The Microsoft 365 connector is an Anthropic-hosted integration that enables Claude to securely access Microsoft 365 services (Outlook, SharePoint, OneDrive, Teams) through user-delegated permissions. Anthropic has completed Microsoft's publisher verification process, associating our verified Microsoft Partner Network account with these applications to confirm our organizational identity.
The Microsoft 365 connector is available on all Claude plans: Free, Pro, Max, Ultra, Team, and Enterprise.
This guide has a section for each account type:
Work or school accounts
The connector operates as a secure proxy, and your Microsoft 365 documents, emails, and files remain in your tenant. The connector only retrieves data on-demand during active queries and doesn’t cache file content. Credentials are encrypted and managed by Anthropic's backend infrastructure. The MCP server itself doesn’t store or manage these credentials. Microsoft's Azure SDK handles the On-Behalf-Of token exchange and caching on a per-user basis for accessing the Graph API.
Restrict access
The connector provides multiple layers of access control to address your security requirements. For detailed information on administration of the Microsoft 365 connector, see Set up the Microsoft 365 connector.
1. Microsoft Entra tenant requirement
People connecting a work or school account must authenticate with a Microsoft 365 account tied to a Microsoft Entra tenant, on every Claude plan. A Microsoft Entra Global Administrator must complete a one-time consent process before anyone in the tenant can connect.
2. Organization-level gating (Team and Enterprise plans)
On Team and Enterprise plans, access to the connector requires a two-step approval process. First, Owners must explicitly enable the Microsoft 365 connector in Claude organization settings by navigating to Organization settings > Connectors > Browse connectors > Add "Microsoft 365." Until this approval is granted, team members have no access.
Second, after the Owner enables the connector, a Microsoft Entra Global Administrator must complete individual authentication and grant consent on behalf of the whole organization before any team members can connect.
3. Granular permission revocation
You can selectively disable specific capabilities via Microsoft Entra Admin Center. For example:
To restrict | Action | Effect |
All access | Disable connector in Claude organization settings | Complete shutdown |
SharePoint only | Revoke Sites.Read.All permission in Entra | Blocks SharePoint |
Email access | Revoke Mail.Read permission in Entra | Blocks Outlook |
Teams chat | Revoke Chat.Read permission in Entra | Blocks Teams |
Teams messaging (write) | Revoke ChatMessage.Send, ChannelMessage.Send, and Chat.Create in Entra | Blocks Claude from sending Teams messages |
OneDrive files | Revoke Files.Read and/or Files.Read.All | Blocks reading files from OneDrive |
Changes take effect immediately for all people in your organization. People can also choose to disable capabilities during a chat by selectively toggling off the connector's tools.
4. Microsoft Conditional Access
Your Conditional Access policies apply to the connector, but not always in the way they apply to a user working directly in Microsoft 365. When a user connects, Entra evaluates your policies against their sign-in. Every later request is made by Claude's servers. In our testing, Entra evaluates those requests as coming from Anthropic’s outbound IP addresses, identifying the member and carrying the device recorded when they connected, rather than the member’s current device or network. What that means for each kind of policy:
Group-based access: Supported. Scope your policy to specific security groups, or set Assignment required on both Claude applications as described in Set up the Microsoft 365 connector.
Multi-factor authentication (MFA): Supported. MFA is enforced when the member signs in to connect. If your MFA policy doesn't apply to the connector sign-in, for example because it targets specific applications, or has conditions that can skip MFA there, create a separate policy with no conditions that requires MFA for the two Claude applications.
Device compliance: Supported, with a difference in when it's checked. In our testing, the policy is evaluated against the device the member connects from. A device that doesn't meet the policy isn't stopped at the connect screen; its requests fail from the first tool call afterwards. The connection then carries that device record, and ongoing access is checked against the record rather than the device currently in use, until the member next reconnects. Each member's most recent connection is the one that counts. The record is only created if the member's browser can prove the device to Entra, so a compliant device used with a browser profile that isn't signed in to your organization is treated as not compliant. Members who are blocked (
AADSTS53000) fix it by reconnecting from a device that meets the policy, in a browser signed in to your organization. Keep the policy assigned to the Claude applications; excluding them removes the check.Location and network restrictions: Not supported. In our testing, the server-side requests always appear to come from Anthropic's IP ranges, wherever the member is, so a policy that limits sign-ins to your network or VPN blocks the connector for every member. The same applies to sign-in frequency policies. Learn how to exclude Anthropic's IP ranges in Set up the Microsoft 365 connector.
Warning: Don't change a device policy to require a compliant device or multi-factor authentication as a workaround. In our testing the MFA proof carries through the stored connection in the same way, so the policy can end up satisfied for every member and the device requirement stops doing anything reliable.
To stop members from connecting a work Microsoft 365 account to a Claude account outside your organization, turn on Restrict verified-domain connectors to your enterprise.
5. User-level permissions
The Microsoft 365 Connector uses delegated permissions.
Users can only access Microsoft 365 data they already have permission for
SharePoint search requires Sites.Read.All permission. Site-specific permissioning (using *.Selected permissions) is not supported because the underlying search is tenant-wide.
Users cannot bypass SharePoint sharing settings or folder permissions.
Users can't access other users' private files or emails. Users can search shared mailboxes they've been granted delegate access to in Microsoft 365, including full access and folder-level delegation. Shared mailbox access remains read-only, via the
Mail.Read.Sharedpermission. Email search doesn't reach a user's separate Online Archive (In-Place Archive) mailbox.Delegated permissions inherently respect Microsoft 365 data loss prevention (DLP) policies.
6. Token management
Refresh tokens expire after 90 days of inactivity by default, requiring re-authentication. This can be customized in Microsoft Entra ID using a token lifetime policy.
Access tokens typically expire within 60-90 minutes per Microsoft Entra ID defaults and are automatically refreshed.
Admins or users can revoke access anytime via Microsoft Entra ID.
The Microsoft 365 Connector doesn’t see or store passwords.
Security architecture summary
Authentication flow
OAuth 2.0 On-Behalf-Of (OBO): Industry-standard delegated authentication
PKCE protection: Public client uses Proof Key for Code Exchange to prevent authorization code interception
Two-stage token exchange: User authenticates to obtain access token for MCP server, then MCP server exchanges it for Graph API access using OBO flow with confidential client credentials. In this flow, not even the user or their Claude client has access to the OBO tokens. Only the MCP server can access and use tokens with access to the user’s data via the Microsoft Graph API.
No credential storage: Users never share Microsoft passwords with Anthropic
Encrypted token storage: Access and refresh tokens are encrypted while cached by the Claude backend
Data flow
Documents and other content are retrieved only during active queries
Tool call results from the connector that are part of stored chats are retained
The user who requested the Claude chat can see the tool call results and Claude’s response incorporating the data
Other users shared on the chat can only see Claude’s response incorporating the result of the tool call
Each request creates a fresh data flow which is cleaned up after the response is returned
Multi-tenant isolation
Microsoft Entra tenants are cryptographically separated from each other using a common-scoped multi-tenant configuration
Multi-tenant isolation is cryptographically enforced through digitally signed access tokens that bind each user to their organization’s tenant
Available capabilities
Read and search tools
The connector provides read-only access to:
Tool | Description | Required permission |
| Search SharePoint documents and pages | Sites.Read.All |
| Find SharePoint folders by name | Sites.Read.All |
| Search email with sender/date filters | Mail.Read |
| Search calendar events | Calendars.Read |
| Find available meeting times | Calendars.Read |
| Search Teams chat messages | Chat.Read |
| Read files, emails, or chat by URI | Varies by resource type |
Write tools
Tool | Description | Required permission |
| Send an email as the user | Mail.Send |
| Forward an existing message | Mail.Send |
| Send an existing draft | Mail.Send |
| Move a conversation to Deleted Items | Mail.ReadWrite |
| Restore a conversation from Deleted Items | Mail.ReadWrite |
| Move multiple messages to Deleted Items | Mail.ReadWrite |
| Create a draft email | Mail.ReadWrite |
| Create a reply draft on a message | Mail.ReadWrite |
| Create a reply-all draft on a message | Mail.ReadWrite |
| Update an existing draft | Mail.ReadWrite |
| Move a draft to Deleted Items | Mail.ReadWrite |
| Create a category in the master list | MailboxSettings.ReadWrite |
| Rename or recolor a category | MailboxSettings.ReadWrite |
| Remove a category from the master list | MailboxSettings.ReadWrite |
| Add/remove categories on one message | Mail.ReadWrite |
| Add/remove categories across a thread | Mail.ReadWrite |
| Add/remove categories on multiple messages | Mail.ReadWrite |
| Create a calendar event | Calendars.ReadWrite |
| Update an existing event | Calendars.ReadWrite |
| Delete a calendar event | Calendars.ReadWrite |
| Accept, decline, or tentatively accept an invitation | Calendars.ReadWrite |
| Set the automatic-reply (out-of-office) message | MailboxSettings.ReadWrite |
| Create an inbox rule | MailboxSettings.ReadWrite |
| Delete an inbox rule | MailboxSettings.ReadWrite |
| Create a new file in a library or folder | Files.ReadWrite.All |
| Replace an existing file's content | Files.ReadWrite.All |
| Create a new folder | Files.ReadWrite.All |
| Rename a file or folder | Files.ReadWrite.All |
| Move a file or folder | Files.ReadWrite.All |
| Copy a file or folder | Files.ReadWrite.All |
| Delete a file or folder (to recycle bin) | Files.ReadWrite.All |
| Send a message in an existing Teams chat | ChatMessage.Send |
| Post or reply in a Teams channel | ChannelMessage.Send |
| Reply in a Teams channel thread | ChannelMessage.Send |
| Start a new Teams chat | Chat.Create |
Note: The sharepoint_* file tools also work in OneDrive, wherever the user already has edit access. OneDrive for Business stores files in a SharePoint library, so the same tools cover both. sharepoint_delete_item moves the file or folder, including its contents, to the recycle bin. It doesn’t delete it permanently.
Note: On Team and Enterprise plans, users can't choose Always allow for the following tools, unless an admin has set that tool to Always allow on or after November 9, 2026:
outlook_send_mailoutlook_forward_mailoutlook_send_draftoutlook_create_eventoutlook_update_eventoutlook_delete_eventoutlook_respond_to_eventoutlook_set_vacationteams_send_chat_messageteams_send_channel_messageteams_reply_channel_message
This limit doesn't apply to organizations that added the Microsoft 365 connector for the first time after November 9, 2026. There, admins can set each of these tools to Always allow, Needs approval, or Blocked, as for any other write tool. Removing the connector and adding it again usually keeps the organization's original install date, so it usually doesn't change whether the limit applies. Admins in other organizations who see a notice about these tools can set them to Always allow now in Review write tools, in Review tool restrictions, or on the Tools tab. The limit ends right away for each tool an admin sets to Always allow, and users can then choose Always allow for it. Some users may have chosen Always allow for that tool in the past. That earlier choice can take effect right away, so Claude can stop asking them. Claude asks everyone else by default until they choose it.
If the organization has more than one Microsoft 365 connector, the tool must be saved on each one. An Always allow saved before November 9, 2026 doesn't end the limit until an admin saves it again. For the rest of these tools, users must still approve each use until the limit is removed on or after December 9, 2026. Any of these tools an admin hasn't set by then will change to Needs approval, unless the whole connector is set to Blocked.
Organizations that have enabled HIPAA aren't part of these changes to default blocks and limits: they don't get a notice, and neither setting Always allow nor adding the connector for the first time ends this limit.
In Cowork, users can choose Always allow only when the organization setting Allow “Always allow” for connector tools is on. Changes an admin saves apply right away. A tool set to Always allow turns on right away if it was blocked by default. With Always allow, Claude may use a tool without asking anyone first, including in “Automatically approve” mode and in some scheduled tasks, such as a cloud scheduled task set to “Automatically approve” or a Claude Code routine. Scheduled tasks can lose access to tools on Needs approval. On Free, Pro, Max, and Ultra plans, users can choose Always allow for these tools.
When an organization enables write tools, the connector also exposes write tools for sending and organizing email, managing drafts and calendar events, updating mailbox settings, creating and updating files in OneDrive and SharePoint, and sending Teams messages. In organizations that added the connector before the Teams write tools launched in September 2026, Admins can set each Teams write tool individually in Organization settings > Connectors within “Microsoft 365”. If a Teams write tool is blocked by default, setting the connector's default restriction to No restriction doesn't turn it on. Claude can send messages in Teams but can't change Teams settings, memberships, or permissions.
Write tools include the following built-in safeguards:
Attribution. Emails Claude sends include an attribution header identifying them as agent-initiated. File writes, calendar writes, and Teams messages aren't currently tagged.
Rate limits. Per-user limits apply to writes, sends, and recipients.
Attachment restriction. Attachments aren't supported in any write tool—sending, forwarding, and drafting all reject messages with attachments.
Blocked by default until at least December 9, 2026. Organizations that used the connector before write tools or the Teams write tools launched have some write tools blocked by default. Admins can choose a setting for each of these tools now in Organization settings > Connectors.
On or after December 9, 2026, any of these tools that an admin hasn't changed will be set to Needs approval, unless the whole connector is set to Blocked. If one of these tools is among the 11 Outlook, Calendar, and Teams tools with a limit that Anthropic will remove on or after that date, admins can set it to Always allow now. It turns on right away.
Once it's saved on each of the organization's Microsoft 365 connectors, the limit ends for that tool, and members can choose Always allow for it. Claude may then use it without asking anyone first, including in “Automatically approve” mode and in some scheduled tasks, such as a cloud scheduled task set to “Automatically approve” or a Claude Code routine. Scheduled tasks can lose access to tools on Needs approval. Organizations that have enabled HIPAA aren't part of these changes to default blocks and limits.
Confirmation required. In chat and Cowork, Claude asks the user to confirm before it sends or forwards an email, sends a Teams message, creates, changes, deletes, or responds to a calendar event, or sets an automatic reply. On Team and Enterprise plans, users can't choose Always allow for these tools, unless an admin has set that tool to Always allow on or after November 9, 2026. Otherwise the user confirms each use. The exception is organizations that added the Microsoft 365 connector for the first time after November 9, 2026. There, admins can set each of these tools to Always allow, Needs approval, or Blocked, and when an admin sets a tool to Always allow, each user can choose Always allow for it.
In Cowork, users can choose Always allow for these tools only when the organization setting Allow “Always allow” for connector tools is on. Removing the connector and adding it again usually keeps the organization's original install date, so it usually doesn't change whether the limit applies. In other organizations, admins who see a notice about these tools can set them to Always allow now. The limit ends right away for each tool an admin sets to Always allow, and each user can then choose Always allow for it.
Some users may have chosen Always allow for that tool in the past. That earlier choice can take effect right away, so Claude can stop asking them. If the organization has more than one Microsoft 365 connector, the tool must be saved on each one. For the rest of these tools, users must still confirm each use until the limit is removed on or after December 9, 2026.
With Always allow, Claude may use a tool without asking anyone first, including in “Automatically approve” mode and in some scheduled tasks, such as a cloud scheduled task set to “Automatically approve” or a Claude Code routine. On Free, Pro, Max, and Ultra plans, Claude asks by default, and each user can choose Always allow for any of these tools. Claude then uses that tool without asking them.
Organizations that have enabled HIPAA aren't part of these changes to default blocks and limits.
Permissions list
Basic permissions
User.Read - Sign in and read user profile (basic requirement)
Mail permissions
Mail.Read - Read user mail (required for email tools/resources)
Mail.ReadBasic - Read user mail metadata (alternative for limited functionality)
Mail.Read.Shared - Read user and shared mail
MailboxFolder.Read - Read a user's mailbox folders
MailboxItem.Read - Read a user's mailbox items
Calendar permissions
Calendars.Read - Read user calendars and events
Calendars.Read.Shared - Read calendars user can access, including shared
User directory
User.ReadBasic.All - Read basic profiles of all users (for meeting availability)
Chat permissions
Chat.Read - Read user chat messages
Chat.ReadBasic - Read user chat metadata (alternative for limited functionality)
ChatMember.Read - Read the members of chats
ChatMessage.Read - Read user chat messages (more specific than Chat.Read)
Channel permissions
Team.ReadBasic.All - Read the names and descriptions of teams
Channel.ReadBasic.All - Read the names and descriptions of channels
ChannelMessage.Read.All - Read channel messages
Meeting permissions
OnlineMeetings.Read - Read online meetings
OnlineMeetingTranscript.Read.All - Read meeting transcripts
OnlineMeetingAiInsight.Read - Read all AI Insights for online meetings
OnlineMeetingArtifact.Read.All - Read user's online meeting artifacts
OnlineMeetingRecording.Read.All - Read all recordings of online meetings
Files permissions
Files.Read - Read user files
Files.Read.All - Read all files user can access
Sites permissions
Sites.Read.All - Read items in all site collections
Write permissions
Requested as part of the updated consent set; used only when write tools are enabled:
Mail.Send - Send and forward email
Mail.ReadWrite - Create, update, and delete drafts; move and label messages
Calendars.ReadWrite - Create, update, delete, and respond to calendar events
Files.ReadWrite.All - Create, update, and delete files and folders in OneDrive and SharePoint
MailboxSettings.ReadWrite - Manage categories, inbox rules, and automatic replies
ChatMessage.Send - Send a Teams chat message on the user's behalf
ChannelMessage.Send - Post or reply in a Teams channel
Chat.Create - Start a new Teams chat on the user's behalf
People.Read: Find people in the organization to start a chat with
Current limitations
Teams write access is limited to messaging: Claude can send a chat message, post or reply in a channel, or start a new chat, but can't modify Teams settings, memberships, or permissions. All write tools require an admin to enable them.
User-level access only: Access with service principal authentication is not supported.
Online Archive mailboxes aren't searched: email search covers each user's primary mailbox, including its Archive folder, and any shared mailboxes they can access. It doesn't cover the separate Online Archive mailbox (also called the In-Place Archive), so messages that a retention policy has moved there won't appear in results.
Frequently asked questions
Can we test with a small pilot group before enterprise-wide rollout?
Yes. The recommended approach is to use app assignment to restrict who can use the connector:
Enable the connector (Team and Enterprise Owners enable it in organization settings; individual plan users can connect directly).
Microsoft Entra Admin completes pre-consent setup
Use Microsoft Entra Enterprise App assignment to restrict access to specific users or groups (e.g., assign only "IT Security Test Group" to the app).
Expand groups progressively for gradual deployment
How do we ensure no data leakage occurs between our organization and others in the multi-tenant environment?
Multi-tenant isolation ensures complete separation:
Server uses the common tenant configuration to accept tokens from any Microsoft Entra ID tenant
Each user's token contains their organization's tenant ID (tid claim) which is validated
Graph API tokens obtained through OBO are automatically scoped to the user and their tenant
Cross-tenant token access is prevented cryptographically by the design of Microsoft Graph’s OAuth 2.0 implementation.
What happens if someone tries to connect with a personal Microsoft account?
It depends on which option they choose:
Work or school option: Signing in with a personal account gives an authentication error.
Personal account option: On Free, Pro, Max, and Ultra plans, people can connect a personal account here. This option isn't shown on Team and Enterprise plans.
Learn more about personal Microsoft accounts.
Do you have audit logging for compliance?
Yes. All Graph API calls made by the connector are logged in your organization's Microsoft 365 audit log, which you can access through the M365 Compliance Center. These logs show the timestamp, user, operation performed, and resource accessed, with retention periods matching your Microsoft 365 audit policy. Additionally, Anthropic logs authentication and tool execution events.
Can we revoke access if we discover unauthorized usage?
There are multiple revocation methods:
Individual: Users disconnect via Customize > Connectors
Admin-level: On Team and Enterprise plans, Owners disable the connector in Claude organization settings (all team members affected).
Permission-level: Revoke specific permissions in Microsoft Entra Admin Center
Tenant-level: Revoke all permissions in Microsoft Entra Admin Center
Personal Microsoft accounts
On Free, Pro, Max, and Ultra plans, people can connect a personal Microsoft account, such as an Outlook.com, Hotmail, Live, or MSN account. This option isn't shown on Team and Enterprise plans. Learn more in Connect to Microsoft 365.
Separate applications: Personal accounts use their own Microsoft applications, which accept only personal accounts. Your tenant's applications and consent aren't involved.
Consent: Each person consents for their own account. There's no admin step, and Microsoft Entra controls such as Conditional Access and app assignment don't apply.
Tools: Personal accounts get the tools in Available capabilities, plus
search_people, except the Teams tools,chat_message_search,find_meeting_availability,outlook_create_filter,outlook_delete_filter, andoutlook_set_vacation.read_resourcecan't read Teams content. Thesharepoint_*tools work on the person's own OneDrive, including shared items they've added to it, and don't useSites.Read.All.Write tools: There's no admin setting, so write tools are available once connected. Attribution, rate limits, and the attachment restriction still apply. The "Always allow" limits in Available capabilities don't apply to personal accounts.
Permissions: Personal accounts request these Microsoft Graph permissions:
User.Read,offline_access,Mail.Read,Mail.ReadWrite,Mail.Send,MailboxSettings.Read,MailboxSettings.ReadWrite,Calendars.Read,Calendars.ReadWrite,Files.Read.All,Files.ReadWrite.All, andPeople.Read. Sign-in also requestsopenidandemail, so Claude receives the account's email address.Terms: On Free, Pro, Max, and Ultra plans, this connection falls under Anthropic's Consumer Terms of Service and Privacy Policy.
Access removal: People disconnect in Customize > Connectors and can remove the permission in their Microsoft account.
Data handling: The connector retrieves data on demand and doesn't cache file content. Your email and files stay in your Microsoft account, but content Claude retrieves becomes part of your chat. Credentials are encrypted and managed by Anthropic's backend infrastructure, and the connector doesn’t see or store passwords. Tool call results in stored chats are retained.
Certifications
Anthropic has the following certifications:
SOC 2 Type II (annual audit)
ISO 27001 certified
DPA available on Team and Enterprise plans