# upload-my-profile-photo Update the photo for the specified contact, group, team, or user in a tenant. The size of the photo you can update to is limited to 4 MB. You can use either PATCH or PUT for this operation. 💡 TIP: Uploads a new profile photo for the signed-in user. Body is a base64-encoded string of the image bytes (the server decodes before PUT). Photo must be JPEG, max 4 MB; the base64 travels as a tool argument and a truncated one is written without error, so resize before encoding instead of emitting a large string. Microsoft 365 generates HD downsized variants automatically (48x48, 64x64, 96x96, 120x120, 240x240, 360x360, 432x432, 504x504, 648x648). For work or school accounts, ProfilePhoto.ReadWrite.All is the more granular alternative permission. Use download-bytes with target=/me/photo/$value to retrieve the current photo. Agent View of the PolicyLayer registry record for `upload-my-profile-photo`. HTML page: https://policylayer.com/tools/jo3zik-ms-365-mcp-server/upload-my-profile-photo ## Facts - Tool: `upload-my-profile-photo` - Server: Ms 365 (`@jo3zik/ms-365-mcp-server`) — https://policylayer.com/tools/jo3zik-ms-365-mcp-server.md - Install: `npx -y @jo3zik/ms-365-mcp-server` - Homepage: https://www.npmjs.com/package/@jo3zik/ms-365-mcp-server - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 4 (1 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `body` | string | yes | Base64-encoded file content. The server decodes it and PUTs the raw bytes to Microsoft Graph. | | `confirm` | boolean | no | For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly app | | `includeHeaders` | boolean | no | Include response headers (including ETag) in the response metadata | | `excludeResponse` | boolean | no | Exclude the full response body and only return success or failure indication | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "upload-my-profile-photo", "arguments": { "body": "" } } } ``` ## Why upload-my-profile-photo is rated Medium An AI agent can call upload-my-profile-photo faster than any human can review: one bad instruction and it creates or modifies resources in Ms 365 by the hundred, each call as confident as the last. Risk signals: Accepts raw HTML/template content (body) ## Use case AI agents use upload-my-profile-photo to create or update resources in Ms 365, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Ms 365 environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Ms 365: ```json { "version": "1", "default": "deny", "tools": { "upload-my-profile-photo": { "limits": [ { "counter": "upload-my-profile-photo_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Ms 365 (193) - `cancel-calendar-event` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/cancel-calendar-event.md - `clear-excel-range` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/clear-excel-range.md - `delete-calendar` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-calendar.md - `delete-calendar-event` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-calendar-event.md - `delete-contact-folder` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-contact-folder.md - `delete-drive-item-permission` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-drive-item-permission.md - `delete-excel-range` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-excel-range.md - `delete-excel-table-row` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-excel-table-row.md - `delete-focused-inbox-override` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-focused-inbox-override.md - `delete-mail-attachment` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-mail-attachment.md - `delete-mail-folder` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-mail-folder.md - `delete-mail-message` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-mail-message.md - `delete-mail-rule` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-mail-rule.md - `delete-my-calendar-permission` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-my-calendar-permission.md - `delete-onedrive-file` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-onedrive-file.md - `delete-onenote-page` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-onenote-page.md - `delete-outlook-contact` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-outlook-contact.md - `delete-planner-bucket` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-planner-bucket.md - `delete-planner-task-message` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-planner-task-message.md - `delete-specific-calendar-event` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-specific-calendar-event.md - `delete-subscription` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-subscription.md - `delete-todo-linked-resource` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-todo-linked-resource.md - `delete-todo-task` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-todo-task.md - `delete-todo-task-list` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/delete-todo-task-list.md - `graph-batch` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/graph-batch.md - `logout` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/logout.md - `remove-account` — Destructive — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/remove-account.md - `parse-teams-url` — Execute — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/parse-teams-url.md - `tentatively-accept-calendar-event` — Execute — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/tentatively-accept-calendar-event.md - `dismiss-calendar-event-reminder` — Read — https://policylayer.com/tools/jo3zik-ms-365-mcp-server/dismiss-calendar-event-reminder.md - …and 163 more: https://policylayer.com/tools/jo3zik-ms-365-mcp-server.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=jo3zik-ms-365-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/jo3zik-ms-365-mcp-server