# Microsoft 365 MCP Server: an MCP server we run in production

Canonical: https://scalably.io/mcp/ms-365-mcp-server
Source: https://github.com/Softeria/ms-365-mcp-server
Registry: not published to the MCP registry
Provenance: third-party server, pinned at 0.147.0, verified 2026-10-02. Newer upstream available: 0.157.2; the pin stays at 0.147.0 until it is re-verified.
Integrity: no independent hash is published for this third-party listing; the raw endpoint at https://scalably.io/mcp/ms-365-mcp-server.md mirrors this representation byte for byte
This is the machine-readable representation of the page at the canonical URL. Same facts, denser format.

## Direct answer
OneDrive and Microsoft Graph file access behind a per-tenant folder policy.

## Install
- Claude Code: `claude mcp add ms-365 -e MS365_MCP_OAUTH_TOKEN=your-value -- npx -y @softeria/ms-365-mcp-server@0.147.0`
- Codex: `codex mcp add ms-365 --env MS365_MCP_OAUTH_TOKEN=your-value -- npx -y @softeria/ms-365-mcp-server@0.147.0`
- Claude Desktop: not available for this server.

## Environment
| Variable | Required | Secret | Purpose |
|---|---|---|---|
| `MS365_MCP_OAUTH_TOKEN` | no | yes | optional bring-your-own Graph token, not refreshed by the server; how we run it per tenant |

## Tools
The vendor doesn't publish a fixed per-tool list for this server; the tool groups are described under Setup.

## Setup
- Default: `npx -y @softeria/ms-365-mcp-server@0.147.0` over stdio, signed in with the device-code flow. Call the `login` tool, or run `--login` once. No environment variable is needed for this path.
- Add `--org-mode` for work or school accounts. Personal Microsoft accounts should set `MS365_MCP_TENANT_ID=consumers`.
- Bring your own token: `MS365_MCP_OAUTH_TOKEN`. The server doesn't refresh it, so the caller replaces it before it expires. This is how we run it, one token per tenant behind a folder policy.
- Your own Azure app: `MS365_MCP_CLIENT_ID`, `MS365_MCP_CLIENT_SECRET`, `MS365_MCP_TENANT_ID`.
- `--http [port]` runs Streamable HTTP and requires OAuth Bearer tokens.

The server has 300+ tools, one per Microsoft Graph endpoint. Personal accounts get mail, calendar, OneDrive files, Excel, OneNote, To Do, Planner, contacts, profile and search. Work accounts with `--org-mode` add Teams and chats, meetings and transcripts, SharePoint, shared mailboxes, users and presence. Narrow the set with `--preset` (for example `files`, `mail`, `calendar`), `--enabled-tools <regex>`, `--read-only`, `--allowed-scopes` or `--discovery`.


## Limits
- Work features need `--org-mode` from startup. Shared mailboxes also need delegated permissions and Exchange access.
- HTTP mode rate-limits per IP: 30 requests a minute on the auth endpoints, 120 a minute on `/mcp`.
- Paging defaults to 100 pages and 10,000 items.
- A bring-your-own token is never refreshed by the server.
- Since June 2026, refresh tokens from the default `common` tenant fail for personal accounts; use `consumers`.

Sources: @softeria/ms-365-mcp-server 0.147.0 README and `dist/endpoints.json` (unpkg.com).


## Reliability
- CI: not applicable, this is a third-party project we do not control.
- Pinned at 0.147.0 Newer upstream available: 0.157.2; the pin stays at 0.147.0 until it is re-verified.
- Verified 2026-10-02
- We run this server in production, pinned at the exact version, with the install command derived mechanically from that pin so it can be re-verified against the published package.

## Related
- Read more: [Claude Code MCP: how to add an MCP server](https://scalably.io/blog/claude-code-mcp)