A tenant administrator must consent to Anthropic's multi-tenant connector app once for the organization. This creates a service principal in your tenant; no secret is exchanged.

Open the following URL after replacing `YOUR_TENANT_ID` with the Directory (tenant) ID shown in **Entra admin center → Overview**.

```text theme={null}
https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17
```

The consent screen lists the delegated Microsoft Graph permissions the connector requests. All are read-only:

| Scope                                     | Purpose                                                     |
| ----------------------------------------- | ----------------------------------------------------------- |
| `User.Read`                               | Read the signed-in user's profile                           |
| `Mail.Read`, `Mail.Read.Shared`           | Read mail in the user's and shared mailboxes                |
| `Calendars.Read`, `Calendars.Read.Shared` | Read events in the user's and shared calendars              |
| `Files.Read.All`                          | Read files the user can access in OneDrive and SharePoint   |
| `Sites.Read.All`                          | Read SharePoint site content the user can access            |
| `Chat.Read`, `ChatMessage.Read`           | Read Teams chat messages the user can access                |
| `offline_access`                          | Allow the desktop to refresh its token without re-prompting |

Review the permissions and select **Accept**.

> [!NOTE]

FedRAMP and GovCloud deployments use a different connector app ID and a different connector service hostname. Contact your Anthropic representative for the app ID to use in this URL and in the scope string in step 4, and for the connector URL to use in step 4.

Register a desktop client app in your tenant

Create the public client that Claude Desktop will sign in as.

1. In **Entra admin center → App registrations → New registration**, set **Name** to `Claude Desktop` (or your preferred name), set **Supported account types** to *Accounts in this organizational directory only*, and add a **Redirect URI** of platform *Mobile and desktop applications* with the value `http://127.0.0.1/callback`.
2. Select **Register**, then note the **Application (client) ID** and **Directory (tenant) ID** shown on the overview page.
3. Under **API permissions → Add a permission → APIs my organization uses**, search for `Anthropic` (or paste the connector app ID from step 1), select **Delegated permissions → access\_as\_user**, then **Add permissions**.
4. Select **Grant admin consent for \{your organization}**.

No client secret is needed; this is a public client that uses PKCE.

Send Anthropic your IDs

Anthropic maintains an allowlist of tenant and client IDs that may call the connector service. Email your Anthropic representative, or open a support ticket, with your Directory (tenant) ID and the Application (client) ID from step 2. Allowlisting is typically completed within two to three business days, as it requires a connector service deployment.

Until the allowlist is updated, sign-in will succeed but the connector returns *Client application is not authorized for this resource*.

Configure Claude Desktop

In the Claude Desktop setup window, open Connectors & extensions, select Add server → Microsoft 365, and enter the values below.

| Field     | Value                                                                      |
| --------- | -------------------------------------------------------------------------- |
| Client ID | The Application (client) ID from step 2                                    |
| Tenant ID | Your Directory (tenant) ID                                                 |
| Scope     | `api://07c030f6-5743-41b7-ba00-0a6e85f37c17/access_as_user offline_access` |

Select **Save**, then deploy the configuration through your device-management tool as usual.

If you manage configuration through JSON or a plist directly instead of the setup window, add the following entry to [`managedMcpServers`](/cowork/3p/configuration#managedmcpservers).

```json theme={null}
{
  "name": "m365",
  "url": "https://microsoft365.mcp.claude.com/mcp",
  "transport": "http",
  "oauth": {
    "clientId": "APPLICATION_CLIENT_ID_FROM_STEP_2",
    "tenantId": "DIRECTORY_TENANT_ID",
    "scope": "api://07c030f6-5743-41b7-ba00-0a6e85f37c17/access_as_user offline_access"
  }
}
```

[!WARNING] Do not reuse the desktop client app you registered for the remote connector. That app is consented only for the connector's own scope, so its tokens can reach nothing but the connector service. The local-mode app needs Microsoft Graph permissions directly, and adding those to the remote connector app's client ID would let any token minted for it read Microsoft 365 data directly, tenant-wide. Register a separate app dedicated to local mode.

1. In **Entra admin center → App registrations → New registration**, set **Name** to `Claude Desktop M365 Local` (or your preferred name) and set **Supported account types** to *Accounts in this organizational directory only*.
2. Under **Authentication → Add a platform → Mobile and desktop applications**, add a redirect URI of `http://localhost`. This is the standard loopback redirect for desktop apps: during browser sign-in, Microsoft Entra redirects to a listener on the device itself, so the response never leaves the machine. For brokered sign-in on managed devices, also add the per-platform broker redirect URI shown under [How users sign in](#how-users-sign-in).
3. Leave **Allow public client flows** set to **No**. The local connector's sign-in flows do not need it, and leaving it off prevents device-code phishing against this registration.
4. Under **API permissions → Add a permission → Microsoft Graph → Delegated permissions**, add the scopes the connector will request (the default set is listed under [Configure scopes](#configure-scopes)), then select **Grant admin consent for \{your organization}**.
5. Note the **Application (client) ID** and **Directory (tenant) ID** from the overview page.

Configure Claude Desktop

In the Claude Desktop setup window, open Connectors & extensions, select Add server, and choose Microsoft 365 under the Built-in group. Enter the values below, then select Test connection to verify that the server starts and lists its tools, and select Save.

| Field       | Value                                                                                                       |
| ----------- | ----------------------------------------------------------------------------------------------------------- |
| Tenant ID   | Your Directory (tenant) ID                                                                                  |
| Client ID   | The Application (client) ID from step 1                                                                     |
| Azure cloud | `global` (default), `us-gov-high`, or `us-gov-dod`                                                          |
| Access      | Leave empty for standard read access, or list scopes explicitly (see [Configure scopes](#configure-scopes)) |

If you manage configuration through JSON or a plist directly, add an entry to [`managedMcpServers`](/cowork/3p/configuration#managedmcpservers) with the `server` field set to `microsoft365`:

```json theme={null}
{
  "name": "Microsoft 365",
  "server": "microsoft365",
  "tenantId": "DIRECTORY_TENANT_ID",
  "clientId": "APPLICATION_CLIENT_ID_FROM_STEP_1"
}
```

| Field        | Required | Description                                                                                                                                                                   |
| ------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `name`       | Yes      | Unique display name, shown to users in connector settings.                                                                                                                    |
| `server`     | Yes      | Must be `microsoft365`. Built-in entries use this field instead of `url`, `transport`, or `command`; an entry that mixes `server` with those fields is rejected.              |
| `clientId`   | Yes      | The Application (client) ID of the local-mode app from step 1.                                                                                                                |
| `tenantId`   | Yes      | Your Directory (tenant) ID.                                                                                                                                                   |
| `azureCloud` | No       | `global` (default), `us-gov-high`, or `us-gov-dod`. Selects the Microsoft Entra and Microsoft Graph hosts for US Government clouds.                                           |
| `scope`      | No       | Space-separated delegated Graph scopes to request instead of the default read set. A string array named `scopes` is also accepted. See [Configure scopes](#configure-scopes). |
| `toolPolicy` | No       | Per-tool approval locks, the same as for any managed server. See [`toolPolicy`](/cowork/3p/configuration#toolpolicy).                                                         |

The server ships inside the app, so nothing else needs to be installed on the device, and it activates only from managed configuration; users cannot add it themselves. Deploy the configuration through your device-management tool as usual.

Allow the required network hosts for local mode

The local connector calls Microsoft directly from the device, so in addition to the base egress hosts, devices need outbound HTTPS access to:

| Host                        | Purpose                   |
| --------------------------- | ------------------------- |
| `login.microsoftonline.com` | Microsoft Entra sign-in   |
| `graph.microsoft.com`       | Microsoft Graph data APIs |

US Government cloud deployments use `login.microsoftonline.us` and `graph.microsoft.us` (or `dod-graph.microsoft.us` for `us-gov-dod`) instead, matching the `azureCloud` setting. GCC High (`us-gov-high`) support has been confirmed in customer deployments. No egress to any Anthropic host is needed for Microsoft 365 data with the local connector.