Is It Safe to Connect Claude to Microsoft 365?

I’d connect Claude to Microsoft 365 for reading, once you’ve checked write tools are off and searched SharePoint as your most junior employee. We run on Google and I haven’t tested this connector, so this comes from the docs as of October 30, 2026.

Is the Claude Microsoft 365 connector read-only?

Read-only by default, Anthropic says, but go and look. The directory listing shows seven tools, all reads. Anthropic’s security guide lists 35 write tools on top of those, available once an organization enables them.

Anthropic’s firmer “blocked by default” lines name only earlier organizations and Teams tools, so I couldn’t confirm the setting starts at off for a company connecting today. Check it yourself under Organization settings, then Connectors, then Microsoft 365. Admins can choose Always allow, Needs approval or Blocked, and users can’t override that.

Who can connect Claude to Microsoft 365 at a small company?

Find out who your Global Admin is. If nobody can tell you in ten seconds, sort that out first, because Anthropic says “a Microsoft Entra Global Administrator must complete a one-time consent process before anyone in the tenant can connect.” T-Minus365 says a non-admin on a personal account can connect if Entra allows user consent. On Team and Enterprise, a Claude Owner also has to add the connector.

That person consents once, for everyone. Microsoft calls this “a sensitive operation” and says it lets all users access the app “unless otherwise restricted.” To restrict it, set “Assignment required” to Yes on both apps, M365 MCP Client for Claude and M365 MCP Server for Claude.

The consent screen “lists every permission the connector requests.” That includes write scopes such as Mail.Send and Files.ReadWrite.All, “used only when write tools are enabled.” I read the one click as granting those too, leaving the Claude setting as the only lock. To enforce read-only on Microsoft’s side, revoke them in Entra afterward: Enterprise Applications (remove the application type filter), M365 MCP Server for Claude, Permissions, Admin consent. Redo it after any re-consent, which “grants the connector’s full current permission set, including the write permissions.”

Can an employee connect it from a personal Claude account?

Only Enterprise has a setting that stops this. I infer a company on Team has no documented way to stop an employee connecting work Microsoft 365 to a personal Claude account once tenant consent exists. That connection would run under consumer terms. On Microsoft’s side, assignment limits which people can connect and has no say over which Claude account they use, so only disabling sign-in closes this, and that blocks the connector for everyone.

What can Claude do in Outlook, SharePoint, OneDrive and Teams?

This comes from the guide and the connect article. The writes apply only once write tools are on:

The consent set also covers channel messages, shared mailboxes, meeting transcripts and recordings. Creating or updating a calendar event emails the attendees.

“Always allow” isn’t supported on the eight tools in that last column. That list leaves out outlook_create_filter (“Create an inbox rule”) and outlook_batch_delete_messages. Set both to Blocked. Microsoft documents attackers using forwarding rules.

In Cowork, Needs approval doesn’t always mean a person approves. New tasks start in “Automatically approve” mode on Pro, Max, Ultra and Team. By Anthropic’s table, Needs approval only guarantees a human click in Manual mode. In Automatically approve, “Claude decides.” Only Blocked is denied in every mode, so start every write tool there.

Can Claude access all of SharePoint?

It can search all of it. The connector “searches SharePoint across the entire tenant using the permissions of the user. Site-specific search restriction isn’t supported.” The only control Anthropic’s guide lists is revoking Sites.Read.All, which blocks SharePoint outright.

Microsoft’s rule for delegated permissions is that “the application isn’t able to access anything the signed in user couldn’t access.” That doesn’t help when the user can see too much. Microsoft describes “Everyone except external users” as a built-in group that includes all internal users, and calls content shared that way “effectively public.” Say someone shared a folder that way in 2019 for a new hire, then forgot. I’d assume search turns it up for every employee who connects. Anyone you share the chat with can read Claude’s answer without access to the file, so don’t share chats that pulled restricted content.

Microsoft’s reports for finding this are tied to enterprise licenses, usually plus Copilot or a paid add-on. On a Business plan, assume you don’t have them.

How do I test what Claude could find in SharePoint?

You don’t need a Claude account for this. The test is my own, and I haven’t run it on a Microsoft tenant.

1. Sign in to Microsoft 365 with your most junior employee’s account, or as a test user in the same groups.
2. Search SharePoint for “salary”, “termination”, “bank” and your biggest client’s name.
3. Whatever this account can open, I’d assume Claude can reach for this person, and Copilot too.
4. Fix the sharing on what you find before anyone connects.

A clean result only means those words found nothing. It says little about OneDrive, Teams or shared mailboxes.

Then check whether someone has already connected it. In Entra, under Enterprise Applications (filter removed), search for “M365 MCP”. If the name search finds nothing, search the app IDs in the setup article. Open Permissions and read the Admin consent and User consent tabs.

Do Conditional Access and DLP policies apply to Claude?

Partly, and only if you have Conditional Access. It requires Entra ID P1, which Business Premium includes, so check your license first. Without it, skip to the DLP part below.

If you have it, look for two policies before anyone connects: one limiting sign-ins to your network or VPN, and one setting sign-in frequency. Anthropic’s guide marks location and network “Not supported,” and says that in its testing either policy blocks the connector for every member. Excluding Anthropic’s IP range unblocks it, but lifts the policy for every request from Anthropic’s addresses.

Don’t expect the other policies to work the way they do for someone “working directly in Microsoft 365.” Group policies are “Supported.” MFA is enforced only when the member signs in to connect. Device compliance is checked against the device recorded at that connection, not the one in use now. If a device policy blocks someone, have them reconnect from a compliant device. Don’t exclude the IP range for this, because that turns the device check off. Don’t change the policy to accept MFA either: Anthropic warns the device requirement can stop doing anything reliable.

Anthropic’s guide says “delegated permissions inherently respect Microsoft 365 data loss prevention (DLP) policies.” A Microsoft whitepaper, a Copilot sales document, says Claude “does not honor Purview DLP policy.” The policy in its test was “configured to block Copilot processing,” so I’m not shocked another app walked past it. I can’t tell you which is right. If DLP matters, label a dummy file and try it.

Does Microsoft 365 data leave Microsoft, and does Claude train on it?

Yes on leaving. The connector “doesn’t cache file content,” but tool results in stored chats stay at Anthropic. Anthropic’s commercial page says data is stored in the US, and by default traffic may route through the US, Europe, Asia and Australia. If you have residency obligations, get it in writing.

On training, commercial plans default to no, except for thumbs feedback. On Free, Pro and Max, chats can be used if the training setting is on, so turn it off. Conversations flagged for safety review can be used even with the setting off, so keep company mail off those plans. Both pages exclude raw connector content, but not what gets copied into the chat.

How do I disconnect Claude from Microsoft 365?

In Claude, each person goes to Customize, then Connectors, then Microsoft 365, then Disconnect. In Entra, revoke under the Admin consent path above. The portal can’t revoke individual user consents, so if you see any, or want to block it outright, disable sign-in on both apps.

Anthropic says permission changes take effect immediately, but assume access can outlast a revoke by up to 90 minutes, the typical token life. A connection stays valid until 90 days of inactivity, so when someone leaves, revoke their access in Entra instead of waiting. Don’t count on disconnecting to clear past chats. Delete them, and expect up to 30 days for back-end deletion.

Should I connect Claude to Outlook?

For reading, yes, once you’ve run the search test and know who your Global Admin is. Keep write tools off in any chat or task that reads mail. Reading mail means reading text from strangers, in your inbox and in any shared mailbox you’ve been granted. Anthropic’s Cowork safety page uses summarizing email as its prompt injection example, and says Claude “could act on those instructions before you notice.” I covered that in Is Claude Cowork safe for business?

For sending, start from Blocked and open tools one at a time. Then adopt the one-page connector policy and check the table of what 33 common connectors can change.

What I couldn’t confirm

• Whether a non-admin can connect without Global Admin consent. Anthropic and T-Minus365 disagree.
• How Automatically approve combines with the eight tools that can’t be set to Always allow. Use Manual mode for anything that sends.
• How much the audit log shows. Anthropic’s guide says all Graph API calls are logged, and Microsoft documents mail-read auditing as on by default for E3 and E5. Ask Claude a test question, then check your audit search.

Before you connect Claude to Microsoft 365

Run the junior-employee search this week, even if you never connect Claude.

The setup planner asks six questions and gives you a plan, no email. If your search turned up something worrying, bring it to a 30-minute call.