Microsoft 365 MCP

Microsoft 365 MCP Server, published by Softeria, connects AI assistants to Microsoft 365 and Office services through Microsoft Graph. The Softeria/ms-365-mcp-server repository announces 300+ tools mapped one-to-one to Graph endpoints, covering Outlook, Calendar, OneDrive, Excel, OneNote, To Do, Planner, Contacts, Search and, in organization mode, Teams, meetings, SharePoint, shared mailboxes, presence, and user management. In the GitHub check on August 26, 2026, the repository was MIT licensed, had 937 stars and 359 forks, and package.json listed @softeria/ms-365-mcp-server with Node engine >=18.

For Educasium, Microsoft 365 MCP is the Microsoft counterpart to Google Workspace MCP, but with a central technical point: Microsoft Graph and its permissions. The key is to explain productive uses together with their guardrails: read-only mode, presets, allowed scopes, multiple accounts, token cache, and the distinction between personal and organization accounts.

Contents

1. What Microsoft 365 MCP does
2. Personal and organization services
3. Authentication and Graph permissions
4. Presets, filtering, and dynamic discovery
5. HTTP transport, multiple accounts, and token storage
6. JSON, TOON, and output limits
7. Comparison with Google Workspace and Excel MCP
8. Educasium position

What Microsoft 365 MCP Does

Key point: Microsoft 365 MCP exposes Microsoft Graph to an AI client, with 300+ announced tools and a surface that can be controlled through flags. It is not an isolated Outlook plugin.

A Graph gateway

The README says each tool maps declaratively to an endpoint in src/endpoints.json. That gives broad coverage: email, calendar, OneDrive files, Excel, OneNote, tasks, Planner, contacts, user profile, and search in personal mode; Teams, chats, meetings, transcripts, SharePoint, shared mailboxes, and user management in organization mode.

That breadth is useful in a Microsoft company. An assistant can find email, read a OneDrive file, prepare a draft, list events, inspect tasks, or work with Excel data through Graph. But every capability must be tied to a precise Graph permission.

Node and package

The README says Node.js >=20 is recommended and Node.js 14+ may work with dependency warnings. The checked package.json declares Node engine >=18, a ms-365-mcp-server binary, and dependencies including @azure/msal-node, @modelcontextprotocol/sdk, express, helmet, express-rate-limit, winston, and zod.

That distinction matters in installation notes: for serious use, follow the README recommendation of Node >=20; the package engines field accepts >=18. Do not present Node 14 as the normal target.

Personal And Organization Services

Key point: personal mode is available by default; Teams, SharePoint, and work/school features require --org-mode. This changes both available tools and requested permissions.

Personal mode

The README lists personal tools for Outlook email, Calendar, OneDrive files, Excel, OneNote, To Do, Planner, Contacts, User Profile, and Search. This is the simplest scope for testing with a personal Microsoft account or individual use.

Even in personal mode, writes need control. Sending email, modifying files, or creating tasks is not neutral. read-only mode is a prudent first step.

Organization mode

Organization mode is enabled with --org-mode or --work-mode. It opens work/school features: Teams and chats, online meetings, transcripts, attendance reports, SharePoint Sites and Lists, shared mailboxes and calendars, user management, presence, and virtual events.

The README is explicit that organization mode must be enabled from startup to access those features. Shared mailbox access also requires delegated permissions and real Exchange permissions for the signed-in user.

Authentication And Graph Permissions

Key point: MSAL handles authentication, and permissions are computed from the enabled tools. This is the core governance model for Microsoft 365 MCP.

Available auth flows

The README documents device code flow by default, OAuth Authorization Code Flow in HTTP mode, and BYOT for providing an existing OAuth token. In HTTP mode, the server requires Bearer authentication for MCP requests and disables login/logout tools by default unless explicitly enabled.

Enterprise environments can use their own Azure Entra app via MS365_MCP_CLIENT_ID, MS365_MCP_CLIENT_SECRET, and MS365_MCP_TENANT_ID. The README also notes an important point for personal Microsoft accounts: consumers may be needed instead of common to avoid refresh-token issues.

Permissions and scopes

--list-permissions prints the permissions required for the active configuration. The README distinguishes toolPermissions, effectivePermissions, allowedScopes, disabledTools, missingAllowedScopesForTools, and extraAllowedScopesNotUsedByTools.

--allowed-scopes and MS365_MCP_ALLOWED_SCOPES narrow the surface: the server hides tools whose required scopes are not covered. An empty value fails at startup instead of falling back to a wider surface. That fail-fast behavior is important in governed deployments.

Presets, Filtering, And Dynamic Discovery

Key point: presets, --enabled-tools, --read-only, and --discovery reduce the tools visible to the model and the context size. 300+ tools without filtering is rarely the right starting point.

Presets

The README lists presets such as mail, calendar, files, personal, work, excel, contacts, tasks, onenote, search, users, outlook, onedrive, teams, teams-write, and all. outlook, onedrive, and teams are app-scoped. teams-write is an interesting case: it allows sending in Teams with reduced read capability.

These presets are useful for teaching. They show that an MCP is not simply installed or not; it is configured. A workshop can start with --preset mail --read-only, then expand to calendar or files.

Dynamic discovery

--discovery loads tools on demand instead of exposing everything initially. The README presents it as a way to reduce context and cost, especially for long sessions or interfaces where tool surface becomes heavy.

This fits Educasium's discipline: give the model a readable surface, then expand when the need is real.

HTTP Transport, Multiple Accounts, And Token Storage

Key point: the server supports stdio, OAuth HTTP, multiple accounts, and encrypted token caching; each adds security decisions.

Multiple accounts

The README explains that one instance can serve multiple Microsoft accounts. When more than one account is signed in, an account parameter is injected into tools. The server can also pin an expected account with MS365_MCP_EXPECTED_USERNAME or a homeAccountId.

This avoids running N servers for N accounts, but it requires discipline. In a client context, the user must know which account is active before any sensitive read or write.

Token storage

Tokens are stored in an AES-256-GCM encrypted cache, with the key in the operating system credential store and a file fallback. The README details default paths for Windows, macOS, and Linux, plus behavior when the cache cannot be decrypted.

That detail deserves explanation. A productivity MCP is not just a tool list; it is an authentication system that lives over time, with login, cache, account selection, logout, and error recovery.

JSON, TOON, And Output Limits

Key point: JSON is the default; TOON is experimental and targets a 30-60% token reduction according to the README. This mainly matters for uniform lists.

Output format

The server can return standard JSON or TOON, Token-Oriented Object Notation. The README positions TOON as useful for reducing token volume in uniform arrays: email lists, calendar events, files, and similar results.

For Educasium, present it as an optimization, not a requirement. JSON remains more familiar, standard, and easier to debug. TOON can be tested when volume becomes a real issue.

Pagination limits

MS365_MCP_MAX_TOP, MS365_MCP_MAX_PAGES, MS365_MCP_MAX_ITEMS, and MS365_MCP_ALLOW_PAGINATION limit response size. These are practical guardrails against overly broad retrieval.

In an organization, these limits prevent an assistant from fetching too much data by mistake. They also improve cost, latency, and readability.

Comparison With Google Workspace And Excel MCP

Key point: Microsoft 365 MCP is the right choice for Microsoft organizations; Google Workspace MCP for Google; Excel MCP for standalone .xlsx files.

Choose without ideology

The right choice is the client's real environment. A Microsoft 365 company should use Graph and existing permissions rather than copy files into a parallel workflow. A Google organization should stay in Google Workspace. A standalone Excel file does not need a Graph server if Excel MCP is enough.

Educasium Position

Key point: Educasium teaches Microsoft 365 MCP as an enterprise connector governed by Graph scopes. Productivity comes after permissioning.

What to show

A healthy workshop starts with --list-permissions and --read-only. The learner sees which permissions will be requested, enables a narrow preset, reads a few messages or files, then prepares an unsent action. Writes only come after human validation.

This method matters more than the demo. It teaches identity, permissions, and token lifecycle, which are the real subjects of Microsoft 365 MCP in production.