One of the bigger pain points for organizations using Claude with Microsoft 365 has been getting work back out of Claude. The connector could search and read across Outlook, SharePoint, OneDrive, and Teams, but it couldn't send an email, create a calendar event, or save an edit to a file.
Producing a change without creating a whole new file required one of two workarounds, and each had its own failure mode. You could work through the Claude add-ins for Word, Excel, PowerPoint, and Outlook, which can only see documents that are open, so a task drawing on several files meant keeping every relevant file open at once. Or you could run Cowork against a locally synced OneDrive folder, which works only as well as the sync does: the right folders have to be synced to that machine and current before Claude can touch them.
That changed on July 7, when Anthropic shipped write tools for the Microsoft 365 connector. Claude can now send email, manage drafts and calendar events, update mailbox settings such as inbox rules and automatic replies, and create and update files in OneDrive and SharePoint, all from a normal chat. Two limitations remain: Claude still can't post to Teams, and write tools don't support attachments, so any send, forward, or draft that includes one is rejected.
For organizations that choose not to enable write access, the existing workarounds remain available, and the add-ins and Cowork with a synced folder work the same as before. The connector's read and search tools also behave the same whether write access is on or off.
How to enable Microsoft 365 write access in your organization
Write access is turned off until administrators enable it, and enabling it takes two steps that no end user can complete on their own.
The first step happens in Microsoft Entra. Write tools added five Microsoft Graph scopes to the connector's permission set: Mail.Send, Mail.ReadWrite, Calendars.ReadWrite, Files.ReadWrite.All, and MailboxSettings.ReadWrite. If your tenant granted consent before the launch, a Microsoft Entra Global Administrator needs to review and approve the updated permission set through the Enterprise Applications consent flow in the Entra admin center, which only has to happen once per tenant.
The second step happens in Claude, where an organization admin turns on write tools under Organization settings > Connectors. For organizations already using the connector, write access arrived blocked by default, so nothing changes until you take this step. Enterprise plans can also grant it to specific users through custom roles instead of enabling it for everyone.
Once both steps are done, confirm everything works with a harmless request. Anthropic suggests asking Claude to draft an email to yourself without sending it, and if the draft shows up in your Outlook drafts folder, write access is live. The setup guide for the connector covers both steps in more detail, including manual Entra configuration and troubleshooting.
The two-step design can feel like bureaucracy, but it's what makes this feature safe to adopt. Because no individual can enable outbound email on their own, turning on write access becomes a decision your organization makes once, on purpose, with IT involved.
How security and permissions work
The underlying permission structure didn't change with this release. The connector uses delegated permissions, which means Claude acts as the signed-in user and can only read or change what that user could already read or change in Microsoft 365. There is no service account with tenant-wide access, and nothing runs in the background; the connector reads or writes only when a user asks, with no sync and no cached content.
This is also why permission hygiene matters more than it did when the connector was read-only. If site permissions across the tenant are loose and everyone can edit everything, write tools inherit that looseness. A permissions review in Entra and SharePoint is worth running before enabling write access, and most tenants are overdue for one anyway.
Administrators keep meaningful controls after enablement. You can restrict who can connect at all by requiring assignment on the two enterprise applications in Entra, M365 MCP Server for Claude and M365 MCP Client for Claude, and assigning specific users or groups to each. You can also revoke individual Graph permissions from the consented set, which disables the matching tools across the tenant.
The connector also ships with a few guardrails of its own. Emails Claude sends include an attribution header identifying them as agent-initiated, although file and calendar writes aren't tagged, so set a naming or changelog convention if attribution matters for the audit trail. Per-user rate limits cap writes, sends, and recipients, and the complete permission reference is in Anthropic's Microsoft 365 connector security guide.
The risks to weigh
It's tempting to manage this like any software rollout, with a small pilot group that grows over time. But adding users doesn't add much risk here: each person can only do what they could already do in Microsoft 365 themselves, Claude acts only when asked, and usage limits cap how much any one account can send or change. What determines the risk is which of the five permissions are switched on, not how many people can use them.
Mail.Send carries the most risk of the five. A sent email can't be taken back, and email is also the channel an attacker would use if a poisoned document or inbound message tricked Claude into moving data out of the tenant. Prompt injection defenses have improved a great deal, but nobody credible claims the problem is solved.
MailboxSettings.ReadWrite deserves the same scrutiny. A quietly created auto-forward rule is a classic persistence technique in business email compromise, and a rule keeps operating long after the conversation that created it ends.
File and calendar writes sit at the other end of the range. SharePoint and OneDrive keep version history, so a bad edit is something to roll back rather than an incident to report, and a wrong calendar invite is visible to everyone it touches.
The controls to act on that analysis sit at three levels. A Microsoft Entra admin can revoke scopes individually, so a tenant can run file and calendar writes while leaving Mail.Send off, and drafting still works under Mail.ReadWrite, which keeps a person between Claude and every outbound message. A Claude org admin can switch write tools off entirely at any time without touching Entra, Enterprise plans can restrict them to specific users through custom roles, and individual members can turn off specific tools in their own connector settings.
The decision in front of admins isn't one switch. It's five scopes with five different risk profiles, plus consent, revocation, and role controls that let an organization treat them separately. Weigh each scope on its own terms, starting with whether its actions can be undone, and the right configuration for a given organization follows from there.