/erp-connectors — Connector Selection Matrix

When designing an agent that integrates with any enterprise system, picking the wrong connector approach costs a sprint. This skill provides the selection matrix and the governance check. Run it at blueprint stage — before Eric writes any integration code.

ACP MANDATORY: Advanced Connector Policies (ACP, GA June 4, 2026) replace classic Business/Non-Business DLP for certified connector governance in enterprise Copilot Studio agent builds. Architecture designed on the old DLP model alone is insufficient from June 2026. Verify ACP scope (certified connectors only — custom connectors still use classic DLP) at author time.

When to invoke

• Designing an agent that integrates with any enterprise system: ERP (SAP, D365, BC, Oracle, NetSuite), CRM (Salesforce, Dynamics), HRIS, data platform (Snowflake, Databricks), or any internal API
• Bob is blueprinting an agent architecture and needs a connector decision before the blueprint is locked
• Nexus is producing a Platform Brief for a project with enterprise integration requirements
• Client asks "how does the agent talk to [system]?" — this skill provides the structured answer and the governance check

Steps

1. Enumerate target systems. List every external system the agent must interact with. For each, record:
   • System name and version
   • Available integration surfaces (REST API, OData, MCP server, Power Platform connector, SOAP/RFC for legacy)
   • Required operations (read-only vs read-write, which records or endpoints)
   • Auth mechanism (Entra ID, OAuth2, API key, SAML, XSUAA)

2. Apply the connector selection matrix.

   Connector type	Best for	Auth complexity	Copilot Studio native?	Notes
   Power Platform connector (1,000+ pre-built)	M365, Dataverse, published SaaS integrations (Salesforce, ServiceNow, SAP, etc.)	Low — Entra ID or OAuth2 managed by the connector	Yes — native action	Simplest path for Copilot Studio agents; always check connector catalogue before building custom
   Logic Apps connector (400+ managed)	Enterprise integrations requiring mid-layer processing: transformation, retries, long-running, durable execution	Low-Medium — connector manages auth; Logic App orchestrates	Via HTTP trigger	Use when the chain involves multiple systems or needs retry/compensation logic; agent calls Logic Apps HTTP trigger, Logic Apps does the heavy lifting
   Custom MCP server	Target system has no Power Platform connector, or agent needs a domain-specific tool surface (SAP S/4HANA, custom internal systems)	High — vendor-specific	Via MCP add (Copilot Studio creates a PP connector behind the scenes)	MCP is the dominant emerging pattern — ERP vendors are publishing MCP servers. Check current vendor MCP availability before building a custom one
   Copilot Studio custom connector	Target has a REST API but no MCP wrapper and no certified PP connector	Medium — OpenAPI spec, OAuth2 or API key	Yes — configure from OpenAPI spec	Right bridge when the target is REST-capable but not MCP-ready; simpler than building a full MCP server

3. Check current MCP server availability. Before building a custom MCP server or custom connector, check whether the target system has a vendor-published one. Verify this table at author time — the MCP ecosystem is evolving monthly.

   Platform	MCP status (September 2026)	Auth
   Business Central	GA 2026	Entra ID
   Snowflake	GA — managed in-account	Snowflake OAuth + RBAC
   Databricks	Public Preview (January 2026)	Entra ID + Unity Catalog
   Teradata	GA	Teradata auth
   SAP Commerce Cloud	Q2 2026 target — verify current availability	SAP IAS + XSUAA
   Work IQ (M365 semantic index)	Preview	Entra ID
   Salesforce / MuleSoft	Not published as of September 2026	—
   Oracle NetSuite	Not published as of September 2026	—

4. Verify ACP governance. For every connector approach:
   • ACP (Advanced Connector Policies, GA June 4, 2026) applies to certified Power Platform connectors — default-deny allowlist, action-level control within a connector, can block specific MCP servers
   • Custom connectors (OpenAPI-based) still fall under classic DLP — ACP does not yet cover custom connectors; verify this boundary at author time
   • MCP servers added to Copilot Studio create a Power Platform connector behind the scenes — they inherit ACP/DLP governance; specific MCP servers can be blocked by ACP. This is not obvious from the Copilot Studio user-facing flow.
   • Purview sensitivity labels propagate through connector data paths for regulated clients — factor this into governance design for any data classification requirement
5. Build and deploy. Follow the appropriate downstream skill:
   • BC MCP integration: skills/bc-mcp/SKILL.md
   • SAP BTP integration: skills/sap-btp-agents/SKILL.md
   • Copilot Studio agent authoring: skills/copilot-studio-build/SKILL.md
   • Azure AI agent: skills/azure-ai-foundry-dev/SKILL.md

Deliverable format

• Connector selection decision document citing this matrix and the project-specific reasoning for each integration point
• ACP policy record: which connectors and which actions are allowed per environment (dev/test/prod)
• For each integration point: connector type chosen, auth mechanism, read/write scope, licensing note

Non-negotiables

• ACP is mandatory, not optional. Any enterprise Copilot Studio + connector build that governs using only the old Business/Non-Business DLP model is architecturally insufficient as of June 2026. Design ACP policies at blueprint stage.
• Check MCP server availability before building custom. The default assumption is that a vendor-published MCP server may exist. Building a custom MCP server when a vendor one is available wastes a sprint.
• Verify ACP scope at author time. ACP currently covers certified connectors only — custom connectors still use classic DLP. This boundary may shift; verify against current Power Platform documentation at the start of every engagement.
• Route through Logic Apps when durability matters. If a connector operation can fail, needs retry logic, or involves multiple system calls, route through Logic Apps — not directly from the agent. Agents are not durable executors.
• Brief G on connector licensing before scaling. Power Platform connector licensing (per-user, per-flow) and Logic Apps (Consumption vs Standard) have significant cost differences at scale. G must model costs before any connector architecture goes to production.

References

• Power Platform Advanced Connector Policies — Platforms of Power — verify current at author time
• Power Platform connector reference — Microsoft Learn — check connector availability at author time
• Connect your agent to an existing MCP server — Copilot Studio
• Use connectors in Copilot Studio agents — Microsoft Learn
• Logic Apps connectors overview — Azure — verify current at author time
• List of all MCP servers — Microsoft Learn Connectors
• Athanasios recon: .squad/coach/knowledge/2026-09-04-enterprise-integration-recon.md (Angle 3)
• Decision: .squad/decisions/2026-09-04-nexus-enterprise-integration-extension.md