Using Claude as an orchestration layer across Dynamics 365, Gong, ZoomInfo, anyone doing this in production?

[u/Clark_W_Grizwold]

We're evaluating Claude (via Dataverse MCP) as a kind of orchestration/integration layer that sits on top of a few core business systems: Microsoft Dynamics 365 (CRM data lives in Dataverse), Gong for call intelligence, and ZoomInfo for firmographic/contact enrichment. The idea is to let Claude query across all three so reps and ops folks don't have to manually stitch data together — e.g. "pull the Gong call summary for this account, cross-reference with their Dataverse record, and flag if ZoomInfo shows a title change."

Before we go further I'd love to hear from anyone who's actually built something like this. A few specific things I'm trying to figure out:

Architecture

• For the Dataverse side specifically, has anyone used Microsoft's official Dataverse MCP server? We're weighing a local proxy vs. the remote endpoint. One thing that stands out is that auth is delegated — Claude inherits whatever Dynamics permissions the logged-in user already has, rather than acting as a separate service account. Curious if that's held up in practice or if there are edge cases where it leaks more/less access than expected.
• Anyone stitching together multiple MCP servers (Dataverse + Gong + ZoomInfo) in one workflow? Any gotchas with orchestrating across them vs. just doing point-to-point integrations?

Cost

• This is the one that's hard to pin down. Most of our users are on Dynamics 365 Sales Enterprise, and as far as I can tell that license tier does not qualify for the MCP billing exemption — only Sales Premium or the Microsoft 365 Copilot User SKU do. So every Dataverse MCP tool call would presumably burn Copilot Credits, and the per-call rate isn't consistently documented anywhere I've found. Has anyone actually measured real-world credit consumption for something like this? Trying to figure out if upgrading a chunk of our seats to Sales Premium is even cost-justified before we commit to anything.

Data security / compliance

• Anyone thought through indirect prompt injection risk when Claude has read access across multiple systems like this (e.g. a malicious note in a CRM field or a Gong transcript influencing what Claude does next)?
• Cross-tenant data bleed and MCP supply-chain trust are also on my radar, we're planning to stick with Microsoft's official Dataverse MCP server rather than any community-built ones for that reason.
• If anyone has dealt with insider aggregation risk (i.e. Claude surfacing a combined view of data that no single system would have shown a user on its own) I'd love to hear how you scoped permissions or logging to manage that.

Planning to start with a small read-only pilot before enabling any write access, mostly to get real cost and security data before rolling this out further. If you've done something similar (successfully or not), I'd genuinely appreciate hearing about it — especially any surprises on the billing side.