// SCAN REPORT

M365 MCP

10 tools. 1 can modify or destroy data without limits.

1 write tool that can modify data. Rate limits recommended.

Last updated: 29 Jun 2026

1 can modify or destroy data

9 read-only

10 tools total

Community server · catalogue entry verified 29/06/2026

How to control M365 MCP ↓

TOOL MAP

What M365 MCP exposes to your agents

Read (9) Write / Execute (1) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous M365 MCP tools

Execute · Medium ms_auth_status While primarily checking authentication status (a Read action), the tool also triggers an external side effect — opening a browser for sign-in — which constitutes an Execute-level action.

1 of M365 MCP's 10 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control M365 MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and M365 MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "ms_calendar": {
    "limits": [
      {
        "counter": "ms_calendar_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register M365 MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON M365 →

Instant setup, no code required.

FULL CATALOGUE

All 10 M365 MCP tools

EXECUTE 1 tools

Execute ms_auth_status Check Microsoft 365 connection status. If not connected, opens browser to sign in.

READ 9 tools

Read ms_calendar Fetch the user Read ms_chat Read the user Read ms_files Browse or search the user Read ms_mail Read the user Read ms_profile Fetch the user Read ms_schedule Check people Read ms_server_info Returns m365-mcp server metadata: version, available tools, and runtime info. Useful for debugging. Read ms_sharepoint Search SharePoint sites, list site lists, or browse list items. Without parameters, searches all accessible si Read ms_transcripts Fetch meeting transcripts from Microsoft Teams.

FAQ

Questions about M365 MCP

Is the M365 MCP server safe to use without restrictions? +

The M365 MCP server is primarily read-only with 9 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the M365 MCP server expose? +

10 tools across 2 categories: Read, Write. 9 are read-only. 1 can modify, create, or delete data.

How do I enforce a policy on M365 MCP? +

Register the M365 MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every M365 MCP tool call.

Deterministic rules across all 10 M365 MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON M365 →

Instant setup, no code required.

10 M365 MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.