Claude's Microsoft 365 Connector

Anthropic publishes the connector as two apps in Microsoft Entra. Your administrator finds them in the Entra admin center, under Enterprise applications, as M365 MCP Client for Claude and M365 MCP Server for Claude. Before anyone at your firm can connect, a Global Administrator grants consent once, for the whole firm.

On Team and Enterprise plans, an Owner in Claude also has to turn the connector on for the organization. On Free, Pro and Max plans, Anthropic says, "no organization-level setup is needed." For those plans, the Global Administrator's one consent is all it takes.

Anthropic's documentation describes one pair of Entra apps for the connector on claude.ai, the same for every plan. On that reading, the consent your firm gives for its own Claude plan also lets a staff member connect a personal account. The plan a person connects from decides which terms apply: Anthropic's commercial terms on Team and Enterprise, its consumer terms on Free, Pro and Max.

That difference matters. Under Anthropic's consumer terms, each person chooses whether their chats are used to improve its models. Chats used that way are kept in de-identified form for up to five years. Under its commercial terms, Anthropic does not use customer data for training by default.

Limiting who can connect. In Entra, an administrator can set an app to require assignment, so only the people assigned to it can use it. Microsoft's documentation is plain about the effect: "Users and services attempting to access the application or services need to be assigned to the application, or they won't be able to sign-in or obtain an access token." Anthropic's security guide points to the same setting, on both of the connector's apps. It also points to Conditional Access policies, Microsoft's sign-in rules, applied to chosen security groups.

Assignment limits which people can connect. It does not control which Claude plan they connect from. That belongs in your firm's written AI policy.

Anthropic describes every permission as delegated, meaning Claude acts as the signed-in person. In Anthropic's words: "Claude acts on behalf of users and can only access and change content that you already have permission to access and change in Microsoft 365." It reads Word, Excel, PowerPoint, PDF and plain-text files, email threads, Teams chats and channel messages, and meeting information.

It reads only when asked. Anthropic says the connector "doesn't run background searches" and "doesn't cache file content."

Reading only what each person can open cuts both ways. The connector reads everything the person can open, and in most small firms that is more than anyone intended. So have your administrator check who can open what first, whichever assistant reads the files. We covered why staff can open more than they should in Copilot Does Not Leak. It Reveals.

Write tools. Permissions are read-only by default. With write tools on, Claude acts as the user. It can send and manage email; create, update and delete calendar events; create and update files in SharePoint and OneDrive; and send Teams messages. Turning them on takes two steps. First, if your firm consented before the write permissions were added, an Entra administrator approves them. Then a Claude administrator turns on write actions for everyone or, on Enterprise, for chosen users.

An assistant that can send email from a partner's mailbox is a different risk from one that can read it. Decide the two separately.

Anthropic says a firm's "Microsoft 365 documents, emails, and files remain in your tenant," and that the connector fetches them only while answering a question. Anthropic then processes what it fetched to answer that question. Anthropic's security guide adds: "Tool call results from the connector that are part of stored chats are retained." In plain terms, the part Claude read stays with the conversation, in Anthropic's app, for as long as the conversation is kept.

How long that is depends on the plan. On Enterprise, Anthropic says chats are retained "indefinitely unless a custom retention period is set," and an Owner can set a period of 30 days or more. On a commercial plan, when a person deletes a conversation, Anthropic says it leaves their chat history immediately and is deleted from Anthropic's back-end systems within 30 days.

For a tax firm, this is the §7216 question from our Copilot vs Claude brief in a different shape. If return information is pulled into a chat, Anthropic processes and keeps it under Anthropic's terms, not Microsoft's. Anthropic documents a U.S.-only processing setting for its API, the service developers build on. It describes none for its Team and Enterprise plans. Claremont's position is the same as for Copilot: return information goes in only with each client's consent, and for Form 1040 clients the Social Security number stays out even with consent. Whether a particular disclosure needs consent is for your firm's counsel to decide. Put these facts in front of counsel before anyone connects a mailbox full of returns.

In Microsoft Entra. An administrator can withdraw the consent, in part or in full. The connector's two apps can require assignment, so only named users or groups can sign in to them. Anthropic's guide supports Conditional Access sign-in rules. It recommends a separate multifactor policy if your firm's existing one does not apply to the connector's sign-in.

In Claude. On Team and Enterprise, Owners turn the connector on and decide whether write actions are on. They can also limit which members use it, or switch off specific permissions. On Enterprise, except for public sector organizations, Anthropic's Compliance API lets your firm's IT pull activity feeds, chat data, file content and audit log events out of Claude.

The record. The connector's Microsoft Graph calls, its requests to Microsoft 365, "are logged in your organization's Microsoft 365 audit log," Anthropic says. Anthropic also logs sign-ins and each tool the connector runs, on its own side. Do not assume Purview's rules for Copilot, such as its data loss rules, cover the connector. Microsoft documents them for Microsoft 365 Copilot and Copilot Chat. Nothing in that documentation extends them to another vendor's app. Neither Anthropic's setup guide nor its security guide mentions sensitivity labels, the labels that mark confidential files.