This guide explains how system administrators can set up the M365 Tools MCP server in Theta Assist.

Use this guide when you need broader Microsoft 365 capability than the standard built-in connectors provide.

See also:

The M365 Tools MCP server provides broader Microsoft 365 access than the standard built-in connectors. It gives assistants access to email, calendars, Teams, chats, files, SharePoint, OneDrive, people, recent files, Planner, and Excel workbook data.

Quick links

Overview

The M365 Tools MCP server allows Theta Assist to work with Microsoft Graph data using delegated user access. In most cases, this means the assistant acts only within the permissions of the signed-in user.

Compared with the standard Microsoft 365 connectors, this MCP server supports a wider range of actions, including:

  • reading emails and attachments
  • reading calendars and shared calendars
  • retrieving Teams meeting transcripts
  • searching across OneDrive, SharePoint and Teams files
  • reading Teams channel posts and chat messages
  • looking up people and directory details
  • listing recent and shared files
  • reading Excel worksheets, ranges, tables, and charts
  • rendering Excel charts as inline images in chat
  • editing supported Excel workbooks inside the configured AIWorkSpace folder when enabled by an administrator
  • sending an email to the signed-in user
  • drafting a new email or reply to an existing email, ready to review and send in Outlook
  • working with Planner tasks (see separate setup guide)

M365 Tools vs standard Microsoft connectors

Option Where admins set it up Best for
Standard Microsoft connectors Admin > Tools > Connectors Simpler built-in Microsoft access with narrower, mostly read-focused capability
M365 Tools MCP server Admin > Tools > MCP Servers Broader Microsoft 365 capability with a wider set of actions and deeper Graph-based access, including richer Excel workbook support

If the standard Microsoft connectors already meet your needs, see Connectors | Admin guide.

If you need broader Microsoft 365 capability, use M365 Tools.

Built-in Theta Assist MCP server

The M365 Tools MCP tool is a built-in Theta Assist MCP server.

You do not need to manually enter a custom MCP endpoint URL for this integration.

To add the M365 Tools MCP tool:

  1. Go to Admin > Tools > MCP Servers.
  2. Click the green + Theta Assist MCP Server button.
  3. Select the M365 Tools option.
  4. Attach the appropriate Microsoft authentication configuration.
  5. Set the approval policy and save.

M365 Tools listed as a built-in Theta Assist MCP server option.

What the M365 Tools MCP server can do

Email and mailboxes

The server can:

  • list email messages
  • fetch full message content
  • download email attachments
  • search for shared or delegated mailboxes
  • create draft emails
  • create draft replies to existing messages
  • send an email to self

Calendar and meetings

The server can:

  • search calendar events
  • read calendar attachments
  • retrieve Teams meeting transcripts from meeting join links

Files and documents

The server can:

  • search across Microsoft 365 files
  • browse OneDrive and SharePoint folders
  • download supported files
  • read Excel workbook content by worksheet, range, table, and chart
  • render Excel charts as inline images in chat
  • edit supported Excel workbooks inside the configured AIWorkSpace folder when enabled
  • read SharePoint Lists

Teams and chats

The server can:

  • list joined Teams and channels
  • read channel conversations and replies
  • list personal and group chats
  • search Teams messages

People and profile data

The server can:

  • return the signed-in user profile
  • look up colleagues
  • find relevant people and contacts
  • list recent, used, and shared files

Available tools

The M365 Tools MCP server includes tools across email, calendar, files, Teams, people, and Excel.

Email

  • ta_m365_list_emails
  • ta_m365_get_email
  • ta_m365_get_email_attachment
  • ta_m365_find_mailbox
  • ta_m365_create_draft_email
  • ta_m365_create_draft_reply
  • ta_m365_send_email_to_self

Calendar and meetings

  • ta_m365_get_calendar_events
  • ta_m365_get_calendar_attachment
  • ta_m365_get_meeting_transcript

File search, OneDrive and SharePoint

  • ta_m365_search_files
  • ta_m365_onedrive_search
  • ta_m365_onedrive_list
  • ta_m365_onedrive_download
  • ta_m365_sharepoint_find_site
  • ta_m365_sharepoint_get_drives
  • ta_m365_sharepoint_search
  • ta_m365_sharepoint_list
  • ta_m365_sharepoint_download
  • ta_m365_sharepoint_find_list
  • ta_m365_sharepoint_get_list_schema
  • ta_m365_sharepoint_query_list

Teams

  • ta_m365_teams_list_joined
  • ta_m365_teams_list_channels
  • ta_m365_teams_channel_files_root
  • ta_m365_teams_group_drive
  • ta_m365_teams_get_channel_messages
  • ta_m365_teams_get_channel_replies
  • ta_m365_teams_list_chats
  • ta_m365_teams_get_chat_messages
  • ta_m365_teams_search_messages

People, profile and productivity

  • ta_m365_get_user
  • ta_m365_find_people
  • ta_m365_recent_files
  • ta_m365_send_email_to_self

Excel

Excel support uses Microsoft's supported Graph Workbook API.

Reading tools:

  • ta_m365_excel_get_worksheets
  • ta_m365_excel_read_range
  • ta_m365_excel_list_tables
  • ta_m365_excel_list_charts
  • ta_m365_excel_get_chart_image

Editing tools:

  • ta_m365_excel_update_range
  • ta_m365_excel_add_table_row
  • ta_m365_excel_add_worksheet
  • ta_m365_excel_create_table

Excel editing safety and workspace restrictions

Excel editing is protected by two separate controls.

  1. Admin switch. The existing Enable AIWorkSpace file writes setting in Admin > M365 Tool Settings also controls whether Excel editing tools are available. When this setting is off, Excel editing tools are not offered to the assistant. Excel reading tools are unaffected.
  2. Location restriction. Even when Excel editing is enabled, the assistant can only edit workbooks stored inside the configured workspace folder, which is AIWorkSpace by default, or one of its subfolders.

If the assistant attempts to edit a workbook outside the configured workspace folder, the request is refused and no change is made.

This matches the existing workspace file write behaviour, so administrators manage one consistent safe area for assistant-created or assistant-edited files. Learn more

Excel workbook support and limitations

  • Only modern .xlsx workbooks are supported.
  • Legacy .xls workbooks are not supported.
  • Workbooks must be stored in OneDrive for Business, SharePoint, or Teams.
  • Personal Microsoft accounts and consumer OneDrive are not supported.
  • Changes are saved directly to the workbook.

Admin setup overview

To set up the M365 Tools MCP server:

  1. Create or update a Microsoft Entra ID app registration.
  2. Add the required Microsoft Graph permissions.
  3. Grant admin consent where required.
  4. Reuse or create a Microsoft authentication configuration in Theta Assist.
  5. Go to Admin > Tools > MCP Servers.
  6. Click the green + Theta Assist MCP Server button.
  7. Select M365 Tools.
  8. Choose the authentication configuration.
  9. Review Admin > M365 Tool Settings if you want to enable Excel editing or change the workspace folder name.
  10. Set approval policy and access controls.
  11. Test with a limited admin or pilot group first.

For shared authentication setup guidance, see Authentication configurations | Admin guide.

For general MCP setup guidance, see MCP servers | Admin guide.

App registration permissions

Important: If you already have an app registration for the existing Microsoft 365 connectors, you can usually extend that same app registration by adding the extra permissions. The next section shows the main differences.

Required permissions

Permission Type Purpose
Calendars.Read Delegated Read user calendars
Calendars.Read.Shared Delegated Read user and shared calendars
Channel.ReadBasic.All Delegated Read the names and descriptions of channels
ChannelMessage.Read.All Delegated Read user channel messages
ChannelSettings.Read.All Delegated Read the names, descriptions, and settings of channels
Chat.Read Delegated Read user chat messages
Contacts.Read Delegated Read user contacts
Directory.Read.All Delegated Read directory data
Files.Read Delegated Read user files, including Excel workbook reading
Files.Read.All Delegated Read all files that user can access
Files.ReadWrite Delegated Read and edit supported files, including Excel workbooks in the configured AIWorkSpace folder
Group.Read.All Delegated Read all groups
Mail.Read Delegated Read user mail
Mail.ReadWrite Delegated Read and write access to user mail
Mail.Send Delegated Send mail as a user
MailboxSettings.Read Delegated Read user mailbox settings
offline_access Delegated Maintain access to data you have given it access to
OnlineMeetingRecording.Read.All Delegated Read all recordings of online meetings
OnlineMeetings.Read Delegated Read user's online meetings
OnlineMeetingTranscript.Read.All Delegated Read all transcripts of online meetings
openid Delegated Sign users in
People.Read.All Delegated Read all users' relevant people lists
Presence.Read.All Delegated Read presence information of all users in your organisation
profile Delegated View users' basic profile
Sites.Read.All Delegated Read items in all site collections
Tasks.Read Delegated Read user's tasks and task lists
Team.ReadBasic.All Delegated Read the names and descriptions of teams
User.Read Delegated Sign in and read user profile
User.ReadBasic.All Delegated Read all users' basic profiles

For Excel workbooks, reading requires Files.Read. Editing requires Files.ReadWrite.

Extra permissions if you already use standard Microsoft connectors

If your organisation already uses the standard Microsoft 365 connectors, the following are the main additional permissions typically needed for the M365 Tools MCP server:

  • Calendars.Read.Shared
  • ChannelSettings.Read.All
  • Directory.Read.All
  • Files.Read.All
  • Files.ReadWrite
  • Group.Read.All
  • Mail.ReadWrite
  • Mail.Send
  • MailboxSettings.Read
  • OnlineMeetingRecording.Read.All
  • OnlineMeetings.Read
  • OnlineMeetingTranscript.Read.All
  • People.Read.All
  • Presence.Read.All
  • Tasks.Read
  • User.ReadBasic.All

Why these permissions are needed

These additional permissions enable broader MCP functionality such as:

  • shared calendar access
  • Teams transcript access
  • wider file discovery across Microsoft 365
  • people and directory lookups
  • sending mail to self
  • richer Teams and organisational context
  • Excel workbook editing inside the configured workspace folder
  • Planner-related access where relevant

For Planner permissions and further details, see Planner MCP tool | Admin guide.

Suggested rollout approach

For initial rollout,we recommend you:

  • extend your existing Microsoft app registration rather than creating a duplicate one
  • grant the additional permissions listed above
  • create a separate Theta Assist authentication configuration for the M365 MCP server if you want to keep it separate from the built-in connectors
  • optionally set the MCP server approval policy to Always require approval during testing
  • restrict access using Access Profiles if only some assistant authors should be able to add the server
  • review Admin > M365 Tool Settings and decide whether to leave Enable AIWorkSpace file writes off or enable it for controlled writing and editing files in SharePoint & OneDrive
  • add a new assistant with the tool and validate scenarios such as email access, calendar search, transcript retrieval, file search, Teams retrieval, Excel reading, chart rendering, draft email flows, and Excel editing inside the workspace folder
  • confirm that file saving and editing is refused outside the configured workspace folder

Notes

  • All access is based on delegated permissions, so the assistant can only act on data the signed-in user already has access to.
  • The permission set for this MCP server is broader than the standard connector setup and should be reviewed by your Microsoft 365 administrator and security team.
  • If you already use Microsoft connectors in Theta Assist, this is typically an extension of your existing setup, not a full rebuild.