MCP for Your BI Data: What Has to Be True Before You Add an Assistant

Connecting an assistant to your BI data takes an afternoon. Whether the answers can be trusted was decided long before that, by three things that have nothing to do with the connection: whether your numbers have one fixed definition, whether the assistant works with the rights of the person asking, and whether a human approves anything that has an effect outside the system. A team that has those three gets a useful colleague. A team that skips them gets a confident stranger with access to the warehouse.

This piece walks through each condition with the kind of example a finance or marketing lead will recognize, and looks at what one BI vendor, Microsoft, documents about its own MCP servers as a reference point.

What an MCP connection on BI data is

An MCP connection on BI data is a server that sits in front of your reporting layer and offers an AI assistant a fixed menu of actions: find a report, read which measures exist, run a query, and in some products build or change something. MCP, the Model Context Protocol, is the open standard that describes how the assistant discovers and calls those actions. The assistant can use what is on the menu and nothing else. If the protocol itself is new to you, start with MCP Explained for Marketing Leaders.

What matters is what the menu sits on. There are three common layers, and they behave very differently.

The assistant should never decide what revenue means

Take a webshop that charged customers €261,360 at checkout in October. That figure includes 21 percent VAT and €6,000 of shipping. Without VAT and shipping it is €210,000. That is after €20,000 of discount codes and sale markdowns, so at list price the same orders were worth €230,000. Customers then sent back €21,000 worth of products. Finance reports €189,000.

All of those are revenue to an assistant reading column names. Ask "what was revenue in October" against loose tables and you get one of them, stated without doubt, and possibly a different one next week when the question is phrased another way. Divide by €30,000 of ad spend and return on ad spend lands anywhere between 6.3 and 8.7. Someone will move budget on that.

"New customer" has the same problem. Is it a first order ever, or the first in twelve months? Does a guest checkout with a known email address count as returning? Does a customer whose only order was fully refunded count at all? A model cannot recover those choices from the data, because they were never in the data. They are in the heads of the people who close the month.

So the first condition is a definition layer, often called a semantic layer or a semantic model: one place where each number is defined once, in a form software can apply. The assistant asks for net revenue and the layer does the arithmetic. We cover the mechanics in Why AI Gets Your Numbers Wrong, and the practical work of writing the definitions down in the guide to the ecommerce KPI scorecard.

A quick test before you connect anything: ask three colleagues for last month's revenue and for the number of new customers. If you get more than one answer to either, an assistant will not fix that. It will add a fourth.

Access should follow the person asking

The quick way to wire up an assistant is one shared technical account with read access to everything. It works on the first day. It also means the intern asking about campaign performance can get wholesale margins, and that nobody can say afterward who asked what.

The second condition is that every question runs with the rights of the individual who asked it. The country manager for Germany sees German orders. The agency sees the client it works for. Two people asking the same question can then get different answers, and that is correct behavior, the same thing your dashboards already do when they filter by role.

Ask the vendor two things. Does the connection sign in as the person, or as a shared account? And is there a log of who asked what and which data came back? Your security reviewer will ask the same questions, along with where the data travels once it leaves the BI tool. Our security review for AI on marketing data lists the rest.

A person approves what has an effect outside the system

Reading is safe to automate. A wrong answer to a question costs you a wrong answer. Writing is different, and BI has more writing in it than people expect: publishing a dashboard to the whole company, changing the definition behind forty reports, scheduling a report that mails a client every Monday, sending a customer list to an ad platform.

The third condition is a hard line between what an assistant may do alone and what it may only prepare. Let it draft the dashboard, propose the definition change, set up the schedule. Then a person opens the proposal, sees exactly what will happen, and switches it on. The approval should happen in the product, by someone with the right to give it, and it should not be something the assistant can click for you.

This sounds slow. In practice the assistant does the forty minutes of building and the person does the forty seconds of checking, which is the right way round.

What Microsoft documents for Power BI

Power BI is a useful reference because Microsoft has written its position down in detail. The following comes from Microsoft Learn as read on November 13, 2026.

Microsoft's overview of the Power BI MCP servers describes two servers. The Power BI Authoring MCP server lets an agent read and change semantic models: tables, measures, relationships, security roles. It exists as a hosted endpoint in preview and as a local server that is generally available. Microsoft states that it is not meant for answering business questions for end users.

For questions there is Fabric IQ MCP, which is generally available. Microsoft describes its toolset as read only: find reports and semantic models, read their metadata and schema, search for stored values, and run a query. It has no tool that answers in plain language. The assistant chooses the tools, writes the query itself and explains the result. It covers reports and semantic models, and does not support Power BI dashboards, paginated reports or Power BI apps. Results are as current as the model's last successful refresh.

On the three conditions, the documentation is direct:

• Definitions. Because the assistant writes its own query against the model, the quality of the answer depends on what the model defines. Microsoft notes that a result can be incomplete or fail if the model does not expose the fields and measures the question needs.
• Access. Sign in is per user. The server applies the caller's existing permissions, row level and object level security keep restricting what comes back, and service principal sign in is not supported.
• Approval. The question server cannot change anything. For the authoring server, Microsoft warns that an autonomous or misconfigured client might perform destructive actions, and recommends least privilege roles and safeguards before deployment.

Microsoft adds a point that applies to every vendor: an MCP server does not expand data access, but it does move data. Schemas and query results go to the assistant, which may forward them to its model provider. Where that provider processes data is your question to answer, and the BI tool's own security settings do not answer it.

Six questions to ask before you connect

1. When the assistant reports revenue, where is the definition written down, and does the dashboard use the same one?
2. Does every question run with the rights of the person asking?
3. Can I see afterward who asked what, and what was returned?
4. Which actions can the assistant complete alone, and which need a person?
5. Where do the question and the result travel, and in which region are they processed?
6. Can the assistant answer something no existing report covers, or only read what was already built?

A vendor that answers the first one with "the model figures it out" has told you what you need to know.

Where Verity fits

Verity takes this approach for marketing and ecommerce data. Its MCP server gives an assistant such as Claude or ChatGPT more than 100 tools on three levels: reading, writing, and actions that a person approves. Answers come from the same approved definitions that feed dashboards and reports, so an assistant can run an analysis or build a dashboard as a draft and the numbers match what the team already sees. Anything with an effect outside Verity, such as scheduling a report or sending an audience to an ad platform, comes back as a review link that a person opens and approves. The full list is in the public tool reference, and the broader picture is on the AI analytics page.

Frequently asked questions

Does Power BI have an MCP server?

Yes. Microsoft documents an authoring server for building and changing semantic models and Fabric IQ MCP for read only questions on reports and semantic models. Check Microsoft Learn for the current status of each, because the lineup has changed over the past year.

Is an assistant on a dashboard the same as an assistant on the data?

No. A dashboard holds the answers to questions someone thought of in advance. An assistant that can only read those tiles inherits that limit. Connected to a definition layer, it can answer new questions with the same definitions the tiles use.

Do we need a semantic layer before we start?

You need the definitions, whatever you call the place they live. Start with the ten numbers your management meeting discusses, agree on each, and store them where both the dashboards and the assistant read them. If your BI tool and your data team already disagree on revenue, settle that first.

Can an assistant build dashboards for us?

It can, and it is one of the better uses. The condition is the approval step: the assistant builds a draft, a person reviews it, and only then does it reach the team. For why dashboards and conversation belong on one definition layer, see Your Dashboards Are Answering Last Quarter's Questions.