Connect Microsoft 365 to Claude: Access Users, Sites, and Contacts

If you need to connect Microsoft 365 to Claude to automate IT onboarding, audit Entra ID user permissions, query SharePoint document libraries, or manage Microsoft Teams channels, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's natural language tool calls and the complex Microsoft Graph REST API. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT, check out our guide on /connect-microsoft-365-to-chatgpt-manage-teams-tasks-and-files/ or explore our broader architectural overview on /connect-microsoft-365-to-ai-agents-search-messaging-and-tasks/.

Giving a Large Language Model (LLM) read and write access to a sprawling enterprise ecosystem like Microsoft 365 is an engineering challenge. You have to handle OAuth 2.0 token lifecycles, map massive JSON schemas to MCP tool definitions, and deal with Microsoft's strict API quotas and OData syntax. Every time Microsoft updates an endpoint or deprecates a resource, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Microsoft 365, connect it natively to Claude Desktop, and execute complex workflows using natural language.

The Engineering Reality of the Microsoft 365 API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against Microsoft 365's APIs is painful. You are not just integrating "Microsoft" - you are integrating Microsoft Entra ID (formerly Azure AD), SharePoint, OneDrive, Teams, Planner, and Outlook, all wrapped behind the Microsoft Graph API.

If you decide to build a custom MCP server for Microsoft 365, you own the entire API lifecycle. Here are the specific challenges you will face:

OData Query Complexity and Payload Shaping Microsoft Graph relies heavily on OData query parameters ($select, $expand, $filter, $orderby). If an LLM calls an endpoint to get a user without specifying $select, Microsoft only returns a minimal subset of default properties. If you want the user's manager, skills, or photo, the LLM must know to explicitly append $expand=manager. Teaching an LLM to accurately structure OData queries on the fly leads to frequent hallucinated parameters and HTTP 400 errors. A well-designed MCP server must abstract these quirks into distinct, predictable tool properties.

Opaque IDs and Complex Resource Routing Microsoft 365 does not use simple integer IDs. SharePoint site IDs, for example, are a composite of a hostname, a site collection GUID, and a web GUID (e.g., contoso.sharepoint.com,1234-abcd,5678-efgh). Finding a specific document requires traversing from a site_id to a drive_id to an item_id. An LLM cannot simply guess these IDs. The MCP server must expose a logical sequence of search and list tools so the model can navigate the hierarchy step-by-step to resolve the exact opaque identifiers it needs.

Aggressive and Fragmented Rate Limiting Microsoft Graph applies rate limits aggressively, and these limits vary wildly depending on the resource. Searching Outlook mailboxes has a different throttling threshold than creating Teams channels.

It is critical to note that Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Microsoft Graph API returns an HTTP 429 Too Many Requests, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The caller - meaning your LLM orchestration script or Claude client - is strictly responsible for implementing retry and backoff logic using these standardized headers.

Generating a Managed MCP Server for Microsoft 365

Instead of building a JSON-RPC server from scratch and writing custom TypeScript types for every Microsoft Graph endpoint, Truto dynamically derives MCP tools directly from the integration's documented API schema.

Tools are generated dynamically on every tools/list request. Rather than hand-coding tool definitions, Truto uses the integration's endpoint definitions and documentation records (which contain descriptions, query schemas, and body schemas) to assemble the MCP tool list at runtime. This documentation-driven approach acts as a quality gate - ensuring only curated, well-described endpoints are exposed to Claude.

Each MCP server is scoped to a single integrated account. The server URL contains a cryptographic token that encodes which Microsoft 365 account to use and what tools to expose, making the URL fully self-contained.

Here is how to create your Microsoft 365 MCP server.

Method 1: Via the Truto UI

If you prefer a visual interface, you can generate the server directly from your dashboard:

1. Navigate to the Integrated Accounts page for your active Microsoft 365 connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration. You can name the server (e.g., "M365 - IT Admin Access") and optionally filter tools by method (like read or write) or by tags (like directory or files).
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the Truto API

For automated deployments, you can provision MCP servers programmatically. This is ideal for assigning dedicated AI workspaces to specific users or teams.

Make a POST request to /integrated-account/:id/mcp with your configuration payload.

curl -X POST https://api.truto.one/integrated-account/<your_integrated_account_id>/mcp \
  -H "Authorization: Bearer <your_truto_api_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Claude M365 Access",
    "config": {
      "methods": ["read", "write"]
    }
  }'

The API securely provisions the token in a managed key-value store and returns the endpoint URL:

{
  "id": "mcp-789",
  "name": "Claude M365 Access",
  "config": { "methods": ["read", "write"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

Connecting the MCP Server to Claude

Once you have your Truto MCP server URL, connecting it to Claude requires zero custom code. The URL itself handles authentication against Truto and routes requests to the correct Microsoft 365 tenant.

Method A: Via the Claude UI (Desktop/Web)

If you are using Claude Desktop or Claude Web (for Team/Enterprise plans with remote MCP enabled):

1. Copy the MCP server URL from Truto.
2. In Claude, navigate to Settings -> Integrations (or Connectors depending on your plan tier) and click Add MCP Server.
3. Paste the Truto URL and click Add.
4. Claude will instantly perform an MCP handshake, discover the Microsoft 365 tools, and make them available in your chat context.

(Note: If your team uses ChatGPT, the process is similar: Settings -> Apps -> Advanced settings -> Enable Developer mode -> Add under Custom connectors).

Method B: Via the Claude Desktop Configuration File

If you prefer to configure Claude Desktop manually, you can edit the local claude_desktop_config.json file. Truto's MCP servers communicate over HTTP using Server-Sent Events (SSE).

Add the following block to your configuration file:

{
  "mcpServers": {
    "microsoft365": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Restart Claude Desktop. The application will initialize the connection and load the Microsoft 365 tools.

Microsoft 365 Hero Tools for Claude

Truto automatically maps Microsoft Graph API resources into distinct, snake_case MCP tools. Here are some of the highest-leverage tools available for AI agents working with Microsoft 365.

list_all_microsoft_365_users

This tool allows Claude to query the Microsoft Entra ID directory. It is essential for resolving human names to system IDs, which are required for almost all subsequent API calls. It supports OData options like $search and $filter.

"Find the user profile for Alex Wilber in the directory. I need his user ID, job title, and the department he belongs to."

list_all_microsoft_365_search

Instead of checking individual endpoints, this tool runs a Microsoft Search query across Microsoft 365 content (files, messages, events) and returns matching hits. It is a powerful way for Claude to locate information without knowing exactly where it lives.

"Run a search across the organization for any documents or chat messages mentioning 'Project Falcon Q3 Review'. Return the top 5 results."

list_all_microsoft_365_drive_items

This tool allows Claude to list and navigate files within a specific SharePoint or OneDrive directory. Because Microsoft uses complex parent/child references, Claude can use this tool to step through a folder structure to locate a specific asset.

"List all the files in the root folder of the Marketing Team's shared drive. Find the exact item ID for the 'Q4_Budget.xlsx' file."

list_all_microsoft_365_tasks

This tool exposes Microsoft Planner tasks associated with a specific plan. It allows Claude to audit project status, identify overdue items, and determine task ownership.

"Get all tasks for the 'Website Redesign' plan. Filter the list to show only tasks that are marked as incomplete and assigned to me."

create_a_microsoft_365_channel_message

This tool enables Claude to actively post new messages or status updates directly into a Microsoft Teams channel. It requires the team_id and channel_id, which Claude can retrieve using the respective listing tools.

"Draft a brief summary of the overdue Planner tasks we just found, and post it to the 'Engineering Triage' channel in Teams."

get_single_microsoft_365_team_member_by_id

This tool retrieves detailed information about a specific member within a Microsoft Team, including their roles and visibility history. It is highly useful for auditing channel access.

"Check the permissions for the user ID I just gave you within the 'Leadership Council' team. Verify if they hold owner privileges."

To view the complete inventory of available Microsoft 365 tools, including detailed query schemas, required parameters, and pagination structures, visit the Microsoft integration page.

Workflows in Action

Connecting Microsoft 365 to Claude unlocks the ability to execute complex, multi-step operations that span Entra ID, SharePoint, and Teams. Here are two real-world workflows demonstrating how Claude navigates the Graph API autonomously.

Workflow 1: IT Admin Offboarding Audit

When an employee leaves, IT needs to quickly assess their digital footprint - identifying what groups they manage and where their personal files are stored before revoking access.

"We need to start the offboarding process for Megan Bowen. Find her user ID, list all the Microsoft Teams she is a member of, and locate her personal OneDrive so we can secure her files."

Step-by-step execution:

1. Claude calls list_all_microsoft_365_users with a $search parameter for "Megan Bowen" to retrieve her opaque id.
2. Claude calls list_all_microsoft_365_me_plans (or a team membership endpoint) passing her id to inventory her active collaboration spaces.
3. Claude calls list_all_microsoft_365_user_drives using her id to locate the drive_id of her personal OneDrive.

Result: The user receives a comprehensive, structured audit of the employee's access footprint and file locations, giving IT exactly what they need to safely proceed with account deactivation.

Workflow 2: Automated Project Status Sync

Project managers waste hours cross-referencing task trackers and posting manual updates to chat channels. Claude can orchestrate this entire loop.

"Check the 'Q3 Marketing Launch' Planner board. Find all tasks that were due this week but are still incomplete. Summarize them and post the summary to the 'Marketing General' Teams channel."

sequenceDiagram
    participant User as User
    participant Claude as Claude Desktop
    participant MCP as Truto MCP Server
    participant Graph as Microsoft Graph API

    User->>Claude: "Check tasks and post summary..."
    Claude->>MCP: tools/call (list_all_microsoft_365_tasks)
    MCP->>Graph: GET /planner/plans/{plan_id}/tasks
    Graph-->>MCP: [Task JSON array]
    MCP-->>Claude: JSON response
    Note over Claude: Claude filters for<br>overdue tasks and<br>drafts summary text
    Claude->>MCP: tools/call (create_a_microsoft_365_channel_message)
    MCP->>Graph: POST /teams/{team_id}/channels/{channel_id}/messages
    Graph-->>MCP: 201 Created
    MCP-->>Claude: Success confirmation
    Claude-->>User: "I found 3 overdue tasks and posted the update to Teams."

Step-by-step execution:

1. Claude calls list_all_microsoft_365_tasks providing the known plan_id to retrieve the task array.
2. Claude internally parses the JSON, filtering for items where the due date has passed and status is incomplete, then uses its LLM capabilities to draft a natural language summary.
3. Claude calls create_a_microsoft_365_channel_message passing the team_id, channel_id, and the drafted summary as the message body.

Result: The overdue tasks are identified, summarized, and communicated to the wider team in seconds, completely autonomously.

Security and Access Control

Giving an AI agent access to an organization's Microsoft 365 tenant requires strict governance. Truto's MCP implementation provides granular security controls enforced at the server level, ensuring the LLM cannot exceed its intended authority.

• Method Filtering (config.methods): You can restrict an MCP server entirely to read-only operations. By setting methods: ["read"], Truto will strictly omit any create, update, or delete tools (like delete_a_microsoft_365_user_by_id) during tool generation. The LLM simply won't know the endpoints exist.
• Tag Filtering (config.tags): If you only want Claude to access Planner tasks and not Entra ID users, you can filter tools by functional tags. Only resources matching the approved tags will be exposed.
• Extra Authentication (require_api_token_auth): By default, possessing the MCP URL grants access to its tools. For higher security scenarios, enabling this flag requires the MCP client (or caller) to also pass a valid Truto API token in the Authorization header. This ensures only authenticated team members can execute tools, even if the URL leaks.
• Automatic Expiration (expires_at): For temporary workflows - like giving a contractor AI agent access to audit a SharePoint site for a week - you can assign an ISO datetime to expires_at. Truto's automated cleanup routines will permanently destroy the server and invalidate the URL exactly when the time expires.

Moving Faster with Managed MCP

Building a custom integration layer for Microsoft 365 is an expensive distraction from building your core AI product. You are forced to deal with Microsoft's fragmented resource architecture, opaque identifiers, strict OData requirements, and aggressive rate limits.

By leveraging Truto's dynamic MCP server architecture, you bypass the boilerplate. Tool schemas are generated automatically from documentation, authentication lifecycles are fully managed, and security controls are enforced at the infrastructure level. Your AI agents get immediate, secure access to Microsoft 365 data, and your engineering team stays focused on building intelligent features rather than maintaining REST wrappers.