Claude for MSPs: the challenges and how to handle them

The challenge clients are bringing

Businesses that have used Copilot for Office work are adding Claude for longer analysis, drafting and work across many documents. They want it connected to their email, files and Teams, and that needs their Microsoft tenant, which their MSP usually administers.

When the answer is no, the client rarely stops. Staff sign up for personal accounts and upload files by hand, which gives the business less control than a properly set-up business plan. The MSP keeps the risk and loses sight of it.

Challenge 1: a practice built around one vendor

Most Irish MSPs are built around Microsoft, sometimes with one hyperscaler alongside. Their tools, certifications, support processes and commercial relationships assume it. Adding a second AI supplier has a real cost, and the easiest answer is that Copilot covers it.

Clients increasingly want both: Copilot inside the Office apps, and Claude for the deeper work. An MSP that can govern the two side by side, with one set of identity, access and audit controls, is in a stronger position than one that has to choose.

How the two tools differ on the work itself is set out in Claude or Microsoft 365 Copilot, by task.

Challenge 2: the security sign-off

The questions MSPs ask are the right ones, and the documentation answers most of them. The Microsoft 365 connector uses delegated permissions, so it acts as each signed-in person and reaches only what they could already open. It does not need administrator rights. A Global Administrator approves it once for the tenant, and Microsoft shows the full permission list before they accept.

Access can be limited to a pilot group by setting Assignment required on the two enterprise applications consent creates, M365 MCP Server for Claude and M365 MCP Client for Claude. Individual permissions can be revoked, for example to keep Claude out of Teams. Anthropic states that every Microsoft Graph call the connector makes is recorded in the Microsoft 365 audit log.

Two points need real attention. Anthropic states that location-based and network-based Conditional Access policies and sign-in frequency policies are not supported, because requests come from Anthropic's servers. And SharePoint search cannot be limited to particular sites, so over-shared content becomes easier to find, as it does with Copilot.

The full data handling picture is in is it safe to connect Claude to Microsoft 365?

Challenge 3: the client is on the wrong plan

Many of the problems an MSP sees come from personal Free, Pro or Max accounts. These belong to the person, not the business, and on them each person decides whether chats may be used to improve Claude. Connecting a work tenant to a personal subscription is the arrangement to stop.

Claude Team and Claude Enterprise come under Anthropic's commercial terms, with the business as data controller and Anthropic as processor. Team has a two-seat minimum and monthly billing, and includes single sign-on and admin control over connectors. Enterprise adds SCIM provisioning, audit logs, the Compliance API and custom data retention, which is often what a client's security lead asks for before signing off.

The difference between the two plans is in Claude Team or Claude Enterprise.

Challenge 4: Copilot and Claude in the same tenant

Copilot runs under the client's Microsoft agreement and, for EU customers, Microsoft states it is an EU Data Boundary service, with exceptions such as web search queries sent to Bing. Claude is a separate supplier under its own terms and Data Processing Addendum, and its processing may take place outside the EU.

Microsoft also offers Anthropic models inside Copilot. It documents that these are currently excluded from the EU Data Boundary and switched off by default for EU tenants. Clients asking for Claude inside Copilot need that explained before anyone turns it on.

For most clients this is something to document rather than a barrier. A client with a contractual requirement for EU-only processing will currently find Copilot's commitment the closer fit, and that requirement should decide it.

Challenge 5: who supports it afterwards

The tenant work is a few hours. The ongoing load is people asking how to use Claude well, which is a training question rather than a helpdesk one. Without training, staff use Claude like a search box, value is hard to show and the MSP fields questions it isn't set up to answer.

A clear split works best. The MSP keeps the tenant, identity, connector settings and audit. Questions about using Claude go to Anthropic's support and to whoever trains the client's staff. A short written record of the connector settings lets the helpdesk answer the occasional access question.

What a safe yes looks like

• Move the client onto Claude Team or Enterprise, in the business's name, and away from personal accounts.
• Review over-shared SharePoint sites before anyone connects.
• Grant admin consent, set Assignment required on both enterprise applications and assign a pilot group.
• Check Conditional Access policies against Anthropic's supported list before the first user connects.
• Start with read access. Approve write permissions later, once people know how to check Claude's work.
• Agree who handles training and day-to-day questions about using Claude.

The client-facing steps are in what your IT provider needs to do to connect Claude to Microsoft 365, written so the client can forward it.

Working with us

We work alongside MSPs rather than in place of them. Either you refer the client and we set up Claude and train their people, with your part limited to the connector approval, or you roll Claude out yourself and we train the staff on the configuration you support. The tenant stays with you either way.

Both routes are on Claude for IT providers.

Common questions