Is it safe to connect Claude to Microsoft 365?

What the connector is

Claude's Microsoft 365 connector is an integration that Anthropic hosts. When someone asks Claude a question that needs their email, files or Teams messages, the connector requests the relevant items from Microsoft Graph, which is Microsoft's own interface to Microsoft 365 data, and passes them to Claude for the answer. Anthropic makes the connector available on every Claude plan.

The connector uses delegated permissions. In Microsoft's terms, that means it acts as the signed-in person and can read only what that person could already open. Anthropic's security guide says users cannot get around SharePoint sharing settings or folder permissions, and that your Microsoft 365 data loss prevention policies continue to apply.

This matters because the connector inherits your existing access model, including any folders that are open to more people than they should be.

What leaves your tenant and what stays

Your files, mailboxes and Teams history stay where they are. Anthropic states that the connector fetches content only while it is answering a request, and that it does not cache file content.

The material Claude reads to answer a question does leave the tenant. Those extracts are sent to Anthropic for processing, and the conversation, including what the connector returned, is kept in Claude's chat history under your plan's retention settings. Anthropic's privacy centre says data from its commercial products is stored in the United States.

The accurate description, then, is that your Microsoft 365 data is not copied out in bulk, but the parts used in each conversation are processed and stored by Anthropic. That is the point to record in your data protection documentation.

Where the AI processing happens

Anthropic's privacy centre says that, unless otherwise agreed, traffic from its commercial products may be processed in selected countries in the United States, Europe, Asia and Australia. It describes a US-only processing option for some Enterprise customers. It does not describe an EU-only processing option for Claude Team or Enterprise used through claude.ai.

For most Irish businesses this is something to document under GDPR rather than a reason to stop. Anthropic's commercial terms incorporate its Data Processing Addendum, which sets out how Anthropic processes personal data on your behalf. Your data protection lead should read it, including the sections on international transfers, and add Anthropic to your records as a processor.

If a contract says where data may be processed, read the exact wording. Public sector tenders and client contracts differ: some make EU processing a requirement, others state it as a preference. The answer for Claude depends on which one you have signed.

Business plans and personal accounts

Claude Team and Claude Enterprise come under Anthropic's commercial terms. Under those terms Anthropic may not train its models on your content, your organisation is the data controller and Anthropic acts as processor, and the Data Processing Addendum applies. The one exception Anthropic describes is an organisation that chooses to join its Development Partner Program.

On the individual Free, Pro and Max plans, each person decides in a privacy setting whether their chats may be used to improve Claude, and the business does not own or control the account. Staff connecting their work Microsoft 365 accounts to personal Claude subscriptions is the arrangement to avoid.

A Team plan also gives the business central control: an owner decides which connectors are available, people sign in with single sign-on, and billing is in the business's name. According to Anthropic's plan comparison, Enterprise adds audit logs, SCIM user provisioning, custom data retention and IP allowlisting.

What your IT provider controls in Microsoft Entra

• Approval. Nobody can connect until a Global Administrator grants consent for the connector once for the tenant. Microsoft shows the full list of permissions before they accept.
• Who can connect. Consent creates two enterprise applications, M365 MCP Server for Claude and M365 MCP Client for Claude. Setting Assignment required to Yes on both, and assigning the same people or groups to each, limits the connector to a pilot group. Microsoft notes that assigning a group, rather than individual people, needs a Microsoft Entra ID P1 or P2 licence.
• What it can reach. Individual permissions can be revoked on the M365 MCP Server for Claude application. Anthropic's examples: removing Sites.Read.All blocks SharePoint, Mail.Read blocks Outlook and Chat.Read blocks Teams. The change takes effect immediately. Repeating admin consent later restores the full permission set, including write permissions, so keep a note of anything removed.
• Write actions. Sending email, changing calendar events, updating files and posting in Teams need extra permissions that an administrator approves, and the Claude owner then turns them on. Tenants that approved the connector before write tools existed have them blocked until then.
• Sign-in policies. Anthropic states that group-based assignment and MFA policies are supported. Location-based and network-based Conditional Access policies and sign-in frequency policies are not, because the connector's requests come from Anthropic's servers rather than the user's device.

What the audit log shows

Anthropic's security guide states that every Microsoft Graph call the connector makes is recorded in your organisation's Microsoft 365 audit log. Microsoft's audit search is in the Microsoft Purview portal, and the standard tier keeps records for 180 days. The detail in each record depends on your Microsoft licence, so ask your IT provider to run a test search once the first users have connected.

Inside Claude, an audit log of user activity is an Enterprise feature. On a Team plan, the Microsoft audit log is where you see what the connector accessed.

The real risks: over-shared files and prompt injection

The most likely problem is ordinary over-sharing. Claude will find anything the signed-in person can open, including folders shared more widely than anyone intended, and Anthropic notes that limiting SharePoint search to particular sites is not supported. Microsoft search and Copilot have the same exposure. The remedy is also the same: review sites shared with everyone, archive or lock down old team sites, and agree which libraries the first group needs for its work.

Start with a defined set of material rather than the whole of SharePoint. Give the first group a Claude project whose instructions name the libraries and documents to use. Answers are better, and much easier to check, when Claude starts from the right sources.

Prompt injection is text hidden in an email or document that tries to instruct the AI, for example to forward a thread or change a figure. Anthropic's documentation for its Office add-ins warns about this for files and emails from outside the organisation, and the same caution applies to anything the connector reads. The risk is greatest once write actions are on. Anthropic requires confirmation before Claude sends Teams messages and does not allow several sending tools to be set to always run. Begin with read access, and have people read every draft before it goes.

How this compares with Copilot

Microsoft 365 Copilot, which Microsoft now calls Microsoft Copilot, also reads through Microsoft Graph with each person's permissions, so the over-sharing point applies equally to both. The differences are who processes the data, under which contract, and where.

Copilot is covered by your existing Microsoft agreement and data protection addendum. For EU customers, Microsoft states that Copilot is an EU Data Boundary service and that EU traffic stays within the boundary for AI processing. Microsoft documents two exceptions: web search queries that Copilot sends to Bing fall outside the EU Data Boundary and the addendum, and Anthropic models offered inside Copilot are currently excluded from the boundary and switched off by default for EU tenants.

Claude is a separate supplier with its own commercial terms and addendum, and its processing may take place outside the EU. Many firms accept that once it is documented. A firm with a contractual requirement for EU-only processing will currently find Copilot's commitment the closer fit, and that requirement should decide the question. Many businesses use both, choosing by task.

For how the two tools differ on the work itself, see Claude or Microsoft 365 Copilot, by task.

A sensible way to start

• Buy Claude Team for a named group, in the business's name. Monthly billing suits the first few months.
• Ask your IT provider to grant consent, set Assignment required on both applications and assign the pilot group.
• Review over-shared SharePoint sites before anyone connects.
• Start with read access, and add write actions once people know how to check Claude's work.
• Record Anthropic as a processor and keep a copy of its Data Processing Addendum with your GDPR records.
• Keep your documents organised in Microsoft 365. They stay there whichever AI tool you use, so changing tools later means changing a subscription and a connector rather than moving your files.

Your IT provider's part is set out step by step in what your IT provider needs to do, written so you can forward it.

Common questions