Page history
Use Claude for M365 with third-party platforms
office-agents/third-party-platforms
History
office-agents/third-party-platforms Changed · +42 / -10 lines
### Admin feature controls
from line 205
<img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/config-discovery.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=b6c750272cf3ad9765ec2563af436806" alt="The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters." width="2398" height="1670" data-path="images/office-agents/architecture/config-discovery.png" /> </Frame> +### Admin feature controls + +The `disabled_features` configuration key turns off individual add-in +features for your users. It travels over the same three channels as every +other key: manifest parameters (comma-separated), Entra ID extension +attributes (comma-separated), or a bootstrap endpoint (JSON array), so it +can apply org-wide from one manifest or vary per user. + +| Slug | Effect | +| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `skills.authoring` | Blocks creating, editing, and uploading skills. Running admin-provisioned skills is unaffected. | +| `thumbs` | Blocks response feedback (thumbs up / down and the follow-up prompt). | +| `addin.access` | Kill switch: the add-in refuses to run. | +| `file.upload` | Blocks attaching files to the conversation. | +| `web_search` | Removes the built-in web search and web fetch tools, whose queries are served by Anthropic's search provider, along with the user-facing web search toggle. Code execution is unaffected. | + +Unknown slugs are ignored, so setting a slug from a newer add-in version +on an older deployment is safe. + +Disabling `web_search` pairs with the `mcp_servers` key: attach your own +search tool from a server inside your network, and with the built-in +search disabled the model uses the tool you provide. This keeps search +queries on infrastructure you control. + +For document-scoped control, such as disabling a feature only on files +carrying certain sensitivity labels, use the `access_policies` key +instead; a statement without a resource behaves exactly like +`disabled_features`. The setup wizard's +`/claude-for-msft-365-install:manifest` and +`/claude-for-msft-365-install:access-policies` commands document both +keys in full. + ### Deploy to Outlook Outlook requires a separate manifest file from Excel, PowerPoint, and
from line 759
| Publisher | Anthropic, PBC (verified publisher) | | Supported account types | Accounts in any organizational directory | -The add-in uses the following redirect URIs for sign-in. Each one exists -for a specific sign-in path, and none of them receives a Microsoft -access token in the URL. +The add-in uses the following redirect URIs with this application. Each +one exists for a specific Microsoft sign-in path, and none of them +receives a Microsoft access token in the URL. -| Redirect URI | Platform | Purpose | -| -------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------- | -| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives `admin_consent` and `tenant` only | -| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively | -| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac | -| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal | +| Redirect URI | Platform | Purpose | +| -------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives only `admin_consent` and `tenant` from Microsoft. Google sign-in for Vertex AI reuses this URI for its [OAuth authorization-code redirect](#oauth-authorization-code-redirects) | +| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively | +| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac | +| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal | ### Verify this in your own environment
office-agents/third-party-platforms Changed · +97 / -36 lines
### Foundry direct without an API key ### Identify Anthropic's Microsoft Entra application
from line 13
Four connection paths are available. Your IT admin selects one during deployment. End users see the same interface regardless. -| Path | How it works | -| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | -| LLM gateway | Requests route through your gateway (LiteLLM, Portkey, Kong, and others) to your chosen provider. Matches the pattern used by Claude Code. | -| Bedrock direct | The add-in authenticates via Microsoft Entra ID and calls Amazon Bedrock directly without intermediaries. | -| Vertex AI direct | The add-in authenticates through Google OAuth and calls Vertex AI directly. | -| Foundry direct | The add-in authenticates directly to your Azure AI Foundry resource using its API key. | +| Path | How it works | +| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | +| LLM gateway | Requests route through your gateway (LiteLLM, Portkey, Kong, and others) to your chosen provider. Matches the pattern used by Claude Code. | +| Bedrock direct | The add-in authenticates via Microsoft Entra ID and calls Amazon Bedrock directly without intermediaries. | +| Vertex AI direct | The add-in authenticates through Google OAuth and calls Vertex AI directly. | +| Foundry direct | The add-in calls your Azure AI Foundry resource directly, authenticating with each user's Microsoft Entra ID token (keyless) or with the resource API key. | ## Requirements by connection path
from line 31
`Calendars.Read`, `User.Read`, and `offline_access`, granted via Anthropic's app or your own Entra app registration. -| Path | Additional requirements | -| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| LLM gateway | Gateway URL and API token from your IT team. | -| Bedrock direct | AWS account with Claude model access enabled in target region. IAM OIDC identity provider and role configured to trust Microsoft Entra ID tokens. | -| Vertex AI direct | Google Cloud project with Vertex AI API enabled and Claude model access. Google OAuth client configured with the add-in's redirect URI. | -| Foundry direct | Azure AI Foundry resource with at least one Claude model deployed. Deployment names must use default model IDs (for example, `claude-opus-4-6`), not custom names. Resource API key from Azure Portal, your Foundry resource, Keys and Endpoint, KEY 1. | +| Path | Additional requirements | +| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| LLM gateway | Gateway URL and API token from your IT team. | +| Bedrock direct | AWS account with Claude model access enabled in target region. IAM OIDC identity provider and role configured to trust Microsoft Entra ID tokens. | +| Vertex AI direct | Google Cloud project with Vertex AI API enabled and Claude model access. Google OAuth client configured with the add-in's redirect URI. | +| Foundry direct | Azure AI Foundry resource with at least one Claude model deployed. Deployment names must use default model IDs (for example, `claude-opus-4-6`), not custom names. Then one credential path: **keyless**, your own Entra app registration with the Azure Cognitive Services `user_impersonation` delegated permission (admin-consented) and users holding the Cognitive Services User role on the resource (see [Foundry direct without an API key](#foundry-direct-without-an-api-key)); or the resource API key from Azure Portal, your Foundry resource, Keys and Endpoint, KEY 1. | Your organization's IT team manages these resources. Anthropic cannot provide or reset credentials.
from line 143
* **Vertex AI direct**: walks through Google OAuth client creation, generates the manifest, handles Azure admin consent. * **Foundry direct**: captures `azure_resource_name` and - `azure_api_key`, then generates the manifest. + `azure_api_key`, then generates the manifest. For keyless Entra ID + sign-in, add the parameters described in + [Foundry direct without an API key](#foundry-direct-without-an-api-key) + to the generated manifest. When complete, the add-in is ready for tenant-wide deployment.
from line 334
For Vertex AI, sign in with the Google account your admin authorized via the Google OAuth client created during setup. For Foundry, the add-in connects automatically if your admin - pre-filled the Azure resource name and API key. Otherwise, enter the - values your IT team provided and select Connect. + pre-filled the Azure resource name and API key. If your admin enabled + keyless sign-in, the add-in uses your Microsoft work account and no + key is involved. Otherwise, enter the values your IT team provided + and select Connect. </Step> <Step title="Start working">
from line 367
<img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/vertex-direct.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=a33063abcecbfc36e346621f735453ef" alt="The add-in authenticates through Google OAuth and calls Google Cloud Vertex AI directly." width="2540" height="1030" data-path="images/office-agents/architecture/vertex-direct.png" /> </Frame> +### Foundry direct without an API key + +Instead of a shared resource key, each user can authenticate to your +Foundry resource with their own Microsoft Entra ID token. The add-in +acquires the token through Nested App Authentication inside Office, +sends it to `<resource>.services.ai.azure.com` as `Authorization: Bearer`, +renews it silently before it expires, and re-authenticates once if Azure +rejects a token early. No key is stored on the device and no key is +embedded in the manifest. + +This uses the same Entra app registration that Claude Desktop's +in-app Foundry sign-in uses (`inferenceFoundryClientId`), with the add-in's +redirect URI added. Set up: + +1. In your Entra app registration, add the **Azure Cognitive Services** + delegated permission `user_impersonation` and grant admin consent. + Register the add-in's redirect URI as described in + [Use your own Entra app instead](/docs/office-agents/outlook#use-your-own-entra-app-instead). +2. Grant the users or groups who will sign in the **Cognitive Services + User** role on the Foundry resource. +3. Put these parameters in the manifest URL (no `azure_api_key`): + +| Parameter | Value | +| --------------------- | ----------------------------------------------------------- | +| `azure_resource_name` | Your Foundry resource name. | +| `entra_sso` | `1` | +| `graph_client_id` | The application (client) ID of your Entra app registration. | +| `entra_scope` | `https://cognitiveservices.azure.com/.default` | +| `gateway_auth_source` | `entra` | + +When `gateway_auth_source=entra` is set, the add-in ignores any +`azure_api_key` it receives: the administrator chose keyless sign-in. +Each user sees a one-time Microsoft sign-in prompt if silent sign-in is +not available; afterwards the add-in connects automatically. + ### Change or update your gateway connection If your gateway API token expires or your IT team provides a new URL,
from line 500
If your team already runs Claude Code through a gateway, the table below summarizes how the Office add-in setup differs. -| Aspect | Claude Code | Office add-ins | -| ------------------ | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Credential storage | OS keychain or environment variables | Browser localStorage (sandboxed iframe) | -| Auth configuration | Environment variables, settings file, helper scripts | Manual entry in add-in UI (gateway), Entra ID (Bedrock), Google OAuth (Vertex AI), or Azure API key (Foundry) | -| Token refresh | Supports helper scripts for rotation | Automatic via a bootstrap endpoint (gateway), Entra ID (Bedrock), or Google OAuth (Vertex AI); gateway tokens entered manually in the add-in UI require re-entry in settings | -| Custom model names | Configurable via environment variables | Not configurable in v1 | +| Aspect | Claude Code | Office add-ins | +| ------------------ | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Credential storage | OS keychain or environment variables | Browser localStorage (sandboxed iframe) | +| Auth configuration | Environment variables, settings file, helper scripts | Manual entry in add-in UI (gateway), Entra ID (Bedrock, keyless Foundry), Google OAuth (Vertex AI), or Azure API key (Foundry) | +| Token refresh | Supports helper scripts for rotation | Automatic via a bootstrap endpoint (gateway), Entra ID (Bedrock, keyless Foundry), or Google OAuth (Vertex AI); gateway tokens entered manually in the add-in UI require re-entry in settings | +| Custom model names | Configurable via environment variables | Not configurable in v1 | When gateway configuration comes from a bootstrap endpoint, the add-in keeps the token current without user action. It calls the bootstrap
from line 625
To route a full audit trail, including prompts, tool inputs, tool outputs, and document references, to your own infrastructure, see -[Configure a custom OpenTelemetry collector for Claude for M365](https://support.claude.com/en/articles/14447276-configure-a-custom-opentelemetry-collector-for-office-agents). +[Configure a custom OpenTelemetry collector](/docs/office-agents/opentelemetry). +That page covers the `otlp_endpoint`, `otlp_headers`, and +`otlp_attr_max_chars` configuration keys, the CORS requirements for the +collector endpoint, and the full span reference. -The prompt, tool-input, and tool-output span attributes in that audit -trail are truncated in the add-in at 4,000 characters each by default, -marked with a trailing `…[truncated]`. - -To change the cap, set the `otlp_attr_max_chars` configuration key, for -example as a manifest parameter, to a positive integer. Values are -clamped to between 256 and 32,000. Before raising the cap, confirm that -your collector and tracing backend accept attribute values of the -configured size: many backends truncate or drop over-limit attributes at -ingest, and a dropped span is lost from the audit trail entirely. - ## Why sign-in redirects through pivot.claude.ai During Google sign-in for Vertex AI, Anthropic sign-in, or Microsoft admin
from line 713
directly. The Graph token never reaches `pivot.claude.ai` or any other Anthropic endpoint. +### Identify Anthropic's Microsoft Entra application + +The admin consent link and Nested App Authentication both use a single +multi-tenant application that Anthropic publishes in Microsoft Entra ID. +When you review the consent prompt or the resulting enterprise +application in your tenant, confirm it matches these values. + +| Field | Value | +| ----------------------- | ---------------------------------------- | +| Display name | Claude for Office | +| Application (client) ID | `c2995f31-11e7-4882-b7a7-ef9def0a0266` | +| Publisher | Anthropic, PBC (verified publisher) | +| Supported account types | Accounts in any organizational directory | + +The add-in uses the following redirect URIs for sign-in. Each one exists +for a specific sign-in path, and none of them receives a Microsoft +access token in the URL. + +| Redirect URI | Platform | Purpose | +| -------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------- | +| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives `admin_consent` and `tenant` only | +| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively | +| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac | +| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal | + ### Verify this in your own environment You can confirm every claim above with a network capture on a test
from line 797
The auth token is invalid or expired. For gateway connections, confirm the token with your IT team. For direct-cloud connections, verify the user's Entra ID account is in the assigned group and that the OIDC trust -or OAuth client is configured correctly. For Foundry, regenerate the key -in Azure Portal, Keys and Endpoint. +or OAuth client is configured correctly. For Foundry with an API key, +regenerate the key in Azure Portal, Keys and Endpoint. For keyless +Foundry sign-in, confirm the Entra app has the Azure Cognitive Services +`user_impersonation` permission with admin consent and that +`entra_scope` is `https://cognitiveservices.azure.com/.default`. ### 403 Forbidden or "Access denied"
from line 810
your Google account has the Vertex AI User role on the project. For gateways, check the token's scope with your IT admin. For Foundry, check the resource's networking rules, or confirm the key belongs to the right -resource. +resource. For keyless Foundry sign-in, confirm the user holds the +Cognitive Services User role on the resource. ### 404 Not found
office-agents/third-party-platforms First recorded · 792 lines, first recorded
# Use Claude for M365 with third-party platforms ## Connection paths ## Requirements by connection path ## Network allowlist ### Anthropic API (1P) ### Third-party platforms (3P) ## Deploy the add-in for your organization ### Run the setup wizard ### Available commands ### What the wizard provisions ### Per-user configuration ### Deploy to Outlook ### Deploy to Microsoft 365 ## Connection instructions for end users ### LLM gateway ### Bedrock, Vertex AI, or Foundry direct ### Change or update your gateway connection ## Gateway requirements for IT teams ### CORS requirements ### Required endpoints ### Required header ### Authorization header ### Model discovery ### Differences from Claude Code gateway setup ## Example gateway configuration with LiteLLM ### Route to Anthropic directly ### Route to Amazon Bedrock ### Route to Google Cloud Vertex AI ### Route to Azure ## What Anthropic collects ## Why sign-in redirects through pivot.claude.ai ### OAuth authorization-code redirects ### Why the redirect cannot target localhost ### Microsoft admin-consent redirects ### Verify this in your own environment ## Differences from signing in with a Claude account ## Troubleshooting ### "Connection refused" or network error ### 401 Unauthorized or "Invalid token" ### 403 Forbidden or "Access denied" ### 404 Not found ### 500 or other server errors ### "No models available" ### Streaming responses fail or hang ### A feature I expected is not available
The first capture of this source. The page was already there, and this is what it said.
# Use Claude for M365 with third-party platforms
> Deploy the Office add-ins through Amazon Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM gateway, without individual Claude accounts.
Organizations using Amazon Bedrock, Google Cloud Vertex AI, Azure AI
Foundry, or an LLM gateway can deploy Claude's Office add-ins without
requiring individual Claude accounts. The add-in connects through your
organization's infrastructure, keeping prompts and responses within your
trust boundary.
## Connection paths
Four connection paths are available. Your IT admin selects one during
deployment. End users see the same interface regardless.
| Path | How it works |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| LLM gateway | Requests route through your gateway (LiteLLM, Portkey, Kong, and others) to your chosen provider. Matches the pattern used by Claude Code. |
| Bedrock direct | The add-in authenticates via Microsoft Entra ID and calls Amazon Bedrock directly without intermediaries. |
| Vertex AI direct | The add-in authenticates through Google OAuth and calls Vertex AI directly. |
| Foundry direct | The add-in authenticates directly to your Azure AI Foundry resource using its API key. |
## Requirements by connection path
All paths need:
* Claude for Excel, PowerPoint, Word, or Outlook installed from
Microsoft AppSource or via admin deployment.
* Microsoft 365 with Entra ID for admin consent and token issuance.
* For Outlook: Microsoft Graph admin consent for `Mail.ReadWrite`,
`Calendars.Read`, `User.Read`, and `offline_access`, granted via
Anthropic's app or your own Entra app registration.
| Path | Additional requirements |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| LLM gateway | Gateway URL and API token from your IT team. |
| Bedrock direct | AWS account with Claude model access enabled in target region. IAM OIDC identity provider and role configured to trust Microsoft Entra ID tokens. |
| Vertex AI direct | Google Cloud project with Vertex AI API enabled and Claude model access. Google OAuth client configured with the add-in's redirect URI. |
| Foundry direct | Azure AI Foundry resource with at least one Claude model deployed. Deployment names must use default model IDs (for example, `claude-opus-4-6`), not custom names. Resource API key from Azure Portal, your Foundry resource, Keys and Endpoint, KEY 1. |
Your organization's IT team manages these resources. Anthropic cannot
provide or reset credentials.
## Network allowlist
The add-in requires access to specific domains. The required domains
differ depending on whether your organization uses the Anthropic API
directly (1P) or a third-party platform (3P).
<Note>
In all configurations, prompts and responses travel only to your chosen
inference provider. Domains pointing to Anthropic (such as
`pivot.claude.ai`) serve the add-in's interface, feature configuration,
and operational telemetry, not prompt or response content.
</Note>
### Anthropic API (1P)
Use this table if your organization signs in with Claude accounts and
inference goes to `api.anthropic.com`.
| Domain | Required when | Purpose |
| ------------------------------ | ------------------------- | ------------------------------------------------------------------------------------------ |
| `pivot.claude.ai` | Always | Add-in host serving task pane UI, analytics, icon search, skill downloads, and telemetry. |
| `claude.ai` | Always | Anthropic OAuth sign-in and feature-flag evaluation. |
| `api.anthropic.com` | Always | Claude inference API, file uploads, code-execution containers, and MCP connector registry. |
| `appsforoffice.microsoft.com` | Always | Microsoft Office.js runtime script (required by all Office add-ins). |
| `login.microsoftonline.com` | If using Outlook | Microsoft Entra ID sign-in via Nested App Auth for the Graph token. |
| `o1158394.ingest.us.sentry.io` | Optional | Crash and error reporting; blocking degrades diagnostics only. |
| `mcp-proxy.anthropic.com` | If using MCP connectors | Proxy for MCP connector tool calls. |
| `bridge.claudeusercontent.com` | If using work across apps | WebSocket bridge for the work-across-apps feature. |
| `graph.microsoft.com` | If using Outlook | Microsoft Graph mailbox and calendar API. |
### Third-party platforms (3P)
Use this table if your organization signs in with Microsoft Entra ID
and inference goes to your LLM gateway, Bedrock, Vertex AI, or Azure
AI Foundry.
| Domain | Required when | Purpose |
| ---------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------- |
| `pivot.claude.ai` | Always | Add-in host serving task pane UI, analytics, and telemetry. |
| `claude.ai/api/` | Always | Feature-flag evaluation without sign-in. |
| `appsforoffice.microsoft.com` | Always | Microsoft Office.js runtime script. |
| `login.microsoftonline.com` | Always | Microsoft Entra ID sign-in via Nested App Auth; reads admin config and issues tokens. |
| `o1158394.ingest.us.sentry.io` | Optional | Crash and error reporting; blocking degrades diagnostics only. |
| Your LLM gateway URL | If using LLM gateway | Organization's LLM gateway for inference. |
| `sts.amazonaws.com` | If using Bedrock direct | AWS STS for exchanging Entra ID token for temporary Bedrock credentials. |
| `bedrock-runtime.<region>.amazonaws.com` | If using Bedrock direct | Bedrock inference endpoint; replace `<region>` with your configured AWS region. |
| `accounts.google.com` | If using Vertex AI direct | Google OAuth consent screen. |
| `oauth2.googleapis.com` | If using Vertex AI direct | Google OAuth token exchange and refresh. |
| `aiplatform.googleapis.com` | If using Vertex AI direct | Vertex AI global inference endpoint. |
| `<region>-aiplatform.googleapis.com` | If using Vertex AI direct | Vertex AI regional inference endpoint; replace `<region>` with your GCP region. |
| `<resource>.services.ai.azure.com` | If using Foundry direct | Azure AI Foundry inference endpoint; replace `<resource>` with your resource name. |
| `graph.microsoft.com` | If using Outlook | Microsoft Graph mailbox and calendar API. |
## Deploy the add-in for your organization
Use the `claude-for-msft-365-install` plugin to configure and deploy the add-in
across your organization. The plugin provisions cloud resources (for
Bedrock or Vertex AI direct), generates the add-in manifest, and obtains
admin consent in a single guided flow.
### Run the setup wizard
[Install the plugin](https://github.com/anthropics/financial-services/tree/main/claude-for-msft-365-install)
from the financial services marketplace, then run the setup wizard
from inside Claude.
Add the marketplace in your shell:
```bash theme={null}
claude plugin marketplace add anthropics/financial-services
```
Install the plugin:
```bash theme={null}
claude plugin install claude-for-msft-365-install@claude-for-financial-services
```
Keep the plugin current before each deployment. List installed plugins
with `claude plugin list` and compare your version against the
[latest published version](https://github.com/anthropics/financial-services/blob/main/claude-for-msft-365-install/.claude-plugin/plugin.json).
If yours is older, update it:
```bash theme={null}
claude plugin update claude-for-msft-365-install@claude-for-financial-services
```
Then, from inside Claude, run the setup wizard:
```
/claude-for-msft-365-install:setup
```
The wizard walks you through the path you chose:
* **LLM gateway**: collects the gateway URL and token, determines the
API format, generates the manifest, handles Azure admin consent.
* **Bedrock direct**: creates the IAM OIDC identity provider and role,
generates the manifest, handles Azure admin consent.
* **Vertex AI direct**: walks through Google OAuth client creation,
generates the manifest, handles Azure admin consent.
* **Foundry direct**: captures `azure_resource_name` and
`azure_api_key`, then generates the manifest.
When complete, the add-in is ready for tenant-wide deployment.
<Note>
Bedrock and Vertex AI paths require Node.js for manifest generation and
validation. The wizard checks for it and prompts installation if
missing.
</Note>
### Available commands
The plugin exposes the following slash commands once installed.
| Command | Function |
| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `/claude-for-msft-365-install:setup` | Interactive wizard: provisions cloud resources, handles admin consent, writes manifest. |
| `/claude-for-msft-365-install:manifest` | Generates a customized add-in manifest XML. |
| `/claude-for-msft-365-install:consent` | Generates the Azure admin-consent URL for the add-in's app registration. |
| `/claude-for-msft-365-install:update-user-attrs` | Writes per-user configuration via Microsoft Graph extension attributes. |
| `/claude-for-msft-365-install:bootstrap` | Builds a bootstrap endpoint for per-user MCP servers, skills, and dynamic config. |
| `/claude-for-msft-365-install:debug` | Diagnoses deployment issues: stale config after a manifest update, connection failures, an add-in that does not appear, sign-in or admin-consent loops, and reading the add-in's error paste. |
| `/claude-for-msft-365-install:export-data` | Makes a read-only copy of a user's chat history, skills, connector registrations, and settings before a device is rebuilt. See [Data storage and retention](/docs/office-agents/data-storage). |
Run `/claude-for-msft-365-install:debug` whenever a connection or sign-in
does not behave as expected. It triages from the symptom, reads the "Copy
error details" paste from the connection-failed screen, and explains how
each connection path works, so you can resolve most third-party platform
questions without escalating.
### What the wizard provisions
The setup wizard creates resources in your cloud account based on the
connection path you choose.
| Path | Provisioned resources |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| LLM gateway | None. Collects your gateway URL and token, then generates the manifest. |
| Bedrock direct | IAM OIDC identity provider trusting Microsoft Entra ID tokens, role with `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` permissions, trust policy scoped to the Claude add-in's application ID. |
| Vertex AI direct | Walks through creating a Google OAuth client in the GCP Console (not automatable via CLI), enables the Vertex AI API, captures client ID and secret for the manifest. |
| Foundry direct | None. Collects resource name and API key for the manifest. |
### Per-user configuration
If values vary per user, such as different gateway tokens or AWS roles
for different teams, run `/claude-for-msft-365-install:update-user-attrs`
with per-user keys after initial setup to write configuration via
Microsoft Graph extension attributes.
At load, the add-in resolves each configuration key from three sources in
order of precedence: a bootstrap endpoint, Microsoft Entra ID extension
attributes, then manifest parameters. Per-user attributes override the
manifest defaults, so one deployed manifest can serve teams with
different settings.
<Frame caption="Configuration resolution at add-in load: bootstrap, Entra ID attributes, then manifest parameters.">
<img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/config-discovery.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=b6c750272cf3ad9765ec2563af436806" alt="The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters." width="2398" height="1670" data-path="images/office-agents/architecture/config-discovery.png" />
</Frame>
### Deploy to Outlook
Outlook requires a separate manifest file from Excel, PowerPoint, and
Word. Microsoft uses a different add-in schema for mail applications, so
the two cannot be combined into one file. When you tell the setup wizard
you are deploying to Outlook, it generates a second file named
`manifest-outlook.xml` alongside `manifest.xml`. Upload each file as its
own custom app in the steps below.
Claude for Outlook reads mail and calendar data through Microsoft Graph,
which requires a one-time tenant-wide grant from a Global Administrator
regardless of which platform serves the model. Complete the
[Microsoft Graph admin consent](/docs/office-agents/outlook#grant-microsoft-graph-consent)
step before deployment so users are not prompted individually. The Graph
token stays in the user's Outlook client and is never sent to your
gateway or to Anthropic.
If your organization's policy does not permit consenting to a third-party
multi-tenant application, register your own single-tenant Entra
application with the same delegated Graph permissions and provide its
client ID to the setup wizard as `graph_client_id`. See
[Use your own Entra app instead](/docs/office-agents/outlook#use-your-own-entra-app-instead).
<Note>
Claude for Outlook on third-party platforms supports Claude Opus 4.7 and
later and Claude Sonnet 5 and later. Earlier model generations are not
available on the Outlook surface.
</Note>
### Deploy to Microsoft 365
After the wizard generates your manifest files:
<Steps>
<Step title="Upload the manifest">
Open the Microsoft 365 Admin Center and go to Settings, Integrated
apps, Upload custom apps. Select "Office Add-in" as the app type,
then upload the `manifest.xml` file. If you are deploying Outlook,
repeat this step with `manifest-outlook.xml` as a second custom app.
</Step>
<Step title="Choose who gets the add-in">
If all users share the same configuration, select "Entire
organization". If you wrote per-user attributes, assign to "Specific
users/groups" matching exactly who was configured. Others would open
the add-in with no configuration.
</Step>
<Step title="Finish deployment">
Accept permissions and finish deployment.
</Step>
</Steps>
Propagation to users takes up to 24 hours, usually faster. The add-in
appears under Tools, Add-ins on Mac or Home, Add-ins on Windows in
Excel, PowerPoint, and Word once deployed. In Outlook it appears in the
message ribbon when an email is open.
Custom manifest deployment is where most issues surface: the add-in does
not appear, users see old configuration after an update, or sign-in
fails. Run `/claude-for-msft-365-install:debug` to diagnose these, or to
sideload and validate a manifest locally before a tenant-wide upload.
<Note>
Start with a pilot group to confirm functionality, then widen
assignment. You can change assignment later without redeploying.
</Note>
## Connection instructions for end users
### LLM gateway
<Steps>
<Step title="Open the add-in">
Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in.
</Step>
<Step title="Select your connection mode">
On the sign-in screen, select "Cloud provider or gateway". Then
choose your connection: Gateway, Vertex, Bedrock, or Azure. Contact
your IT team for connection details if you're unsure which one to
select.
</Step>
<Step title="Enter your credentials">
For Gateway, enter the gateway URL (HTTPS base URL of your LLM
proxy, for example
`https://llm-gateway.example.com`) and the API token your IT team
provided. By default the add-in sends the token in the `x-api-key`
header with every request. If your admin set
`gateway_auth_header: authorization` in the manifest, the add-in
sends `Authorization: Bearer <token>` instead.
</Step>
<Step title="Connect">
The add-in checks the connection by sending a test request to the
Cut at 300 lines.