Connect to Microsoft 365 changedthird-party/claude-desktop/connectors-m365
Nearest release: v2.1.296, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 9 Oct 2026 14:43 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Oct 2026 15:07 UTC.
Upstream edited
Recorded here
Lines+16added
Lines−9removed
From line
23
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits15to this page, all time
The whole hunk
from line 23, old and new numbered
/
from line 23
2323| App registrations you own | One desktop client app, plus tenant consent to Anthropic's connector app | One dedicated public client app |
2424| Token exchange | On-behalf-of exchange in Anthropic's infrastructure | Tokens acquired and stored on the device |
2525| Allowlisting with Anthropic | Required (two to three business days) | Not needed |
26| Device egress | `login.microsoftonline.com` and the connector host | `login.microsoftonline.com` and `graph.microsoft.com` |
26| Device egress | `login.microsoftonline.com` and the connector host | `login.microsoftonline.com`, `graph.microsoft.com`, and your tenant's SharePoint and OneDrive hosts |
2727| Device-based Conditional Access | Not supported (the server-side exchange has no device identity) | Supported on managed Windows and Mac devices through brokered sign-in |
2828| Write actions | Available with [write scopes on the Anthropic connector app](#control-write-actions-on-the-remote-connector) | Available with [write scopes](#grant-write-scopes) |
2929| US Government clouds | Separate connector deployment; contact your Anthropic representative | Built in; set `azureCloud` |
from line 264
264264 </Step>
265265
266266 <Step title="Configure Claude Desktop">
267 In the Claude Desktop [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration), open **Connectors**, select **Add server**, and choose **Microsoft 365** under the **Built-in** group. Enter the values below, then select **Test connection** to verify that the server starts and lists its tools, and select **Save**.
267 In the Claude Desktop [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration), open **Connectors**, select **Add server**, and choose **Microsoft 365** under the **Built-in** group. Enter the values below, then select **Test this connection** to verify that the server starts and lists its tools, and select **Save**.
268268
269269 | Field | Value |
270270 | - | - |
from line 292
292292 | `tenantId` | Yes | Your Directory (tenant) ID. |
293293 | `azureCloud` | No | `global` (default), `us-gov-high`, or `us-gov-dod`. Selects the Microsoft Entra and Microsoft Graph hosts for US Government clouds. |
294294 | `continuousAccessEvaluation` | No | `enabled` (default) or `disabled`. When enabled, the connector requests Continuous Access Evaluation-capable Microsoft Graph tokens, which live up to about 28 hours and stop working within minutes after an administrator revokes the user's sessions or disables the account in Entra, and, where your tenant enforces an IP named-location or Global Secure Access compliant-network Conditional Access policy, when the token is used from outside that network. `disabled` keeps standard one-hour tokens. A change applies to tokens issued after the connector next starts, and an already-issued token stays in use until it expires (select **Disconnect**, then **Connect**, to sign in again immediately). Requires Claude Desktop 1.49585.0 or later; earlier versions ignore the field and request standard one-hour tokens. |
295 | `scope` | No | Space-separated delegated Graph scopes to request instead of the default read set. A string array named `scopes` is also accepted only before 12:00 PM Pacific Time (19:00 UTC) on October 7, 2026. See [Configure scopes](#configure-scopes). |
295 | `scope` | No | Space-separated delegated Graph scopes to request instead of the default read set. The app rejects an entry that has a `scopes` array, so write the scopes as one string. See [Configure scopes](#configure-scopes). |
296296 | `toolPolicy` | No | Per-tool approval locks, the same as for any managed server. See [`toolPolicy`](/docs/third-party/claude-desktop/configuration#managedmcpservers). |
297297
298298 The server ships inside the app, so nothing else needs to be installed on the device, and it activates only from managed configuration; users cannot add it themselves. Deploy the configuration through your device-management tool as usual.
from line 305
305305 | - | - |
306306 | `login.microsoftonline.com` | Microsoft Entra sign-in |
307307 | `graph.microsoft.com` | Microsoft Graph data APIs |
308 | Your tenant's SharePoint and OneDrive hosts | Downloads of OneDrive and SharePoint files |
308309
309 US Government cloud deployments use `login.microsoftonline.us` and `graph.microsoft.us` (or `dod-graph.microsoft.us` for `us-gov-dod`) instead, matching the `azureCloud` setting. GCC High (`us-gov-high`) support has been confirmed in customer deployments. No egress to any Anthropic host is needed for Microsoft 365 data with the local connector.
310 To read Office documents, such as Word and PowerPoint files, the connector asks Microsoft Graph for a PDF version and follows the redirect Graph returns. Microsoft chooses the host in that redirect.
311
312 US Government cloud deployments use `login.microsoftonline.us` and `graph.microsoft.us` (or `dod-graph.microsoft.us` for `us-gov-dod`) instead of `login.microsoftonline.com` and `graph.microsoft.com`, matching the `azureCloud` setting. GCC High (`us-gov-high`) support has been confirmed in customer deployments. No egress to any Anthropic host is needed for Microsoft 365 data with the local connector.
310313 </Step>
311314</Steps>
312315
from line 332
329332
330333Six optional read scopes are not in the standard set:
331334
332* `ChannelMessage.Read.All` adds Teams channel messages to chat search results and lets Claude list a channel's messages (`teams_list_channel_messages`). Requires tenant-admin consent.
335* `ChannelMessage.Read.All` enables Teams message search (`chat_message_search`), including searches of 1:1 and group chats, and lets Claude list a channel's messages (`teams_list_channel_messages`). Requires tenant-admin consent.
333336* `OnlineMeetingTranscript.Read.All` enables reading meeting transcripts. Requires tenant-admin consent.
334337* `MailboxSettings.Read` lets the connector read the user's mailbox time zone so that dates in requests follow the user's local time rather than UTC.
335338* `People.Read` enables people search (`search_people`), which resolves a name to a user before starting a Teams chat.
336339* `Team.ReadBasic.All` and `Channel.ReadBasic.All` let Claude list the user's teams and their channels (`teams_list_teams`, `teams_list_channels`), which Claude uses to find the team and channel IDs that the channel-message tools take.
337340
338Until `ChannelMessage.Read.All` and `OnlineMeetingTranscript.Read.All` are granted, chat search omits channel results and transcript requests return a permission error. The `search_people`, `teams_list_teams`, and `teams_list_channels` tools require Claude Desktop version 1.32885.1 or later, and `teams_list_channel_messages` requires 1.49585.0 or later.
341Until `ChannelMessage.Read.All` is granted, Teams message search returns an error with an admin consent link, including for 1:1 and group chats. Claude can still list chats (`teams_list_chats`) and read their messages (`read_resource`) with `Chat.Read`. Until `OnlineMeetingTranscript.Read.All` is granted, transcript requests return a permission error. The `search_people`, `teams_list_teams`, and `teams_list_channels` tools require Claude Desktop version 1.32885.1 or later, and `teams_list_channel_messages` requires 1.49585.0 or later.
339342
343Grant admin consent for `ChannelMessage.Read.All` or `OnlineMeetingTranscript.Read.All` in Microsoft Entra before you list it in `scope`. While the connector requests one of these scopes without admin consent, Microsoft Entra refuses the whole token request (`AADSTS65001`) instead of leaving that scope out. If the entry has no `scope` field yet, list the standard read scopes as well, because `scope` replaces them.
344
340345The `scope` field accepts only scopes the connector can use. An entry containing an unrecognized scope name is rejected as a whole at configuration load, with an error in the app's main log listing the valid names, and the connector does not appear.
341346
342347<Note>
from line 356
351356| `outlook_calendar_search` | Search calendar events |
352357| `find_meeting_availability` | Find free meeting times |
353358| `outlook_find_available_time` | Find open time slots for a meeting between the user and specific participants |
354| `chat_message_search` | Search Teams chat (1:1 and group; channel messages need `ChannelMessage.Read.All`) |
359| `chat_message_search` | Search Teams messages in 1:1 chats, group chats, and channels (needs `ChannelMessage.Read.All` as well as `Chat.Read`) |
355360| `sharepoint_search`, `sharepoint_folder_search` | Search SharePoint and OneDrive |
356361| `read_resource` | Fetch a specific item, such as a message, event, or file |
357362| `teams_list_chats` | List the user's Teams chats and their members, to find a chat to read or post in |
from line 411
406411 If a brokered attempt fails with an error the broker cannot recover from, the connector falls back to the system browser automatically and stays on the browser flow until Claude Desktop restarts. A user canceling the broker dialog does not trigger the fallback. On tenants that require a compliant device, tool calls then fail with `AADSTS53003`, unless the browser itself carries the device identity (see above); fix the broker requirement that caused the fallback and restart the app. A fallback is recorded in the connector's log file as a `local_auth_broker_fallback` event.
407412
408413 A missing broker redirect URI does not trigger the fallback on Windows. The broker shows Entra error `AADSTS50011` in its own sign-in dialog, and closing that dialog counts as canceling, so every sign-in attempt ends at the same error until you register the URI above. To have users sign in through the browser instead of the broker, set [`microsoftAuthBroker`](/docs/third-party/claude-desktop/configuration#microsoftauthbroker) to `disabled` in the managed configuration. Tokens from browser sign-in carry no device identity claim unless the browser itself provides one (see above), so device-based Conditional Access policies block them.
414
415 To have **Connect** sign in with the work account already signed in to Windows, without the account picker, set [`microsoftAuthDefaultAccount`](/docs/third-party/claude-desktop/configuration#microsoftauthdefaultaccount) to `enabled`. See the key's reference entry for the requirements and the cases where users still get the picker.
409416 </Accordion>
410417
411418 <Accordion title="Requirements for brokered sign-in on macOS">
from line 443
436443
437444| Symptom | Cause | Fix |
438445| - | - | - |
439| **Test connection** reports that the built-in server is not included | The installed Claude Desktop version predates the built-in connector | Upgrade Claude Desktop |
446| **Test this connection** reports that the built-in server is not included | The installed Claude Desktop version predates the built-in connector | Upgrade Claude Desktop |
440447| **Microsoft 365** is missing from the **Add server** options | The installed Claude Desktop version predates the built-in connector | Upgrade Claude Desktop, or author the JSON entry directly |
441448| Connector missing from settings | The entry was rejected during configuration parsing: an unrecognized scope name in `scope`, a missing `tenantId` or `clientId`, or a `url`, `transport`, or `command` field mixed into the entry | Check the app's main log for a line naming the dropped entry |
442449| Sign-in opens the browser on a managed device where the broker was expected | macOS: Claude Desktop is older than 1.19367.0, Company Portal is not installed, the SSO configuration profile is not deployed, or the broker redirect URI is not registered. Windows: Claude Desktop is older than 1.13576.0, the device is not Entra-joined or Entra-registered, or `microsoftAuthBroker` is set to `disabled` | Re-check the brokered sign-in requirements above |
No line in this hunk matches that.