turnaround to forecast realistic cash collection timelines based on actual payment behavior. Integrated Dynamics 365 Project Operations with QuickBooks to connect sales, delivery, invoicing, and cash collection. Enabled a 17-week rolling revenue forecast with week-by-week cash visibility. Provided dual invoice status for contractual vs realistic payment tracking. Table of Contents 1. Introduction 2. The Business Problem 3. Report Structure Overview 4. The Income Pipeline 5. Project Revenue Forecast 6. Design Principles 7. Business Impact 8. FAQs 9. Conclusion 1. Introduction Managing revenue across a professional services firm is rarely straightforward. When your business spans cybersecurity assessments, AI-driven solutions, and long-term managed services engagements, the gap between work being delivered and cash actually landing in the bank can be wide — and costly if left unmonitored. This is precisely the challenge we set out to solve for a U.S.-based Cybersecurity and AI Business Solutions firm running their operations on Microsoft Dynamics 365 Project Operations. The result was a two-page Power BI report — the Income Pipeline Report — that gives leadership a real-time, end-to-end view of every dollar moving through the business: from early-stage opportunity, through unbilled and billed income, all the way to cash collected. This post walks through how the report was built, how each data layer was modelled, and why the design decisions were made the way they were. 2. The Business Problem The firm needed clarity across four distinct but connected stages of their revenue lifecycle: Sales opportunities and pipeline value Delivered but unbilled work Outstanding invoices and expected payments Actual vs expected payment behavior This would answer as well as resolve the following questions – Where are active sales opportunities sitting, and how much pipeline value do they represent? Which project work has been delivered but not yet invoiced? Which invoices have been raised and sent to clients, and when are they realistically going to be paid? And finally, how does actual payment behaviour compare against what was expected? Each of these questions existed in isolation before. Project managers had partial visibility into their own contracts, and needed a comprehensive bird’s eye view of all of these together. Finance had QuickBooks data but lacked the context of the delivery pipeline. Leadership had no consolidated view. The Income Pipeline Report brought all of this together in a single, navigable Power BI experience. 3. Report Structure Overview The report consists of two pages: Income Pipeline Report — a high-level pipeline view across four stages: Opportunity, Unbilled Income, Billed Income, and Paid Income, each with summary cards and interactive donut charts. Project Revenue Forecast — a time-distributed breakdown of expected cash collection across a rolling 17-week horizon, organised by customer and contract. 4. The Income Pipeline The Four-Stage Pipeline Banner Across the top of the report, four chevron-style stage indicators guide the revenue journey: Opportunity → Unbilled Income → Billed Income → Paid Income Each stage includes a summary card showing record count and total value Provides immediate visibility into where revenue is sitting Highlights potential bottlenecks across the pipeline Stage 1 — Opportunity Data sourced from Dynamics 365 Sales using Business Process Flow (BPF) Uses active BPF stage (Develop, Propose, Close) instead of static fields Ensures accurate reflection of real sales progression Estimated revenue pulled directly from opportunity records Donut chart shows distribution across Develop, Propose, and Close stages Stage 2 — Unbilled Income Represents contracted or delivered work not yet invoiced Sourced from project contract lines in Dynamics 365 Project Operations Includes: Fixed Fee milestones (explicit values) Time & Material (T&M) estimates based on resource allocations T&M calculated as allocated hours × billing rate Clearly marked as estimated until billing run is executed Grouped into payment expectation buckets (30, 60, 90, 120, 180+ days) Uses Average Turnaround to forecast realistic payment timing Stage 3 — Billed Income (Confirmed Invoices) Combines Dynamics 365 Project Operations and QuickBooks data Tracks invoices that are confirmed and sent to clients Introduces Average Turnaround: Average days from invoice creation to payment Based on historical payment behaviour Each invoice has two statuses: Contractual (due date) Estimated (based on Average Turnaround) Provides realistic vs contractual payment visibility Includes: Due-date based categorisation Estimated overdue analysis Prevents misleading insights from strict payment terms alone Stage 4 — Paid Income Tracks fully collected invoices Uses QuickBooks for actual payment dates Groups payments by time bands (under 30, 60, 90 days, etc.) Enables comparison between actual vs estimated payment behaviour Continuously improves accuracy of Average Turnaround Tooltip Drill-Down Hover shows: Payment band Record count Total value Drill-through available for detailed record-level analysis 5. Project Revenue Forecast Overview Distributes expected cash collection across a rolling 17-week window Shifts view from pipeline stage to time-based forecasting Hierarchy and Structure Customer → Contract → Revenue Type Revenue types include: T&M run schedules Fixed Fee milestones Confirmed invoices Each row shows: Customer Contract Billing type Average Turnaround Value mapped to expected payment week Weeks range from Week 0 to Week 16 Top row aggregates total expected cash per week Colour Coding Amber — Unbilled income Green — Invoice within terms Red — Overdue (based on estimated payment date) Drill-Through to Detail Click any row to view detailed breakdown Includes: Billed invoices with due and estimated dates Unbilled milestones and run schedules Connects high-level forecast to transactional detail 6. Design Principles Average Turnaround over payment terms Reflects actual customer behaviour instead of contractual assumptions. Dual invoice status Provides both contractual and realistic payment visibility. Consistent time buckets Ensures comparability across Opportunity, Unbilled, Billed, and Paid stages. Weekly forecasting instead of monthly Supports short-term cash flow planning aligned with operational rhythm. 7. Business Impact Improved cash flow predictability Earlier visibility of at-risk invoices Unified cross-team visibility Improved T&M billing discipline Increased accountability 8. FAQs What is Average Turnaround and why does it … Continue reading How we designed & deployed an Income Pipeline Report for a Texas, U.S. based Cybersecurity & AI Business Solutions Firm, via MS D365 Project Operations and Power BI. →

Summary In modern data engineering environments, managing ingestion pipelines across multiple source systems becomes increasingly complex as data volume and variety grow. Hardcoded pipelines create maintenance overhead, slow down onboarding of new datasets, and introduce operational risks. This blog explains how a metadata-driven pipeline approach in Databricks can simplify ingestion by using a centralized configuration table to dynamically control pipeline behavior. It highlights how this pattern improves scalability, governance, and maintainability while enabling faster and more reliable data processing. The Real Problem: Hardcoded Pipelines Do Not Scale In many implementations, ingestion pipelines are built separately for each entity or source system. Typical issues include: As the number of entities grows, pipelines become difficult to manage and error-prone. What Is a Metadata-Driven Pipeline? A metadata-driven pipeline shifts control from code to configuration. Instead of writing separate logic for each dataset, we define ingestion behavior in a centralized configuration table. Typical metadata fields include: The pipeline reads this metadata and dynamically executes ingestion logic. Implementation Approach Step 1: Create a Configuration Table A centralized metadata table is created to define ingestion rules. Each row represents one dataset and contains all required configuration. Step 2: Dynamic Pipeline Execution The pipeline reads metadata and loops through each configuration entry. For each entity: No code changes are required when new entities are added. Step 3: Incremental Logic Control Instead of hardcoding: WHERE modifiedon > last_run The incremental field is read from metadata, allowing flexibility across different source systems. Step 4: Integration with Lakehouse Layers Metadata drives ingestion, while Lakehouse layers manage transformation. Why This Approach Works in Enterprise Environments 1. Scalability New entities can be added by inserting a new row in metadata. No pipeline duplication required. 2. Maintainability Changes in incremental logic or source structure are handled centrally. 3. Consistency All pipelines follow the same logic and standards. 4. Governance Metadata provides visibility into: Common Mistakes to Avoid Metadata-driven pipelines require discipline in design. Business Impact Metadata-driven pipelines are not just a technical optimization they are a foundational shift in how data platforms are built and managed. Organizations looking to scale their data engineering capabilities should move away from hardcoded ingestion logic and adopt configuration-driven approaches that support flexibility, governance, and long-term growth. Connect with CloudFronts to get started at transform@cloudfonts.com.

Summary Modern analytics platforms require structured data pipelines that ensure reliability, consistency, and governance across reporting systems. Traditional ETL approaches often struggle to scale as data volume and complexity increase. This blog explains how the Bronze–Silver–Gold (Medallion) architecture in Databricks provides a scalable and reliable framework for organizing data pipelines. It highlights how each layer serves a specific purpose, enabling better data quality, governance, and seamless integration with reporting tools such as Power BI. The Real Problem: Reporting Pipelines Become Fragile Over Time In many organizations: This leads to unreliable reporting and increased maintenance effort. What Is the Bronze–Silver–Gold Architecture? The Medallion architecture organizes data into three layers: Bronze Layer Raw data ingestion layer. Silver Layer Cleaned and standardized data. Gold Layer Business-ready, reporting-optimized data. Each layer has a clear responsibility. Bronze Layer: Raw Data Ingestion Purpose Key Characteristics Bronze acts as the system of record. Silver Layer: Data Standardization Purpose Key Activities Silver creates reusable datasets across reporting use cases. Gold Layer: Reporting-Ready Data Purpose Key Characteristics Gold tables are consumed directly by reporting tools. Why This Architecture Works 1. Separation of Concerns Each layer has a defined role, reducing complexity. 2. Improved Data Quality Data is progressively refined from raw to curated. 3. Better Performance Reporting queries run on optimized Gold tables. 4. Governance with Unity Catalog Access can be controlled at each layer: Common Implementation Mistakes These mistakes lead to long-term instability. Business Impact To conclude, the Bronze–Silver–Gold architecture provides a strong foundation for building scalable and reliable data pipelines in Databricks. When combined with proper governance and disciplined design, it enables organizations to deliver consistent, high-quality data for analytics and decision-making. We hope you found this article useful. If you would like to explore how AI-powered customer service can improve your support operations, please contact us at transform@cloudfronts.com.