Connect to Microsoft 365 changedthird-party/claude-desktop/connectors-m365
Nearest release: v2.1.314, published 18 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 30 Oct 2026 18:36 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 30 Oct 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+9added
Lines−7removed
From line
34
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits21to this page, all time
The whole hunk
from line 34, old and new numbered
/
from line 34
3434
3535Anthropic's connector service receives the desktop's delegated access token on each request and exchanges it on-behalf-of the user for a short-lived Graph token. Neither token is persisted server-side beyond the request, and Anthropic never holds your tenant's client secrets or the user's refresh token (the refresh token stays encrypted on the user's device).
3636
37Setup takes about fifteen minutes and requires a Global Administrator or Cloud Application Administrator in your Entra tenant.
37Setup requires a Global Administrator or Cloud Application Administrator in your Entra tenant.
3838
3939The hosted M365 server has not been evaluated for HIPAA compliance. If your organization follows HIPAA compliance, please use the [local connector](#local-connector) instead.
4040
from line 52
5252
5353### Set up the remote connector
5454
55The four steps below cover tenant consent, app registration, allowlisting, and desktop configuration.
56
5755**1. Consent the Anthropic connector app into your tenant**
5856
5957A tenant administrator must consent to Anthropic's multi-tenant connector app once for the organization. This creates a service principal in your tenant; no secret is exchanged.
from line 242
244242
245243Claude Desktop includes a built-in copy of the Microsoft 365 server. As an alternative to the remote connector, you can configure the app to run that server as a local process on each user's machine: the user signs in to Microsoft Entra on the device, and the server calls Microsoft Graph directly from the device. No Microsoft 365 data or tokens pass through Anthropic's infrastructure.
246244
247Choose the local connector when your data-residency requirements do not allow Microsoft 365 content to transit infrastructure outside your control, when your tenant enforces device-based Conditional Access policies (such as *Require compliant device*) that the remote connector's server-side token exchange cannot satisfy, or when you want to avoid the allowlisting step. The [comparison table](#choose-a-connector) above summarizes the differences.
245Choose the local connector in any of these cases:
248246
247* Your data-residency requirements do not allow Microsoft 365 content to transit infrastructure outside your control.
248* Your tenant enforces device-based Conditional Access policies (such as *Require compliant device*) that the remote connector's server-side token exchange cannot satisfy.
249* You want to avoid the allowlisting step.
250
251See the [comparison table](#choose-a-connector).
252
249253### Set up the local connector
250254
251255**1. Register a public client app for local mode**
from line 289
285289| Field | Required | Description |
286290| - | - | - |
287291| `name` | Yes | Unique display name, shown to users in connector settings. |
288| `server` | Yes | Must be `microsoft365`. Built-in entries use this field instead of `url`, `transport`, or `command`; an entry that mixes `server` with those fields is rejected. |
292| `server` | Yes | Must be `microsoft365`. An entry that mixes `server` with `url`, `transport`, or `command` is rejected. |
289293| `clientId` | Yes | The Application (client) ID of the local-mode app from step 1. |
290294| `tenantId` | Yes | Your Directory (tenant) ID. |
291295| `azureCloud` | No | `global` (default), `us-gov-high`, or `us-gov-dod`. Selects the Microsoft Entra and Microsoft Graph hosts for GCC High and DoD. |
from line 364
360364| `search_people` | Search for people by name or email address (needs `People.Read`) |
361365| `teams_list_teams`, `teams_list_channels` | List the user's teams and a team's channels (need `Team.ReadBasic.All` and `Channel.ReadBasic.All`) |
362366| `teams_list_channel_messages` | List a channel's messages, or the replies in one conversation (needs `ChannelMessage.Read.All`) |
363
364Granting write scopes enables write tools; see [Grant write scopes](#grant-write-scopes).
365367
366368### Grant write scopes
367369
No line in this hunk matches that.