Connect to Microsoft 365 - Claude.ai Documentation

The remote connector is hosted by Anthropic. Data in transit passes through Anthropic’s infrastructure, which is based in the United States. Anthropic does not collect or store any data that transits through the server. To keep all Microsoft 365 traffic between the user’s device and Microsoft instead, use the local connector.

When Claude Desktop is deployed on third-party inference, Claude can read your organization’s Microsoft 365 data (Outlook mail and calendar, OneDrive, SharePoint, and Teams) through a connector registered in your own Microsoft Entra tenant. Two connectors are available: a remote connector hosted by Anthropic, and a local connector built into the desktop app.

Choose a connector

Both connectors provide the same read and search tools; they differ in data path and authentication. Write actions (sending mail, managing drafts and calendar events, working with files, and sending Teams messages) depend on the write scopes approved in Microsoft Entra.

	Remote connector	Local connector
Microsoft 365 data path	Transits Anthropic’s infrastructure (no storage)	Stays between the user’s device and Microsoft
App registrations you own	One desktop client app, plus tenant consent to Anthropic’s connector app	One dedicated public client app
Token exchange	On-behalf-of exchange in Anthropic’s infrastructure	Tokens acquired and stored on the device
Allowlisting with Anthropic	Required (two to three business days)	Not needed
Device egress	`login.microsoftonline.com` and the connector host	`login.microsoftonline.com`, `graph.microsoft.com`, and your tenant’s SharePoint and OneDrive hosts
Device-based Conditional Access	Not supported (the server-side exchange has no device identity)	Supported on managed Windows and Mac devices through brokered sign-in
Write actions	Available with write scopes on the Anthropic connector app	Available with write scopes
US Government clouds	Separate connector deployment; contact your Anthropic representative	Built in; set `azureCloud` for GCC High and DoD
Blocking by Microsoft Purview sensitivity label	The label list doesn’t apply to remote connector entries	List the labels to block in the connector’s configuration

Remote connector

The desktop app authenticates with an app registration you create in your own Microsoft Entra tenant, and Anthropic’s Microsoft 365 connector service performs the Microsoft Graph calls on the signed-in user’s behalf. Anthropic’s connector service receives the desktop’s delegated access token on each request and exchanges it on-behalf-of the user for a short-lived Graph token. Neither token is persisted server-side beyond the request, and Anthropic never holds your tenant’s client secrets or the user’s refresh token (the refresh token stays encrypted on the user’s device). Setup requires a Global Administrator or Cloud Application Administrator in your Entra tenant. The hosted M365 server has not been evaluated for HIPAA compliance. If your organization follows HIPAA compliance, use the local connector instead.

How the connection works

Three applications participate in the sign-in chain.

Application	Owner	Purpose
Desktop client app	You (registered in your tenant)	What Claude Desktop signs in as. Public client, PKCE, no secret.
Anthropic connector app	Anthropic (multi-tenant)	Receives the desktop’s token and calls Microsoft Graph on the user’s behalf.
Microsoft Graph	Microsoft	The Microsoft 365 data APIs.

Set up the remote connector

Consent the Anthropic connector app into your tenant

A tenant administrator must consent to Anthropic’s multi-tenant connector app once for the organization. This creates a service principal in your tenant; no secret is exchanged.Open the following URL after replacing YOUR_TENANT_ID with the Directory (tenant) ID shown in Entra admin center → Overview.

https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17

The consent screen lists the delegated Microsoft Graph permissions the connector requests. The read permissions include:

Scope	Purpose
`User.Read`	Read the signed-in user’s profile
`Mail.Read`, `Mail.Read.Shared`	Read mail in the user’s and shared mailboxes
`Calendars.Read`, `Calendars.Read.Shared`	Read events in the user’s and shared calendars
`Files.Read.All`	Read files the user can access in OneDrive and SharePoint
`Sites.Read.All`	Read SharePoint site content the user can access
`Chat.Read`, `ChatMessage.Read`	Read Teams chat messages the user can access
`offline_access`	Allow the desktop to refresh its token without re-prompting

The screen also lists the write permissions, such as Mail.Send and Files.ReadWrite.All. Accepting approves the whole list for every user in your tenant, which makes write actions available to every remote connector user. To keep the connector read-only or limit write actions to specific users, accept, then revoke the write scopes before you deploy the configuration in step 4. See Control write actions on the remote connector.Review the permissions and select Accept.

FedRAMP and GovCloud deployments use a different connector app ID and a different connector service hostname. Contact your Anthropic representative for the app ID to use in this URL and in the scope string in step 4, and for the connector URL to use in step 4.

Create the public client that Claude Desktop will sign in as.

In Entra admin center → App registrations → New registration, set Name to Claude Desktop (or your preferred name), set Supported account types to Accounts in this organizational directory only, and add a Redirect URI of platform Mobile and desktop applications with the value http://127.0.0.1/callback.
Select Register, then note the Application (client) ID and Directory (tenant) ID shown on the overview page.
Under API permissions → Add a permission → APIs my organization uses, search for Anthropic (or paste the connector app ID from step 1), select Delegated permissions → access_as_user, then Add permissions.
Select Grant admin consent for {your organization}.

Send Anthropic your IDs

Anthropic maintains an allowlist of tenant and client IDs that may call the connector service. Email your Anthropic representative, or open a support ticket, with your Directory (tenant) ID and the Application (client) ID from step 2. Allowlisting is typically completed within two to three business days.Until the allowlist is updated, sign-in will succeed but the connector returns Client application is not authorized for this resource.

Configure Claude Desktop

In the Claude Desktop in-app configuration window, open Connectors, select Add server → Microsoft 365, and enter the values below.

Field	Value
Client ID	The Application (client) ID from step 2
Tenant ID	Your Directory (tenant) ID
Scope	`api://07c030f6-5743-41b7-ba00-0a6e85f37c17/access_as_user offline_access`

Select Save, then deploy the configuration through your device-management tool as usual.If you manage configuration through JSON or a plist directly instead of the in-app configuration window, add the following entry to managedMcpServers.

{
  "name": "m365",
  "url": "https://microsoft365.mcp.claude.com/mcp",
  "transport": "http",
  "oauth": {
    "clientId": "APPLICATION_CLIENT_ID_FROM_STEP_2",
    "tenantId": "DIRECTORY_TENANT_ID",
    "scope": "api://07c030f6-5743-41b7-ba00-0a6e85f37c17/access_as_user offline_access"
  }
}

After the configuration is deployed, each user opens Customize → Connectors in Claude Desktop and selects Connect next to Microsoft 365. Their browser opens to your tenant’s sign-in page; once they consent, the connector is ready to use in conversations.

Allow the required network hosts

In addition to the base egress hosts, Claude Desktop needs outbound HTTPS access to the hosts below. The connector service itself calls graph.microsoft.com from Anthropic’s infrastructure, so user devices do not need egress to Graph.

Host	Purpose
`login.microsoftonline.com`	Microsoft Entra sign-in
`microsoft365.mcp.claude.com`	The connector service (substitute your deployment’s hostname)

If your firewall or secure web gateway filters traffic by application, also allow Model Context Protocol (MCP) traffic to the connector service’s host. Such equipment can classify the connection as MCP traffic and block it even when the host is allowed.

Control write actions on the remote connector

Claude can take a write action for a user through the remote connector once the matching write scope is approved for that user on the Anthropic connector app. The Entra admin center lists that app under Enterprise applications as M365 MCP Server for Claude. The write scopes are Mail.Send, Mail.ReadWrite, MailboxSettings.ReadWrite, Calendars.ReadWrite, Files.ReadWrite.All, ChatMessage.Send, ChannelMessage.Send, and Chat.Create. A tenant that approved the connector before Anthropic added the write scopes stays read-only until the write scopes are approved. To see which scopes your tenant has approved, open the app’s Permissions page as described in Revoke write scopes on the remote connector. These controls apply to the connector service at microsoft365.mcp.claude.com. For write actions on a FedRAMP or GovCloud deployment, contact your Anthropic representative.

The Microsoft 365 connector in claude.ai uses the same connector app. When an administrator approves the write scopes for the whole tenant, for either product, write actions become available to every remote connector user in that tenant. Both the admin consent link in Set up the remote connector and Grant admin consent for {your organization} on the M365 MCP Server for Claude app’s Permissions page approve every permission the connector requests, including the write scopes.

Choose a control by who should have write actions:

Who gets write actions	What you do	Where it’s enforced
Every remote connector user	Open the admin consent link and select Accept	Microsoft Entra
Specific users	Revoke the write scopes for the tenant, then grant them user by user	Microsoft Entra
Nobody	Revoke the write scopes	Microsoft Entra
Users on devices you choose	Block the write tools with `toolPolicy` on the other devices	Claude Desktop managed configuration

Revoke write scopes on the remote connector

Revoking a write scope for the tenant turns off the matching write actions for remote connector users and for claude.ai users in the same tenant. Requires the Cloud Application Administrator or Application Administrator role in Microsoft Entra.

In the Microsoft Entra admin center, go to Enterprise applications and remove the application type filter next to the search box.
Search for M365 MCP Server for Claude and open it.
Go to Permissions and open the Admin consent tab, which shows the permissions approved for the whole tenant. If no write scope is listed, none is approved for the tenant.
For each write scope in the Microsoft Graph list, select the scope, select …, select Revoke permission, and confirm. The scope disappears from the tab.
Open the User consent tab, which shows the permissions granted to individual users. The admin center can’t revoke these grants. To remove a write scope listed here, use Microsoft Graph or PowerShell as described in Microsoft’s Review permissions granted to enterprise applications.
If your tenant allows user consent, require assignment on the connector app so that only an administrator can approve its permissions.

Write tools still appear in Claude Desktop after the scopes are revoked, and calls to them fail. To remove the tools from sessions, also block them in Claude Desktop.

Limit remote connector write actions to specific users

Microsoft Entra can record consent for a single user instead of the whole tenant. Keep the read scopes approved for the tenant, and grant the write scopes only to the users who need them. Requires at least the Cloud Application Administrator role in Microsoft Entra.

Follow Revoke write scopes on the remote connector so that no write scope is approved for the tenant.
For each user, follow Microsoft’s Grant consent on behalf of a single user procedure. Use 07c030f6-5743-41b7-ba00-0a6e85f37c17 as the client application, Microsoft Graph as the resource, and the write scopes the user needs as the permissions.
If a user already has a grant for the connector app on the User consent tab, update that grant. Microsoft’s script creates a new grant and assumes none exists.

Keep the limit in place after you create the grants:

Fix a failed write action with a per-user grant: add the missing scope to that user’s grant. The admin consent link and the Grant admin consent for {your organization} button on the M365 MCP Server for Claude app’s Permissions page approve the write scopes for every user, even when a permission error points you to them.
Revoke again after tenant-wide consent: if you use either control to approve a permission Anthropic adds later, repeat Revoke write scopes on the remote connector afterward
Script changes to who has write actions: each grant covers one user and can’t target a group. Create a grant when a user gains write actions, and delete it with Microsoft Graph or PowerShell when they lose them.

Require assignment on the connector app

When an app requires assignment, Microsoft Entra accepts only administrator consent for its permissions, even if your tenant’s user consent settings would otherwise let users consent for themselves. Only assigned users can get a token for the app, so assign people before you turn the setting on.

In the Microsoft Entra admin center, go to Enterprise applications and open M365 MCP Server for Claude.
Under Users and groups, add every user or group that uses the connector in Claude Desktop or claude.ai, including people who only read.
Go to Properties and set Assignment required? to Yes.

If people in your tenant also use the connector in claude.ai, make the same change on the M365 MCP Client for Claude app, as described in Set up the Microsoft 365 connector.

Block remote connector write tools in Claude Desktop

Set each write tool to "blocked" in the toolPolicy of the m365 entry in managedMcpServers. Find each write tool’s name and the scope it needs in the Microsoft 365 connector security guide. For example, this entry blocks three of the write tools:

{
  "name": "m365",
  "url": "https://microsoft365.mcp.claude.com/mcp",
  "transport": "http",
  "oauth": {
    "clientId": "APPLICATION_CLIENT_ID_FROM_STEP_2",
    "tenantId": "DIRECTORY_TENANT_ID",
    "scope": "api://07c030f6-5743-41b7-ba00-0a6e85f37c17/access_as_user offline_access"
  },
  "toolPolicy": {
    "outlook_send_mail": "blocked",
    "outlook_create_event": "blocked",
    "sharepoint_upload_file": "blocked"
  }
}

Claude Desktop removes a blocked tool from Claude’s session, and connector settings show the tool as blocked by your organization. To allow write tools for one group, deploy the entry without the blocks to that group’s devices through your device-management tool. A block doesn’t change the scopes approved in Microsoft Entra. On a device without the block, the same user can still take write actions, so also use one of the Entra controls to limit the user’s account. These errors can appear during setup. If the connection fails with no Microsoft sign-in page, or main.log shows Unexpected content type: text/html, see MCP server sign-in.

Error	Cause	Fix
`AADSTS50011` redirect mismatch	Redirect URI is not exactly `http://127.0.0.1/callback`, or was registered under Web instead of Mobile and desktop applications	Re-check step 2.1
`AADSTS50194` multi-tenant required	Tenant ID is missing from the configuration	Add Tenant ID in step 4
`AADSTS65001` admin consent required	Step 1 was not completed, or step 2.4 was skipped	Complete admin consent
`Client application is not authorized for this resource`	Anthropic allowlist not yet updated	Wait for confirmation from step 3

Local connector

Claude Desktop includes a built-in copy of the Microsoft 365 server. As an alternative to the remote connector, you can configure the app to run that server as a local process on each user’s machine: the user signs in to Microsoft Entra on the device, and the server calls Microsoft Graph directly from the device. No Microsoft 365 data or tokens pass through Anthropic’s infrastructure. To choose between the two connectors, see the comparison table.

Set up the local connector

Do not reuse the desktop client app you registered for the remote connector. That app is consented only for the connector’s own scope, so its tokens can reach nothing but the connector service. The local-mode app needs Microsoft Graph permissions directly, and adding those to the remote connector app’s client ID would let any token minted for it read Microsoft 365 data directly, tenant-wide. Register a separate app dedicated to local mode.

In Entra admin center → App registrations → New registration, set Name to Claude Desktop M365 Local (or your preferred name) and set Supported account types to Accounts in this organizational directory only.
Under Authentication, open the Redirect URI configuration tab and select Add redirect URI (on older versions of the portal, select + Add a platform instead). Choose the Mobile and desktop applications card (the Windows, UWP, and Console card, not the iOS / macOS card, which takes a bundle ID rather than a redirect URI). Leave the suggested redirect URIs unchecked, enter http://localhost in the Custom redirect URIs box, and select Configure. This is the standard loopback redirect for desktop apps: during browser sign-in, Microsoft Entra redirects to a listener on the device itself, so the response never leaves the machine. For brokered sign-in on managed devices, also add the per-platform broker redirect URI shown under How users sign in. Add it to the same platform by selecting Edit on the Mobile and desktop applications section that appears on the Authentication page, rather than adding another platform, and select Save at the top when you finish (on older versions of the portal, add the broker URI via the Add URI row inside the platform section instead). After you save, Microsoft Entra may display the msauth URI under a separate iOS / macOS section. That placement is expected.
Under Authentication, set Allow public client flows to Yes, and select Save. The control is on the Settings tab under Web and SPA settings (on older versions of the portal, under Advanced settings). With it set to No, brokered silent token acquisition fails with AADSTS7000218. To prevent device-code phishing, apply a tenant Conditional Access policy that blocks the device-code authentication flow. Scope the policy to All resources, not to this registration.
Under API permissions → Add a permission → Microsoft Graph → Delegated permissions, add the scopes the connector will request (the default set is listed under Configure scopes), then select Grant admin consent for {your organization}.
Note the Application (client) ID and Directory (tenant) ID from the overview page.

Configure Claude Desktop

In the Claude Desktop in-app configuration window, open Connectors, select Add server, and choose Microsoft 365 under the Built-in group. Enter the values below, then select Test this connection to verify that the server starts and lists its tools, and select Save.

Field	Value
Tenant ID	Your Directory (tenant) ID
Client ID	The Application (client) ID from step 1
Azure cloud	`global` (default), `us-gov-high`, or `us-gov-dod`
Access	Leave empty for standard read access, or list scopes explicitly (see Configure scopes)
Sensitivity labels	Leave empty, or list the labels to block (see Block content by sensitivity label)

If you manage configuration through JSON or a plist directly, add an entry to managedMcpServers with the server field set to microsoft365:

{
  "name": "Microsoft 365",
  "server": "microsoft365",
  "tenantId": "DIRECTORY_TENANT_ID",
  "clientId": "APPLICATION_CLIENT_ID_FROM_STEP_1"
}

Field	Required	Description
`name`	Yes	Unique display name, shown to users in connector settings.
`server`	Yes	Must be `microsoft365`. An entry that mixes `server` with `url`, `transport`, or `command` is rejected.
`clientId`	Yes	The Application (client) ID of the local-mode app from step 1.
`tenantId`	Yes	Your Directory (tenant) ID.
`azureCloud`	No	`global` (default), `us-gov-high`, or `us-gov-dod`. Selects the Microsoft Entra and Microsoft Graph hosts for GCC High and DoD.
`continuousAccessEvaluation`	No	`enabled` (default) or `disabled`. When enabled, the connector requests Continuous Access Evaluation-capable Microsoft Graph tokens, which live up to about 28 hours and stop working within minutes after an administrator revokes the user’s sessions or disables the account in Entra, and, where your tenant enforces an IP named-location or Global Secure Access compliant-network Conditional Access policy, when the token is used from outside that network. `disabled` keeps standard one-hour tokens. A change applies to tokens issued after the connector next starts, and an already-issued token stays in use until it expires (select Disconnect, then Connect, to sign in again immediately). Requires Claude Desktop 1.49585.0 or later; earlier versions ignore the field and request standard one-hour tokens.
`scope`	No	Space-separated delegated Graph scopes to request instead of the default read set. The app rejects an entry that has a `scopes` array, so write the scopes as one string. See Configure scopes.
`sensitivityLabels`	No	The Microsoft Purview sensitivity labels that the connector blocks. See Block content by sensitivity label.
`toolPolicy`	No	Per-tool approval locks, the same as for any managed server. See `toolPolicy`.

The server ships inside the app, so nothing else needs to be installed on the device, and it activates only from managed configuration; users cannot add it themselves. Deploy the configuration through your device-management tool as usual.

Allow the required network hosts for local mode

The local connector calls Microsoft directly from the device, so in addition to the base egress hosts, devices need outbound HTTPS access to:

Host	Purpose
`login.microsoftonline.com`	Microsoft Entra sign-in
`graph.microsoft.com`	Microsoft Graph data APIs
Your tenant’s SharePoint and OneDrive hosts	Downloads of OneDrive and SharePoint files

To read Office documents, such as Word and PowerPoint files, the connector asks Microsoft Graph for a PDF version and follows the redirect Graph returns. Microsoft chooses the host in that redirect.GCC High and DoD deployments use login.microsoftonline.us and graph.microsoft.us (or dod-graph.microsoft.us for us-gov-dod) instead of login.microsoftonline.com and graph.microsoft.com, matching the azureCloud setting. For a Microsoft 365 GCC tenant, leave azureCloud at global. No egress to any Anthropic host is needed for Microsoft 365 data with the local connector.

Configure scopes

With no scope field, the connector requests the standard read set at sign-in:

Scope	Purpose
`User.Read`	Read the signed-in user’s profile
`Mail.Read`, `Mail.Read.Shared`	Read mail in the user’s and shared mailboxes
`Calendars.Read`, `Calendars.Read.Shared`	Read events in the user’s and shared calendars, and find meeting times
`Files.Read.All`	Read files the user can access in OneDrive and SharePoint
`Sites.Read.All`	Read SharePoint site content the user can access
`Chat.Read`	Read Teams chat messages the user can access
`OnlineMeetings.Read`	Read the user’s online meetings
`offline_access`	Refresh tokens without re-prompting

To request a different set, list scopes in the entry’s scope field. The connector then requests exactly that list (plus User.Read and offline_access, which are always included). Use the list to narrow the read surface, to add the optional read scopes, or to add write scopes. Whatever you list must also be consented on the app registration from step 1; keep the two lists in sync. Six optional read scopes are not in the standard set:

ChannelMessage.Read.All enables Teams message search (chat_message_search), including searches of 1:1 and group chats, and lets Claude list a channel’s messages (teams_list_channel_messages). Requires tenant-admin consent.
OnlineMeetingTranscript.Read.All enables reading meeting transcripts. Requires tenant-admin consent.
MailboxSettings.Read lets the connector read the user’s mailbox time zone so that dates in requests follow the user’s local time rather than UTC.
People.Read enables people search (search_people), which resolves a name to a user before starting a Teams chat.
Team.ReadBasic.All and Channel.ReadBasic.All let Claude list the user’s teams and their channels (teams_list_teams, teams_list_channels), which Claude uses to find the team and channel IDs that the channel-message tools take.

Until ChannelMessage.Read.All is granted, Teams message search returns an error with an admin consent link, including for 1:1 and group chats. Claude can still list chats (teams_list_chats) and read their messages (read_resource) with Chat.Read. Until OnlineMeetingTranscript.Read.All is granted, transcript requests return a permission error. Grant admin consent for ChannelMessage.Read.All or OnlineMeetingTranscript.Read.All in Microsoft Entra before you list it in scope. While the connector requests one of these scopes without admin consent, Microsoft Entra refuses the whole token request (AADSTS65001) instead of leaving that scope out. If the entry has no scope field yet, list the standard read scopes as well, because scope replaces them. The scope field accepts only scopes the connector can use. An entry containing an unrecognized scope name is rejected as a whole at configuration load, with an error in the app’s main log listing the valid names, and the connector does not appear.

Narrowing or removing scope shrinks what the connector requests at the next sign-in, but it does not narrow tokens already obtainable for the registration: Microsoft Entra issues tokens carrying every scope previously consented for the app, regardless of what is requested. To revoke access, remove the consent in Entra under Enterprise applications → your app → Permissions.

The connector provides these read and search tools:

Tool	What it does
`outlook_email_search`	Search Outlook mail
`outlook_calendar_search`	Search calendar events
`find_meeting_availability`	Find free meeting times
`outlook_find_available_time`	Find open time slots for a meeting between the user and specific participants
`chat_message_search`	Search Teams messages in 1:1 chats, group chats, and channels (needs `ChannelMessage.Read.All` as well as `Chat.Read`)
`sharepoint_search`, `sharepoint_folder_search`	Search SharePoint and OneDrive
`read_resource`	Fetch a specific item, such as a message, event, or file
`teams_list_chats`	List the user’s Teams chats and their members, to find a chat to read or post in
`get_me`	Return the signed-in user’s own profile
`search_people`	Search for people by name or email address (needs `People.Read`)
`teams_list_teams`, `teams_list_channels`	List the user’s teams and a team’s channels (need `Team.ReadBasic.All` and `Channel.ReadBasic.All`)
`teams_list_channel_messages`	List a channel’s messages, or the replies in one conversation (needs `ChannelMessage.Read.All`)

Grant write scopes

With only read scopes granted, the connector is read-only. To let Claude take actions in Microsoft 365, grant write scopes: add them to the entry’s scope field and consent them on the app registration from step 1. Each write tool appears only when its scope is in the entry’s list, so granting a subset of the write scopes exposes a matching subset of the tools, and removing the write scopes from the list returns the connector to read-only.

Scope	What it enables
`Mail.Send`	Send mail, send drafts, and forward mail
`Mail.ReadWrite`	Create, update, and delete drafts; trash, untrash, and delete messages; apply and remove labels on messages
`Calendars.ReadWrite`	Create, update, delete, and respond to calendar events
`Files.ReadWrite.All`	Create, update, rename, move, copy, and delete files and folders the user can edit in OneDrive and SharePoint
`MailboxSettings.ReadWrite`	Create and delete mail filters, manage labels, and configure automatic replies
`ChatMessage.Send`	Post messages in existing Teams chats
`ChannelMessage.Send`	Post and reply to messages in Teams channels
`Chat.Create`	Start 1:1 and group Teams chats

Sending drafts and forwarding mail also require a mail read scope (one of Mail.Read, Mail.ReadWrite, or Mail.Read.Shared) for the pre-send checks; the standard read set already includes one. Every write tool requires user approval on each call by default. Administrators can change a tool’s approval state with toolPolicy, except for the send tools (outlook_send_mail, outlook_send_draft, outlook_forward_mail, outlook_create_event, outlook_update_event, teams_send_chat_message, teams_send_channel_message, teams_reply_channel_message): an allow setting for them resolves to ask, so they always require approval on each call.

Block content by sensitivity label

You can keep Claude from reading or changing content that carries certain Microsoft Purview sensitivity labels. You add the labels to the local connector’s configuration. The connector then checks the label of a file or email before it gives the item to Claude or changes it, and blocks the request if the label is on your list. The connector blocks this content when it carries a listed label:

Files: Word, Excel, PowerPoint, PDF, and MP4 files in SharePoint and OneDrive. The connector identifies the file type by its extension.
Email: Outlook email, including drafts. When an email is blocked, so are its attachments.
Attachments: a Word, Excel, PowerPoint, or PDF attachment that carries a listed label itself, even if its email doesn’t. Attachments in the older .doc, .xls, and .ppt formats aren’t checked for a label of their own.

Once you set a list, the connector also blocks all OneNote, Loop, and Whiteboard items, and any item it checks whose label it can’t read, such as a password-encrypted file. Results of a file search or a whole-mailbox search also stop showing text excerpts. With or without a list, the connector refuses to overwrite a Word, Excel, PowerPoint, PDF, or MP4 file that Microsoft reports as labeled, because replacing the content could remove the label.

Set up the label list

Update Claude Desktop first. Files are checked starting with version 2.37337.1, and email starting with version 5.1231.0. Versions before 2.37337.1 ignore the list. Devices on the staggered release channel get releases later.

If a Claude apps gateway serves your Claude Desktop settings, upgrade every gateway replica to Claude Code v2.1.321 or later before you add sensitivityLabels. An earlier gateway won’t start if the field is there. In the gateway’s policy, write managedMcpServers as a YAML list, not as one quoted string. If more than one policy has a Microsoft 365 entry, add the labels to each.

Find the label GUIDs

You list each label by its GUID, not its name. Connect to Security & Compliance PowerShell and run this command:

Get-Label | Format-Table DisplayName, Name, Guid

Listing a parent label doesn’t block its sublabels, so list each sublabel you want blocked.

Add the labels to the connector's entry

In the in-app configuration window or the Enterprise Admin Console, go to Connectors and open your Microsoft 365 server. Under Sensitivity labels, click Add for each label. Paste the GUID into Label GUID, and make sure that Effect is set to block.If you write the JSON, plist, or registry value yourself, add sensitivityLabels inside the Microsoft 365 entry in managedMcpServers:

{
  "name": "Microsoft 365",
  "server": "microsoft365",
  "tenantId": "DIRECTORY_TENANT_ID",
  "clientId": "APPLICATION_CLIENT_ID",
  "sensitivityLabels": [
    { "labelId": "LABEL_GUID_1", "effect": "block" },
    { "labelId": "LABEL_GUID_2", "effect": "block" }
  ]
}

You can list up to 48 labels. With a label list, the entry’s tenantId must be your tenant’s GUID, not common, organizations, or consumers. If you have more than one local Microsoft 365 entry, add the list to each, because a list covers only its own entry.

Restart and test

The list takes effect when Claude Desktop restarts. On one device, ask Claude to read a file that carries a listed label and a file that doesn’t. If the list works, Claude can’t read the first file but can read the second. The connector’s log, mcp-server-office365-builtin.log, also has a line with "event":"local_label_policy_loaded", where "labelCount" is the number of labels you listed.

If the list isn’t valid, the connector stays turned off until you fix it. If the list is in the wrong place or its field name is misspelled, nothing is blocked and managed devices show no error. In both cases, main.log says what is wrong. See Troubleshoot the local connector.

What label blocking doesn’t cover

The list doesn’t block the following:

Other file types: such as text files, images, and archives, whether they’re in SharePoint or OneDrive or attached to an email that isn’t blocked
Other Microsoft 365 content: Teams messages, SharePoint site pages, meeting transcripts, and calendar events, even for an invitation that is blocked as an email
Quoted email: a reply or forward that quotes a blocked email, unless it carries a listed label itself
Names: Claude can still see file and attachment names in listings, and file names and email headers, such as the subject and sender, in search results
Files inside a folder: when Claude moves, copies, or deletes a folder, the files inside aren’t checked
Other routes to Claude: files users upload, folders on the device, other connectors, and the remote Microsoft 365 connector
Devices without a device-management profile: the user can edit the configuration and remove the list

Purview label blocking relies on sensitivity-label information returned by Microsoft’s APIs or stored in the document itself. Anthropic does not control or independently verify the accuracy, completeness, or timeliness of the label information. Label blocking is a retrieval filter, not a security control: it supplements, and does not replace, your organization’s own access controls, data loss prevention, and data-handling policies. After the configuration is deployed, the connector appears in Customize → Connectors in Claude Desktop. Sign-in starts when the user selects Connect. On both Windows and macOS, sign-in goes through the device’s native authentication broker when the device is set up for it: a system account-picker dialog appears instead of the browser, and the issued tokens carry the device identity claim that device-based Conditional Access policies (such as Require compliant device) evaluate. When the broker is unavailable, sign-in opens the system browser instead. The microsoftAuthBroker configuration key controls whether sign-in uses the broker or the browser. auto (the default) uses the broker where it is available and the browser otherwise, disabled always uses the browser, and required makes sign-in fail when the broker is unavailable instead of opening the browser, so the refresh token stays held by the broker. Set required only after every device that receives the configuration is on Claude Desktop 1.49585.0 or later, because earlier versions read required as disabled and fall back to browser-only sign-in. Linux has no broker, so required is not supported there. Browser sign-in works on tenants without device-based Conditional Access policies. It satisfies device policies only when the browser itself carries the device identity: on Windows, a browser signed in with the work account on an Entra-joined device (such as Microsoft Edge) provides this; on macOS, deploy Microsoft’s Enterprise SSO browser integration, or use brokered sign-in instead.

Windows 10 or later (desktop editions). The broker (Web Account Manager, or WAM) is built into Windows; no separate install is needed.
The device is joined or registered to Entra ID (Entra joined, Entra hybrid joined, or Entra registered). For device-based Conditional Access, the device must also be marked compliant in Intune or hybrid-joined, as your policy requires.
The broker redirect URI is registered on the local-mode app under Mobile and desktop applications, with APPLICATION_CLIENT_ID replaced by the Application (client) ID from step 1:

ms-appx-web://Microsoft.AAD.BrokerPlugin/APPLICATION_CLIENT_ID

If a brokered attempt fails with an error the broker cannot recover from, the connector falls back to the system browser automatically.A missing broker redirect URI does not trigger the fallback on Windows. The broker shows Entra error AADSTS50011 in its own sign-in dialog, and closing that dialog counts as canceling, so every sign-in attempt ends at the same error until you register the URI above. To have users sign in through the browser instead of the broker, set microsoftAuthBroker to disabled in the managed configuration. Tokens from browser sign-in carry no device identity claim unless the browser itself provides one, so device-based Conditional Access policies block them.To have Connect sign in with the work account already signed in to Windows, without the account picker, set microsoftAuthDefaultAccount to enabled. See the key’s reference entry for the requirements and the cases where users still get the picker.

The Mac is enrolled in an MDM (Intune, Jamf, or similar), registered in Entra ID, and marked compliant. For non-Intune MDMs, use the partner device-compliance integration that reports compliance to Intune and Entra.
Intune Company Portal is installed; it provides the broker.
An Extensible SSO configuration profile of type Redirect, pointed at the Microsoft Enterprise SSO plug-in, is deployed through MDM. The broker is unavailable without it.
The broker redirect URI is registered on the local-mode app under Mobile and desktop applications (it appears under the iOS / macOS section after saving):

msauth.com.anthropic.claudefordesktop://auth

If the app registration also lists msauth.com.anthropic.claudefordesktop.helper://auth, remove that entry. Claude Desktop does not use it.If the broker rejects the app’s sign-in request, or a brokered attempt fails with an error the broker cannot recover from, the connector falls back to the system browser automatically. A fallback most often comes from a missing broker redirect URI or SSO profile.

After a brokered attempt falls back to the system browser, the connector stays on the browser flow until Claude Desktop restarts. On tenants that require a compliant device, tool calls then fail with AADSTS53003, unless the browser itself carries the device identity. Fix the broker requirement that caused the fallback, then restart the app. A fallback is recorded in the connector’s log file as a local_auth_broker_fallback event. A user canceling the broker dialog doesn’t trigger the fallback.

Token storage and sign-out

The connector’s Entra tokens are stored on the device, encrypted by Claude Desktop using the operating system’s secure storage. Each configured entry has its own token store, and tokens persist across app restarts so users are not asked to sign in again each session. Selecting Disconnect next to the connector signs the user out and deletes its stored tokens. Where the user signed in through the broker, the device’s work or school account itself is managed by the operating system and remains after Disconnect; remove the account in Windows Settings (Accounts → Access work or school) or macOS Company Portal, or revoke the user’s sessions in Entra, to end access entirely. With continuousAccessEvaluation at its default of enabled on Claude Desktop 1.49585.0 or later, Microsoft Graph rejects the connector’s current access token within minutes of the revocation. With continuousAccessEvaluation set to disabled, or on earlier app versions, revocation takes effect once the current one-hour access token expires.

Troubleshoot the local connector

Symptom	Cause	Fix
Connector missing from settings	The entry was rejected during configuration parsing: an unrecognized scope name in `scope`, a missing `tenantId` or `clientId`, a `sensitivityLabels` list that isn’t valid, or a `url`, `transport`, or `command` field mixed into the entry. If an entry with an invalid label list was the only entry in `managedMcpServers`, the app also blocks the tools of every plugin’s MCP servers until you fix it.	Check the app’s main log for a line naming the dropped entry
Sign-in opens the browser on a managed device where the broker was expected	macOS: Company Portal is not installed, the SSO configuration profile is not deployed, or the broker redirect URI is not registered. Windows: the device is not Entra-joined or Entra-registered, or `microsoftAuthBroker` is set to `disabled`	Re-check the requirements under How users sign in
`AADSTS50011` redirect mismatch	The redirect URI named in the error message (`http://localhost` for browser sign-in, or the platform’s broker redirect URI for brokered sign-in) is missing from the local-mode app registration, was entered with a different value, or was added under Web instead of Mobile and desktop applications	Add or correct that URI under Mobile and desktop applications (step 1.2, or How users sign in)
`AADSTS900971` no reply address provided	The macOS broker redirect URI is not registered on the local-mode app	Register `msauth.com.anthropic.claudefordesktop://auth` as described in step 1.2 (after you save, it appears under the iOS / macOS section)
`AADSTS65001` admin consent required	Graph delegated permissions were not admin-consented	Re-check step 1.4
`AADSTS53003` blocked by Conditional Access	A device-compliance policy is evaluating a sign-in that carries no device claim	Meet the brokered sign-in requirements for the platform, then restart Claude Desktop
`AADSTS7000218` request body must contain client_assertion or client_secret	Allow public client flows is set to No on the local-mode app registration, so brokered token requests are classified as confidential	Set Allow public client flows to Yes (step 1.3)
Tools return a permission error or Graph `403`	A scope the tool needs is not consented on the app registration, or is excluded by an explicit `scope` list	Add the scope in both places and grant admin consent
Claude reads content that carries a listed sensitivity label	The list is inside `toolPolicy`, on another kind of entry, or under a misspelled field name. Or the device runs an earlier Claude Desktop version. Or Microsoft reported no label, or a different label, for the item.	Look in `main.log` for a line that names the list’s field as you spelled it. Then find the `read_sensitivity_labels_observed` line (files) or the `mail_sensitivity_label_checked` line (email) in the connector’s log, and compare its `observedLabelIds` with your list. If a file shows no label, check that sensitivity labels are enabled for SharePoint and OneDrive files.
Claude can’t read content that carries no listed sensitivity label	The connector couldn’t read the item’s label	Find the `read_blocked_by_sensitivity_label` line (files) or the `mail_blocked_by_sensitivity_label` line (email) in the connector’s log. Its `code` names the cause.
Write tools are missing or fail	The matching write scope is not listed in the entry’s `scope` field	Add the scope to the entry and consent it on the app registration (see Grant write scopes)

The connector writes its sign-in and Microsoft Graph errors to its own log file in the Claude Desktop logs directory (~/Library/Logs/Claude-3p/ on macOS, %LOCALAPPDATA%\Claude-3p\logs\ on Windows), named mcp-server-office365-builtin.log. Configuration parsing and connection lifecycle messages appear in main.log in the same directory.

Choose a connector

Remote connector

How the connection works

Set up the remote connector

Sign in as a user

Allow the required network hosts

Control write actions on the remote connector

Revoke write scopes on the remote connector

Limit remote connector write actions to specific users

Require assignment on the connector app

Block remote connector write tools in Claude Desktop

Troubleshoot sign-in errors

Local connector

Set up the local connector

Configure scopes

Grant write scopes

Block content by sensitivity label

Set up the label list

What label blocking doesn’t cover

How users sign in

Token storage and sign-out

Troubleshoot the local connector