Planner MCP tool | Admin guide

This guide explains how administrators can enable Microsoft Planner access in Theta Assist using the Planner MCP tool. It covers what the tool can do, the Microsoft permissions it needs, supported board types, and the controls available to limit write access.

Use this guide when you want Theta Assist to read, create and update Planner tasks on behalf of signed-in users.

See also:

• Use Microsoft Planner in Theta Assist
• Connectors and MCP | Admin guide
• M365 Tool MCP server | Admin guide

Overview

The Planner MCP tool adds Microsoft Planner task support to Theta Assist.

With this tool enabled, Theta Assist can act on behalf of the signed-in user to:

• read Planner tasks
• create tasks
• edit tasks
• update task fields
• manage checklists
• add comments where supported
• manage labels, due dates, status and importance
• move tasks between buckets
• add links to tasks

The tool supports both private boards and group boards.

When prompted, it can also add a special link back to the Theta Assist thread that created the task. This provides traceability without requiring the thread to be manually shared.

What the Planner MCP tool supports

The tool supports working with task-level data including:

• all core task fields
• checklists
• comments
• labels
• due dates
• status
• importance
• bucket assignment
• links

It can also add and remove tasks from buckets.

Thread links

When prompted, the Planner MCP tool can add a special link back to the Theta Assist thread that created the task.

Important points:

• the thread does not need to be manually shared
• possession of the special link allows access to the thread
• the special links can be revoked

This can be useful when users want to preserve the source context for follow-up or audit.

Before you start

Before enabling the Planner MCP tool, confirm that:

• users already work with Microsoft Planner in Microsoft 365. Note that Premium Planner boards are not supported.
• the required Microsoft auth configuration is available. You can reuse and extend the existing app registration used for the M365 tool. Learn more
• you are comfortable granting the required delegated Microsoft Graph permissions
• you have decided whether write access should be limited to boards that match a naming convention

Permissions required

The Planner MCP tool uses delegated access of the signed-in user.

The required Microsoft Graph permissions are:

• Tasks.ReadWrite – required for the Planner MCP tool to list, create and update tasks on behalf of the signed-in user across their accessible plans and buckets.
• Group.ReadWrite.All – required for the Planner MCP tool to read and post comments on tasks. Planner stores task comments as Microsoft 365 Group conversation threads using /groups/{id}/threads, so reading and writing these threads requires group-level write consent.

Security and access model

The Planner MCP tool uses the permissions of the signed-in user rather than broad background access unrelated to that user.

That means Theta Assist can only act within the Planner access the user already has.

Important note about permission scope

Group.ReadWrite.All is broad in scope.

However, the Planner MCP tool is designed to use that permission only for the narrow Planner comment use case described above.

If you are reviewing risk internally, call out both points:

• the Microsoft consent scope is broad
• the tool behaviour is intentionally restricted to a narrower operational use

How to enable the Planner MCP Tool for your organisation

1. Go to Admin > Tools > MCP Servers
2. Click + Theta Assist MCP Server
   
   
3. Select Microsoft Planner
4. Server details are pre-populated in the configuration form
5. Select the relevant Microsoft Auth configuration.
6. Optionally, add any restrictions your organisation would like.

Restrict which boards can be written to

Global settings are available to control which boards the Planner MCP tool can write to.

This rule applies to all users of that tool instance.

You can restrict write access so that a board name must:

• start with specific text
• end with specific text
• contain specific text

For example, you could allow write access only for boards whose names start with #.

This gives you a simple way to:

• limit risk
• support naming conventions
• separate writable boards from read-only boards
• roll out access gradually

Example approach

You might choose a naming standard such as:

• #Operations
• #Marketing
• #Projects

Then configure the Planner MCP tool so only boards beginning with # are writable.

Supported and unsupported behaviour

Supported

• reading tasks
• creating tasks
• editing task fields
• moving tasks between buckets
• adding links
• comments on supported boards
• both private and group boards

Not supported

• creating new boards
• creating bucket names
• editing bucket names
• attaching files directly to tasks
• comments on private boards
• Premium Planner boards

Notes:

File attachments are not supported. Use links instead.

Premium Planner boards are not supported because they are a separate Microsoft product.

Recommended rollout

For a safer rollout, consider:

1. reusing the existing M365 app registration if appropriate
2. adding the two required delegated permissions
3. enabling the Planner MCP tool for a limited admin or pilot group first
4. applying a board naming restriction for write access
5. testing both a group board and a private board
6. confirming expected behaviour for task creation, task updates, bucket moves, link creation, comment handling and special thread links