### Approve permissions added to the connector
The whole hunk
from line 19, old and new numbered
/
lines
from line 19
1919* **Send and manage email**, including drafts, labels, mail filters, and automatic replies
2020* **Manage calendar events** and find meeting times
2121* **Create and update files** in SharePoint
22* **Send Teams messages** in chats and channels
2223
2324## Setup requirements
2425
25On Free, Pro, and Max plans, no organization-level setup is needed. Connect from **Customize > Connectors** in claude.ai. A Microsoft Entra Global Administrator still needs to grant one-time tenant consent for your Microsoft organization.
26On Free, Pro, and Max plans, no organization-level setup is needed. Connect from **Customize > Connectors** in claude.ai. A Microsoft Entra Global Administrator still needs to grant tenant consent for your Microsoft organization.
2627
2728### Prerequisites
2829
from line 70
6970| **SharePoint/OneDrive** | Search and analyze documents; create and update files in SharePoint |
7071| **Outlook** | Search email threads and archived emails; send and manage mail; create, update, and delete calendar events |
7172| **Teams Calendar** | Review meeting summaries and attendance |
72| **Teams Chat** | Access channel and chat discussions |
73| **Teams Chat** | Access channel and chat discussions; send chat and channel messages |
7374
7475## Write actions
7576
76Claude can take actions in Outlook and SharePoint: send mail and manage drafts; organize mail with labels, filters, and trash; set automatic replies; create, update, and delete calendar events; and create and update files in SharePoint. Read and search tools work the same whether or not write actions are enabled.
77Claude can take actions in Outlook, SharePoint, and Teams. In Outlook, Claude sends mail and manages drafts, organizes mail with labels, filters, and trash, sets automatic replies, and creates, updates, and deletes calendar events. In SharePoint, Claude creates and updates files. In Teams, Claude sends chat and channel messages. Read and search tools work the same whether or not write actions are enabled.
7778
7879Write actions are controlled by your organization's administrators in two places:
7980
801. **Approve the write permissions.** If your tenant's consent for the connector covers only read permissions, a Microsoft Entra Global Administrator or Application Administrator approves the updated permission set (mail, calendar, mailbox settings, and file writes) under **Enterprise applications** in the Entra admin center. This is a one-time action per tenant.
812. **Turn on write actions.** If write actions are off for your organization, administrators turn them on for all users in the Microsoft 365 connector configuration, or enable them for specific users with role-based access control (beta).
811. **Approve the write permissions.** If your tenant approved the connector before a write permission (mail, calendar, mailbox settings, file writes, or Teams messages) was added, a Microsoft Entra Global Administrator or Application Administrator approves the added permissions once for the tenant. Reconnecting doesn't add them. See [Approve permissions added to the connector](#approve-permissions-added-to-the-connector).
822. **Turn on write actions.** If write actions are off for your organization, administrators turn them on for all users in the Microsoft 365 connector configuration, or enable them for specific users with role-based access control (beta). Administrators also check the restriction on each tool that sends Teams messages. Open the Microsoft 365 connector under **Organization settings > Connectors**, find **Tool permission restrictions**, and set each Teams messaging tool so that users can choose it. A per-tool restriction overrides the **Default restriction** row, so a tool that is blocked for all users stays unavailable until an administrator changes its restriction.
8283
83Claude cannot attach files to the drafts it creates and cannot send Teams messages.
84Claude cannot attach files to the drafts it creates.
8485
8586For setup steps, see [Connect to Microsoft 365](https://support.claude.com/en/articles/15183774-connect-to-microsoft-365) and [Set up the Microsoft 365 connector](https://support.claude.com/en/articles/12542951-set-up-the-microsoft-365-connector) in the help center. The [Microsoft 365 connector security guide](https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide) covers the permission model.
8687
from line 90
8990<Note>
9091 All permissions are delegated: Claude acts on behalf of users and can only access and change content that you already have permission to access and change in Microsoft 365. Write actions are available when your administrators enable them (see [Write actions](#write-actions)).
9192</Note>
93
94### Approve permissions added to the connector
95
96If your tenant approved the connector before Anthropic added a permission to it, the Claude feature that needs the permission fails with a permission error until a Microsoft Entra administrator approves it. For example, listing your teams fails until your tenant approves `Team.ReadBasic.All`. Disconnecting and reconnecting the connector in claude.ai doesn't add the permission, because Microsoft [doesn't show a consent screen again once the tenant has approved the connector](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-default-scope). The connector's **Permissions** page in the Entra admin center (under **Enterprise applications**, listed as **M365 MCP Server for Claude**) shows only the permissions your tenant has already approved, so a missing permission doesn't appear there.
97
98A Global Administrator or Application Administrator approves the added permissions for the whole tenant in three steps.
99
100<Steps>
101 <Step title="Open the admin consent link">
102 Replace `YOUR_TENANT_ID` with the Directory (tenant) ID shown in **Entra admin center > Overview**, then open the link. The `client_id` value is the connector's Application ID, shown on the **M365 MCP Server for Claude** enterprise application's **Overview** page.
103
104 ```text theme={null}
105 https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17
106 ```
107 </Step>
108
109 <Step title="Review the permissions and accept">
110 The consent screen lists every permission the connector requests, including any added since your tenant first approved it and the permissions that write actions need. The Teams tools use `Team.ReadBasic.All` to list teams, `People.Read` to look up people, and `ChatMessage.Send`, `ChannelMessage.Send`, and `Chat.Create` to send messages. Select **Accept**.
111 </Step>
112
113 <Step title="Confirm the approval">
114 Check the address bar of the page Microsoft sends you to. The approval succeeded when the address contains `admin_consent=True`, and the approved permissions then appear on the connector's **Permissions** page.
115 </Step>
116</Steps>
117
118Selecting **Grant admin consent for \{your organization}** on that **Permissions** page approves the same list.
119
120This link is for the connector used from claude.ai. If the Application ID on the enterprise application's **Overview** page differs from the one in the link (for example in a government deployment), use that ID instead. The Claude Desktop local connector and a self-hosted server use their own app registrations.
92121
93122## Troubleshooting
94123