{"versionId":"84cb0ed5-8088-4779-df98-08ded7d87211","articleId":"edc12a74-f057-4ac3-2e32-08deb787de13","title":"M365 Tools MCP server | Admin guide","tags":["connectors","MCP","System admin","All articles"],"content":"
\n
\n
\n
\n
\n
\n
\n

This guide for administrators explains how to set up the M365 Tools MCP server in Theta Assist.

\n

See also:

\n\n

The M365 Tools MCP server provides broader Microsoft 365 access than the standard built-in connectors. It gives assistants access to email, calendars, Teams, chats, files, SharePoint, OneDrive, people, recent files, Planner and Excel workbook data.

\n
\n

In this guide

\n\n
\n

Overview

\n

The M365 Tools MCP server allows Theta Assist to work with Microsoft Graph data using delegated user access. In most cases, this means the assistant acts only within the permissions of the signed-in user.

\n

Compared with the standard Microsoft 365 connectors, this MCP server supports a wider range of actions, including:

\n
    \n
  • reading emails and attachments
    • \n
  • reading calendars and shared calendars
    • \n
  • retrieving Teams meeting transcripts
    • \n
  • searching across OneDrive, SharePoint and Teams files
    • \n
  • reading Teams channel posts and chat messages
    • \n
  • looking up people and directory details
    • \n
  • listing recent and shared files
    • \n
  • reading Excel worksheets and cell ranges
    • \n
  • sending an email to the signed-in user
    • \n
  • drafting a new email or reply to an existing email - ready to review and send in Outlook
    • \n
  • work with Planner tasks (see separate setup guide)
    • \n
\n

Note: built-in Theta Assist MCP server

\n

The M365 Tools MCP tool is a built-in Theta Assist MCP Server.

\n

You do not need to manually enter a custom MCP endpoint URL for this integration.

\n

To add the M365 Tools MCP tool:

\n
    \n
  1. Go to Admin → Tools → MCP Servers.
    2. \n
  2. Click the green + Theta Assist MCP Server button.
    3. \n
  3. Select the M365 Tools option.
    4. \n
  4. Attach the appropriate Microsoft auth configuration.
    5. \n
  5. Set the approval policy and save.
    6. \n
\n

\n

What the M365 Tools MCP server can do

\n

Email and mailboxes

\n

The server can:

\n
    \n
  • list email messages
    • \n
  • fetch full message content
    • \n
  • download email attachments
    • \n
  • search for shared or delegated mailboxes
    • \n
  • create draft emails
    • \n
  • create draft replies to existing messages
    • \n
  • send an e-mail to self
    • \n
\n

Calendar and meetings

\n

The server can:

\n
    \n
  • search calendar events
    • \n
  • read calendar attachments
    • \n
  • retrieve Teams meeting transcripts from meeting join links
    • \n
\n

Files and documents

\n

The server can:

\n
    \n
  • search across Microsoft 365 files
    • \n
  • browse OneDrive and SharePoint folders
    • \n
  • download supported files
    • \n
  • read Excel workbook content by worksheet and cell range
    • \n
  • coming soon: read SharePoint Lists
    • \n
\n

Teams and chats

\n

The server can:

\n
    \n
  • list joined Teams and channels
    • \n
  • read channel conversations and replies
    • \n
  • list personal and group chats
    • \n
  • search Teams messages
    • \n
\n

People and profile data

\n

The server can:

\n
    \n
  • return the signed-in user profile
    • \n
  • look up colleagues
    • \n
  • find relevant people and contacts
    • \n
  • list recent, used, and shared files
    • \n
\n

Available tools

\n

The M365 Tools MCP server includes 34 tools.

\n

Email

\n
    \n
  • ta_m365_list_emails
    • \n
  • ta_m365_get_email
    • \n
  • ta_m365_get_email_attachment
    • \n
  • ta_m365_find_mailbox
    • \n
  • ta_m365_create_draft_email
    • \n
  • ta_m365_create_draft_reply
    • \n
  • ta_m365_send_email_to_self
    • \n
\n

Calendar and meetings

\n
    \n
  • ta_m365_get_calendar_events
    • \n
  • ta_m365_get_calendar_attachment
    • \n
  • ta_m365_get_meeting_transcript
    • \n
\n

File search, OneDrive and SharePoint

\n
    \n
  • ta_m365_search_files
    • \n
  • ta_m365_onedrive_search
    • \n
  • ta_m365_onedrive_list
    • \n
  • ta_m365_onedrive_download
    • \n
  • ta_m365_sharepoint_find_site
    • \n
  • ta_m365_sharepoint_get_drives
    • \n
  • ta_m365_sharepoint_search
    • \n
  • ta_m365_sharepoint_list
    • \n
  • ta_m365_sharepoint_download
    • \n
\n

Teams

\n
    \n
  • ta_m365_teams_list_joined
    • \n
  • ta_m365_teams_list_channels
    • \n
  • ta_m365_teams_channel_files_root
    • \n
  • ta_m365_teams_group_drive
    • \n
  • ta_m365_teams_get_channel_messages
    • \n
  • ta_m365_teams_get_channel_replies
    • \n
  • ta_m365_teams_list_chats
    • \n
  • ta_m365_teams_get_chat_messages
    • \n
  • ta_m365_teams_search_messages
    • \n
\n

People, profile and productivity

\n
    \n
  • ta_m365_get_user
    • \n
  • ta_m365_find_people
    • \n
  • ta_m365_recent_files
    • \n
  • ta_m365_send_email_to_self
    • \n
\n

Excel

\n
    \n
  • ta_m365_excel_get_worksheets
    • \n
  • ta_m365_excel_read_range
    • \n
\n

Admin setup overview

\n

To set up the M365 MCP server:

\n
    \n
  1. Create or update a Microsoft Entra ID App Registration.
    2. \n
  2. Add the required Microsoft Graph permissions.
    3. \n
  3. Grant admin consent where required.
    4. \n
  4. Reuse or create a Microsoft OAuth Auth Configuration in Theta Assist.
    5. \n
  5. Go to Admin → Tools → MCP Servers.
    6. \n
  6. Click the green + Theta Assist MCP Server button.
    7. \n
  7. Select M365 Tools.
    8. \n
  8. Choose the auth configuration.
    9. \n
  9. Set approval policy and access controls.
    10. \n
  10. Test with a limited admin or pilot group first.
    11. \n
\n

App registration permissions

\n
\n

Important: If you already have an app registration for the existing Microsoft 365 connectors, you can usually extend that same app registration by adding the extra permissions - see next section to see what the differences are.

\n
\n

Required permissions

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PermissionTypePurpose
Calendars.ReadDelegatedRead user calendars
Calendars.Read.SharedDelegatedRead user and shared calendars
Channel.ReadBasic.AllDelegatedRead the names and descriptions of channels
ChannelMessage.Read.AllDelegatedRead user channel messages
ChannelSettings.Read.AllDelegatedRead the names, descriptions, and settings of channels
Chat.ReadDelegatedRead user chat messages
Contacts.ReadDelegatedRead user contacts
Directory.Read.AllDelegatedRead directory data
Files.ReadDelegatedRead user files
Files.Read.AllDelegatedRead all files that user can access
Group.Read.AllDelegatedRead all groups
Mail.ReadDelegatedRead user mail
Mail.ReadWriteDelegatedRead and write access to user mail
Mail.SendDelegatedSend mail as a user
MailboxSettings.ReadDelegatedRead user mailbox settings
offline_accessDelegatedMaintain access to data you have given it access to
OnlineMeetingRecording.Read.AllDelegatedRead all recordings of online meetings
OnlineMeetings.ReadDelegatedRead user's online meetings
OnlineMeetingTranscript.Read.AllDelegatedRead all transcripts of online meetings
openidDelegatedSign users in
People.Read.AllDelegatedRead all users' relevant people lists
Presence.Read.AllDelegatedRead presence information of all users in your organisation
profileDelegatedView users' basic profile
Sites.Read.AllDelegatedRead items in all site collections
Tasks.ReadDelegatedRead user's tasks and task lists
Team.ReadBasic.AllDelegatedRead the names and descriptions of teams
User.ReadDelegatedSign in and read user profile
User.ReadBasic.AllDelegatedRead all users' basic profiles
\n

Important: extra permissions needed if you already use Microsoft 365 connectors

\n

If your organisation already uses the standard Microsoft 365 connectors described in the existing help article, the following are the main additional permissions typically needed for the M365 Tools MCP server:

\n
    \n
  • Calendars.Read.Shared
    • \n
  • ChannelSettings.Read.All
    • \n
  • Directory.Read.All
    • \n
  • Files.Read.All
    • \n
  • Group.Read.All
    • \n
  • Mail.ReadWrite
    • \n
  • Mail.Send
    • \n
  • MailboxSettings.Read
    • \n
  • OnlineMeetingRecording.Read.All
    • \n
  • OnlineMeetings.Read
    • \n
  • OnlineMeetingTranscript.Read.All
    • \n
  • People.Read.All
    • \n
  • Presence.Read.All
    • \n
  • Tasks.Read
    • \n
  • User.ReadBasic.All
    • \n
\n

Why these permissions are needed

\n

These additional permissions enable broader MCP functionality such as:

\n
    \n
  • shared calendar access
    • \n
  • Teams transcript access
    • \n
  • wider file discovery across Microsoft 365
    • \n
  • people and directory lookups
    • \n
  • sending mail to self
    • \n
  • richer Teams and organisational context
    • \n
  • for Planner permissions and further details, see Planner MCP tool | Admin guide
    • \n
\n

Suggested rollout approach

\n

For initial rollout, we recommend:

\n
    \n
  • Extend your existing Microsoft app registration rather than creating a duplicate one.
    • \n
  • Grant the additional permissions listed above.
    • \n
  • Create a separate Theta Assist Auth Configuration for the M365 MCP server if you want to keep it separate from the built-in connectors.
    • \n
  • Optionally set the MCP server approval policy to Always require approval during the test.
    • \n
  • Restrict access using Access Profiles - this restricts who can add the MCP to their assistants.
    • \n
  • Add a new assistant with the tool and then validate the following scenarios:\n
      \n
    • email listing and attachment access
      • \n
    • calendar search and transcript retrieval
      • \n
    • OneDrive and SharePoint file search
      • \n
    • Teams channel and chat retrieval
      • \n
    • Excel worksheet and range reading
      • \n
    • send-email-to-self flow
      • \n
    • draft email creation
      • \n
    • draft reply creation
      • \n
    \n
    • \n
  • Enable an 'Office Assistant\" for general use with the tool enabled for all staff
    • \n
\n

Notes

\n
    \n
  • All access is based on delegated permissions, so the assistant can only act on data the signed-in user already has access to.
    • \n
  • The permission set for this MCP server is broader than the standard connector setup and should be reviewed by your Microsoft 365 administrator and security team.
    • \n
  • If you already use Microsoft connectors in Theta Assist, this is typically an extension of your existing setup, not a full rebuild.
    • \n
\n
\n
\n
\n
\n
\n
\n
","description":"Set up the M365 Tools MCP server in Theta Assist to give assistants secure access to Microsoft 365 data such as email, calendars, Teams, SharePoint, OneDrive and Excel workbooks.","isMarkdown":false,"publishedOnUtc":"2026-07-02T01:27:22.4118424","modifiedOnUtc":"2026-05-21T22:25:30.6830162"}