Your IT provider says it can't set up Claude: the questions behind it

Why IT providers are cautious

Many Irish IT providers specialise in Microsoft. Their tools, training and support contracts are built around Microsoft products, and Copilot fits that model well. Taking on another product has a real cost for them, and questioning any new application in a client's tenant is part of the job you pay them for.

The concerns below are raised in good faith, and most have something to them. Each heading is a concern we hear, followed by what Anthropic's and Microsoft's documentation says. Your IT provider knows your tenant, your permissions and your people, which makes them well placed to help Claude work safely once the facts are clear.

“Copilot is safe because it runs inside your tenancy. Claude doesn't.”

Partly true. Copilot runs under your Microsoft agreement, and for EU customers Microsoft states that it is an EU Data Boundary service, with some exceptions such as web search queries sent to Bing. Claude is a separate supplier: your files stay in Microsoft 365, the connector reads only what each person can already open, and the extracts it uses for an answer are processed by Anthropic, possibly outside the EU, under Anthropic's commercial terms and Data Processing Addendum.

The real difference is the supplier and the processing location. Both tools respect your Microsoft 365 permissions. Whether the processing location matters depends on your contracts and your data protection assessment, and for most businesses it is something to document rather than a barrier.

The detail is in is it safe to connect Claude to Microsoft 365?

“We can't implement Claude.”

Fair, and often true of the Claude side, which is fine. Choosing the plan, setting up the Claude organisation, writing shared instructions and training people all happen inside Claude, outside a managed IT service. Anyone the business chooses can do that work.

The part that touches Microsoft 365 is small: a Global Administrator approves the connector once for the tenant, and can limit it to a pilot group. Anthropic publishes the steps, and the IT provider does not need to learn Claude to follow them.

“Give one person a month's licence and upload the documents by hand.”

A short trial is sensible. The question is what it tests. An individual Pro or Max subscription belongs to the person rather than the business, and on those plans each person decides whether their chats may be used to improve Claude. Uploading a handful of files shows how Claude reads a document you chose, not whether it finds the right material across email and SharePoint, which is usually what the business wants to know.

Claude Team is the business plan. Anthropic lists a minimum of two seats and offers monthly billing, so a trial for a small group does not commit you to a year, and the business terms apply from the first day.

“Claude would need admin access to your tenant.”

It does not. The connector uses delegated permissions, acting as each signed-in person. Administrator rights stay with your IT provider. Microsoft shows them the full list of permissions on the consent screen before they approve.

“We'd lose control over who uses it.”

The controls are standard Microsoft Entra settings. Setting Assignment required on the connector's two enterprise applications limits it to named users or groups. Individual permissions can be revoked, for example to keep Claude out of Teams. MFA and group-based Conditional Access policies apply. On the Claude side, the business's Claude owner decides which connectors staff can use.

“It will open up everything in SharePoint.”

Claude reaches what each person can already open, no more. It is true that SharePoint search cannot be limited to particular sites, so anything over-shared becomes easier to find. Copilot and Microsoft search have the same exposure. A review of over-shared sites before the first users connect is worth doing whichever tool you choose, and it is work an IT provider is well placed to do.

“Our Conditional Access policies will block it.”

Sometimes true, and worth checking before the first user connects. Anthropic states that location-based and network-based policies and sign-in frequency policies are not supported, because requests come from Anthropic's servers. Anthropic publishes the address range those requests come from, which administrators can exclude from location and sign-in frequency policies. It advises against doing this for device compliance policies, which are checked when each person connects.

“We'd end up supporting it.”

Your IT provider's responsibility stays with the tenant. Questions about using Claude go to Anthropic's support and to whoever set Claude up for you. A short written record of the connector settings, kept with the IT provider's documentation, means their helpdesk can answer the occasional question about access.

The one step that is genuinely the IT provider's

• A Global Administrator grants admin consent for Claude's Microsoft 365 connector, either from inside Claude or with Anthropic's admin consent link.
• Optionally, they set Assignment required on M365 MCP Server for Claude and M365 MCP Client for Claude and assign the pilot group to both.
• Later, if the business wants Claude to send email or update files, an administrator approves the write permissions.

Each step is written out for them in what your IT provider needs to do to connect Claude to Microsoft 365. You can forward it as it is.

Common questions