### Foundry direct without an API key ### Identify Anthropic's Microsoft Entra application
The whole hunk
from line 13, old and new numbered
/
lines
from line 13
1313Four connection paths are available. Your IT admin selects one during
1414deployment. End users see the same interface regardless.
1515
16| Path | How it works |
17| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
18| LLM gateway | Requests route through your gateway (LiteLLM, Portkey, Kong, and others) to your chosen provider. Matches the pattern used by Claude Code. |
19| Bedrock direct | The add-in authenticates via Microsoft Entra ID and calls Amazon Bedrock directly without intermediaries. |
20| Vertex AI direct | The add-in authenticates through Google OAuth and calls Vertex AI directly. |
21| Foundry direct | The add-in authenticates directly to your Azure AI Foundry resource using its API key. |
16| Path | How it works |
17| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
18| LLM gateway | Requests route through your gateway (LiteLLM, Portkey, Kong, and others) to your chosen provider. Matches the pattern used by Claude Code. |
19| Bedrock direct | The add-in authenticates via Microsoft Entra ID and calls Amazon Bedrock directly without intermediaries. |
20| Vertex AI direct | The add-in authenticates through Google OAuth and calls Vertex AI directly. |
21| Foundry direct | The add-in calls your Azure AI Foundry resource directly, authenticating with each user's Microsoft Entra ID token (keyless) or with the resource API key. |
2222
2323## Requirements by connection path
2424
from line 31
3131 `Calendars.Read`, `User.Read`, and `offline_access`, granted via
3232 Anthropic's app or your own Entra app registration.
3333
34| Path | Additional requirements |
35| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| LLM gateway | Gateway URL and API token from your IT team. |
37| Bedrock direct | AWS account with Claude model access enabled in target region. IAM OIDC identity provider and role configured to trust Microsoft Entra ID tokens. |
38| Vertex AI direct | Google Cloud project with Vertex AI API enabled and Claude model access. Google OAuth client configured with the add-in's redirect URI. |
39| Foundry direct | Azure AI Foundry resource with at least one Claude model deployed. Deployment names must use default model IDs (for example, `claude-opus-4-6`), not custom names. Resource API key from Azure Portal, your Foundry resource, Keys and Endpoint, KEY 1. |
34| Path | Additional requirements |
35| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| LLM gateway | Gateway URL and API token from your IT team. |
37| Bedrock direct | AWS account with Claude model access enabled in target region. IAM OIDC identity provider and role configured to trust Microsoft Entra ID tokens. |
38| Vertex AI direct | Google Cloud project with Vertex AI API enabled and Claude model access. Google OAuth client configured with the add-in's redirect URI. |
39| Foundry direct | Azure AI Foundry resource with at least one Claude model deployed. Deployment names must use default model IDs (for example, `claude-opus-4-6`), not custom names. Then one credential path: **keyless**, your own Entra app registration with the Azure Cognitive Services `user_impersonation` delegated permission (admin-consented) and users holding the Cognitive Services User role on the resource (see [Foundry direct without an API key](#foundry-direct-without-an-api-key)); or the resource API key from Azure Portal, your Foundry resource, Keys and Endpoint, KEY 1. |
4040
4141Your organization's IT team manages these resources. Anthropic cannot
4242provide or reset credentials.
from line 143
143143* **Vertex AI direct**: walks through Google OAuth client creation,
144144 generates the manifest, handles Azure admin consent.
145145* **Foundry direct**: captures `azure_resource_name` and
146 `azure_api_key`, then generates the manifest.
146 `azure_api_key`, then generates the manifest. For keyless Entra ID
147 sign-in, add the parameters described in
148 [Foundry direct without an API key](#foundry-direct-without-an-api-key)
149 to the generated manifest.
147150
148151When complete, the add-in is ready for tenant-wide deployment.
149152
from line 334
331334 For Vertex AI, sign in with the Google account your admin authorized
332335 via the Google OAuth client created during setup.
333336 For Foundry, the add-in connects automatically if your admin
334 pre-filled the Azure resource name and API key. Otherwise, enter the
335 values your IT team provided and select Connect.
337 pre-filled the Azure resource name and API key. If your admin enabled
338 keyless sign-in, the add-in uses your Microsoft work account and no
339 key is involved. Otherwise, enter the values your IT team provided
340 and select Connect.
336341 </Step>
337342
338343 <Step title="Start working">
from line 367
362367 <img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/vertex-direct.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=a33063abcecbfc36e346621f735453ef" alt="The add-in authenticates through Google OAuth and calls Google Cloud Vertex AI directly." width="2540" height="1030" data-path="images/office-agents/architecture/vertex-direct.png" />
363368</Frame>
364369
370### Foundry direct without an API key
371
372Instead of a shared resource key, each user can authenticate to your
373Foundry resource with their own Microsoft Entra ID token. The add-in
374acquires the token through Nested App Authentication inside Office,
375sends it to `<resource>.services.ai.azure.com` as `Authorization: Bearer`,
376renews it silently before it expires, and re-authenticates once if Azure
377rejects a token early. No key is stored on the device and no key is
378embedded in the manifest.
379
380This uses the same Entra app registration that Claude Desktop's
381in-app Foundry sign-in uses (`inferenceFoundryClientId`), with the add-in's
382redirect URI added. Set up:
383
3841. In your Entra app registration, add the **Azure Cognitive Services**
385 delegated permission `user_impersonation` and grant admin consent.
386 Register the add-in's redirect URI as described in
387 [Use your own Entra app instead](/docs/office-agents/outlook#use-your-own-entra-app-instead).
3882. Grant the users or groups who will sign in the **Cognitive Services
389 User** role on the Foundry resource.
3903. Put these parameters in the manifest URL (no `azure_api_key`):
391
392| Parameter | Value |
393| --------------------- | ----------------------------------------------------------- |
394| `azure_resource_name` | Your Foundry resource name. |
395| `entra_sso` | `1` |
396| `graph_client_id` | The application (client) ID of your Entra app registration. |
397| `entra_scope` | `https://cognitiveservices.azure.com/.default` |
398| `gateway_auth_source` | `entra` |
399
400When `gateway_auth_source=entra` is set, the add-in ignores any
401`azure_api_key` it receives: the administrator chose keyless sign-in.
402Each user sees a one-time Microsoft sign-in prompt if silent sign-in is
403not available; afterwards the add-in connects automatically.
404
365405### Change or update your gateway connection
366406
367407If your gateway API token expires or your IT team provides a new URL,
from line 500
460500If your team already runs Claude Code through a gateway, the table
461501below summarizes how the Office add-in setup differs.
462502
463| Aspect | Claude Code | Office add-ins |
464| ------------------ | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
465| Credential storage | OS keychain or environment variables | Browser localStorage (sandboxed iframe) |
466| Auth configuration | Environment variables, settings file, helper scripts | Manual entry in add-in UI (gateway), Entra ID (Bedrock), Google OAuth (Vertex AI), or Azure API key (Foundry) |
467| Token refresh | Supports helper scripts for rotation | Automatic via a bootstrap endpoint (gateway), Entra ID (Bedrock), or Google OAuth (Vertex AI); gateway tokens entered manually in the add-in UI require re-entry in settings |
468| Custom model names | Configurable via environment variables | Not configurable in v1 |
503| Aspect | Claude Code | Office add-ins |
504| ------------------ | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
505| Credential storage | OS keychain or environment variables | Browser localStorage (sandboxed iframe) |
506| Auth configuration | Environment variables, settings file, helper scripts | Manual entry in add-in UI (gateway), Entra ID (Bedrock, keyless Foundry), Google OAuth (Vertex AI), or Azure API key (Foundry) |
507| Token refresh | Supports helper scripts for rotation | Automatic via a bootstrap endpoint (gateway), Entra ID (Bedrock, keyless Foundry), or Google OAuth (Vertex AI); gateway tokens entered manually in the add-in UI require re-entry in settings |
508| Custom model names | Configurable via environment variables | Not configurable in v1 |
469509
470510When gateway configuration comes from a bootstrap endpoint, the add-in
471511keeps the token current without user action. It calls the bootstrap
from line 625
585625
586626To route a full audit trail, including prompts, tool inputs, tool
587627outputs, and document references, to your own infrastructure, see
588[Configure a custom OpenTelemetry collector for Claude for M365](https://support.claude.com/en/articles/14447276-configure-a-custom-opentelemetry-collector-for-office-agents).
628[Configure a custom OpenTelemetry collector](/docs/office-agents/opentelemetry).
629That page covers the `otlp_endpoint`, `otlp_headers`, and
630`otlp_attr_max_chars` configuration keys, the CORS requirements for the
631collector endpoint, and the full span reference.
589632
590The prompt, tool-input, and tool-output span attributes in that audit
591trail are truncated in the add-in at 4,000 characters each by default,
592marked with a trailing `…[truncated]`.
593
594To change the cap, set the `otlp_attr_max_chars` configuration key, for
595example as a manifest parameter, to a positive integer. Values are
596clamped to between 256 and 32,000. Before raising the cap, confirm that
597your collector and tracing backend accept attribute values of the
598configured size: many backends truncate or drop over-limit attributes at
599ingest, and a dropped span is lost from the audit trail entirely.
600
601633## Why sign-in redirects through pivot.claude.ai
602634
603635During Google sign-in for Vertex AI, Anthropic sign-in, or Microsoft admin
from line 713
681713directly. The Graph token never reaches `pivot.claude.ai` or any other
682714Anthropic endpoint.
683715
716### Identify Anthropic's Microsoft Entra application
717
718The admin consent link and Nested App Authentication both use a single
719multi-tenant application that Anthropic publishes in Microsoft Entra ID.
720When you review the consent prompt or the resulting enterprise
721application in your tenant, confirm it matches these values.
722
723| Field | Value |
724| ----------------------- | ---------------------------------------- |
725| Display name | Claude for Office |
726| Application (client) ID | `c2995f31-11e7-4882-b7a7-ef9def0a0266` |
727| Publisher | Anthropic, PBC (verified publisher) |
728| Supported account types | Accounts in any organizational directory |
729
730The add-in uses the following redirect URIs for sign-in. Each one exists
731for a specific sign-in path, and none of them receives a Microsoft
732access token in the URL.
733
734| Redirect URI | Platform | Purpose |
735| -------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------- |
736| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives `admin_consent` and `tenant` only |
737| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively |
738| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac |
739| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal |
740
684741### Verify this in your own environment
685742
686743You can confirm every claim above with a network capture on a test
from line 797
740797The auth token is invalid or expired. For gateway connections, confirm
741798the token with your IT team. For direct-cloud connections, verify the
742799user's Entra ID account is in the assigned group and that the OIDC trust
743or OAuth client is configured correctly. For Foundry, regenerate the key
744in Azure Portal, Keys and Endpoint.
800or OAuth client is configured correctly. For Foundry with an API key,
801regenerate the key in Azure Portal, Keys and Endpoint. For keyless
802Foundry sign-in, confirm the Entra app has the Azure Cognitive Services
803`user_impersonation` permission with admin consent and that
804`entra_scope` is `https://cognitiveservices.azure.com/.default`.
745805
746806### 403 Forbidden or "Access denied"
747807
from line 810
750810your Google account has the Vertex AI User role on the project. For
751811gateways, check the token's scope with your IT admin. For Foundry, check
752812the resource's networking rules, or confirm the key belongs to the right
753resource.
813resource. For keyless Foundry sign-in, confirm the user holds the
814Cognitive Services User role on the resource.
754815
755816### 404 Not found
756817