MCP server for Microsoft 365

What is an MCP server for Microsoft 365?

In many mid-sized tenants, the entire operational working life sits in Microsoft 365: hundreds of emails a day in Outlook, decisions scattered across Teams threads, contract status deep in SharePoint libraries. Anyone who wants to make this content accessible to an AI faces the governance problem: permissions that are too broad are a risk, permissions that are too narrow make the assistant useless. This is exactly where an MCP server for Microsoft 365 comes in. It connects AI agents (Claude, GPT, Gemini, Copilot) to your tenant via the open Model Context Protocol. Data access does not run through a dozen individual APIs but is bundled through the Microsoft Graph API, the uniform REST interface to Outlook, Teams, SharePoint, OneDrive, Calendar and Entra ID. The MCP server translates these endpoints into clean, secured tools that an agent can call in natural language.

The practical appeal: Microsoft 365 is practically the standard among mid-sized companies in the DACH region. If your emails, appointments, chats and documents already sit there, you do not have to migrate anything; the MCP server simply sits on top. Instead of building separate scripts or Power Automate flows for every AI idea, you define the tools once and swap the model as you like. You can read more on the basic distinction under MCP vs. API & function calling.

The distinction from Microsoft's own MCP offering matters: with Work IQ MCP, Microsoft provides an official MCP endpoint that, according to Microsoft, is generally available as part of the Work IQ API (Microsoft Learn, as of 8 October 2026). It offers ten generic tools, such as fetch, create_entity or ask, which work with resource paths like /me/messages, signed in via Microsoft Entra ID. Documented connections include those from Microsoft Foundry and the GitHub Copilot CLI; the integration in Copilot Studio is still in preview. Microsoft keeps the older, individual Microsoft MCP servers for mail, calendar, Teams, SharePoint and OneDrive only for backward compatibility and advises against them for new projects. The servers are managed centrally in the Microsoft 365 Admin Center.

A self-hosted MCP server (for example based on the open-source variant ms-365-mcp from Softeria) remains the alternative if you want tailored tools instead of generic paths, your own audit log, your own approval steps or hosting to your own specifications. Which route fits depends on licences, tenant policies and the level of control you want.

Use cases: what can a Microsoft 365 MCP server do in concrete terms?

1. Inbox triage in Outlook The agent reads new emails, classifies them by urgency, customer and topic, suggests draft replies and sets categories or flags. Pure newsletters move to folders automatically, and what matters stays on top. Sending remains a confirmed step by default.
2. Appointment coordination via the calendar "Find a 60-minute slot with the team next week." The agent checks availability through the Calendar endpoints, proposes time windows and, after approval, creates an appointment including a Teams link, along with an agenda draft from the email thread.
3. Meeting summaries from Teams From a channel or chat history, the agent creates a structured summary with decisions, open points and responsibilities, and posts it back as a message or saves it as a note.
4. Document search across SharePoint & OneDrive "Where is the current version of the framework agreement with supplier X?" The agent searches approved SharePoint libraries and OneDrive folders, finds the right document, summarises it and names the exact location, instead of minutes of clicking.
5. Onboarding and task routines For a new project, the agent creates the Teams structure, the SharePoint storage and the first tasks (via Planner/To Do): a repeatable, guided routine instead of manual clicking for every employee.
6. Knowledge base research for other agents The Microsoft 365 agent serves as a research tool for upstream processes: a sales agent, for example, queries the latest email thread with a customer before updating a record in a Salesforce MCP server or Dynamics 365 MCP server.

How the integration works

Architecture view for Microsoft 365:

Route 1, official: AI agent ↔ Work IQ MCP (operated by Microsoft, Entra ID) ↔ Microsoft 365

Route 2, own server: AI agent ↔ MCP server (your EU host) ↔ Microsoft Graph API (OAuth 2.0 via Entra ID, REST/JSON)

Concrete technical steps for your own server:

• OAuth setup via Entra ID: We register an app registration in your tenant. Depending on the use case, with delegated permissions (the agent acts on behalf of a user) or application permissions (background service). Tokens are stored encrypted on the EU host, with rotation.
• Tool mapping to Graph: We define MCP tools such as list_messages, send_mail_draft, find_meeting_times, create_event, search_drive_items, summarize_chat, each with a JSON Schema, validated inputs and clear error messages.
• Scoped permissions: Instead of Mail.Read on all mailboxes, we assign mailbox permissions via RBAC for Applications in Exchange Online with a management scope or an administrative unit. Microsoft describes this as the replacement for Application Access Policies (Microsoft Learn). Important: the same permissions must not additionally be granted tenant-wide in Entra ID, otherwise the restriction does not take effect. We restrict SharePoint sites via Sites.Selected; this does not apply to Teams chats and channels, where we choose the Teams permissions separately.
• Read vs. write separation: By default the agent only creates drafts (mail drafts, appointment proposals). Sending, publishing or deleting requires human approval, configurable per tool.
• Logging and audit: Every Graph action is logged with timestamp, acting user and diff, so it stays traceable what the agent touched and when.

Whether a ready-made open-source base (e.g. ms-365-mcp) is enough or a tailor-made solution makes more sense, we clarify in the audit. See also Having an MCP server developed.

GDPR, hosting & security

With Microsoft 365 in particular, governance is the critical point: the Graph API is powerful, and a scope that is too broad would be a real risk. To keep the overall system privacy-compliant, we pay attention to the following with every MCP connection to Microsoft 365:

• EU Data Boundary: Microsoft 365 can be configured so that email, Teams and SharePoint content remains in Microsoft's EU data centres; a custom MCP server additionally runs on an EU host (Hetzner or the Azure region Germany West Central in Frankfurt), with no US edge. Microsoft itself runs the Work IQ MCP; whether it falls under the EU Data Boundary, we check in advance using Microsoft's documentation.
• Entra ID tokens encrypted and rotated: The OAuth 2.0 tokens the server uses to authenticate against the Graph API are stored encrypted, with a defined rotation and revocation strategy, so that a single compromised token can be withdrawn immediately.
• DPA with the AI provider with EU data residency: e.g. Claude via AWS Bedrock (EU region Frankfurt) or Google Vertex AI (EU), OpenAI Enterprise with EU data residency or Azure OpenAI in an EU region. Which content goes to which provider and where it is processed, we document before the start.
• Data minimisation down to mailbox and site level: Through RBAC for Applications the agent sees only the approved mailboxes, through Sites.Selected only the approved SharePoint sites; we restrict Teams access through separately chosen Teams permissions, with no tenant-wide blanket approval for all Graph data.
• Role and tenant separation within the tenant: Graph permissions are separated by department or client, so that no agent reads into other Outlook or SharePoint areas beyond its task. More depth in MCP server security & GDPR.

What does it cost?

The effort depends heavily on how many Graph areas (only Outlook? Teams and SharePoint too?) and how many write use cases are integrated. In concrete terms:

• Time-to-value: A first read-only use case, such as inbox triage or SharePoint search, is usually productive quickly because the Graph endpoints are cleanly documented. Write use cases with approval logic follow afterwards.
• A clear scope per use case, no hourly roulette. Scaling afterwards in clearly defined increments.

We give the concrete figure in the initial consultation, depending on tenant size, the Graph areas integrated and the level of governance you want. If you want to map out the service framework, the money page MCP integration agency will help.

Frequently asked questions

Through which interface does an MCP server access Microsoft 365?

There are two routes. With Work IQ MCP, Microsoft offers an official, generally available MCP endpoint with generic tools for Microsoft 365 data, signed in via Microsoft Entra ID. A custom MCP server accesses data through the Microsoft Graph API, the uniform REST interface to Outlook, Teams, SharePoint, OneDrive and Calendar, likewise with Entra ID (OAuth 2.0).

Do I need Microsoft Copilot, or is my own MCP server enough?

Both are possible. Work IQ MCP is an official MCP endpoint from Microsoft that agents outside Copilot can also address, for example from Microsoft Foundry or the GitHub Copilot CLI; Microsoft runs it, and the tools are generic. A self-hosted MCP server gives you tailored tools, your own audit log and full control over permissions and hosting.

Will the AI agent then see all emails and documents?

Not if the permissions are set narrowly. For app permissions, we restrict mailboxes via RBAC for Applications in Exchange Online, which replaces Application Access Policies; the corresponding Graph permissions must then not additionally be granted tenant-wide in Entra ID. We restrict SharePoint sites via Sites.Selected. For Teams chats and channels, Sites.Selected does not apply, so we choose the Teams permissions separately and as narrowly as possible.

Can the agent send emails or create appointments on its own?

Technically yes. In practice we recommend carrying out write actions such as sending mail or booking appointments first as a draft or proposal and approving them briefly. Read actions run fully automatically, write actions with a confirmation step, configurable per tool.

Can Microsoft 365 be used with MCP in a privacy-compliant way?

Yes, if the building blocks are chosen cleanly: Microsoft 365 with the EU Data Boundary, a custom MCP server on an EU host or, for Work IQ MCP, a review of Microsoft's commitments for this service, and an AI provider with EU data residency and a DPA. We record in writing where each part of the chain processes data before the start.

Which AI models work?

In principle any model that supports the Model Context Protocol, so in practice Claude, GPT, Gemini as well as Microsoft Copilot. Because the Graph tools are defined once and stay unchanged, you swap the model behind them without having to rebuild the integration. That keeps you independent of any single provider.