Outlook MCP Server for Claude: Setup, Safety

Q: Can I use it with Teams or SharePoint?

Yes, with a work or school account and --org-mode. Use --preset teams to load only Teams tools.

On this page

Outlook MCP Server: Setup for Claude, Read-Only Mode and Safety (Nov 2026)

The most used Outlook MCP server is Softeria's open-source ms-365-mcp-server. Add it with claude mcp add ms365 -- npx -y @softeria/ms-365-mcp-server, then sign in with your Microsoft account. It covers Outlook mail, calendar and contacts. Add --preset outlook --read-only to keep it to reading. TrustedMCP grades it B.

Which Outlook MCP server should you use?

There are three real options. Pick by account type and by what you use.

Option	Who it's for	Accounts	Notes
Softeria ms-365-mcp-server	Claude Code, Claude Desktop, Cursor, any MCP client	Personal (Outlook.com) and work/school	Open source (MIT), runs on your machine. Graded B
Claude's Microsoft 365 connector	People who only use the Claude apps	Personal and work/school	Built by Anthropic. Read-only unless you turn on write tools. A work tenant needs admin consent
Microsoft Work IQ MCP (microsoft/work-iq)	Companies already on Microsoft 365 Copilot tooling	Work/school only	Microsoft's own. Public preview, and a tenant admin must consent

Older community servers such as ryaker/outlook-mcp turn up in searches too. We don't list them because they are no longer maintained.

This guide covers the Softeria server, because it is the one that works with every MCP client and with personal Outlook.com accounts. It is a community project, not a Microsoft product.

Set up the Outlook MCP server in Claude Code

You need Node.js 20 or later. Then:

Add the server. For a personal Outlook.com or Hotmail account:

claude mcp add ms365 -- npx -y @softeria/ms-365-mcp-server

For a work or school account, add --org-mode:

claude mcp add ms365 -- npx -y @softeria/ms-365-mcp-server --org-mode

On Windows, the README wraps it in cmd /c:

claude mcp add ms365 -s user -- cmd /c "npx -y @softeria/ms-365-mcp-server --org-mode"

Sign in. Ask Claude to run the login tool. It gives you a URL and a code. Open the URL, enter the code, and sign in with Microsoft. Then ask it to run verify-login. You can also sign in from a terminal first with npx @softeria/ms-365-mcp-server --login.
Try it. Ask "list my 5 most recent unread emails" or "what's on my calendar tomorrow?".

For more on claude mcp add, see Claude Code MCP setup.

Set up the Outlook MCP server in Claude Desktop

Open Settings > Developer, edit the config file and add:

{
  "mcpServers": {
    "ms365": {
      "command": "npx",
      "args": ["-y", "@softeria/ms-365-mcp-server"]
    }
  }
}

For a work or school account, add "--org-mode" to the end of args. Restart Claude Desktop, then sign in with the login tool as above.

Cursor and other clients use the same command and args in their own MCP config file.

Keep it to Outlook, and read-only

By default the server loads 300+ tools: Outlook, OneDrive, Excel, OneNote, To Do, Planner and more. It also asks Microsoft for every permission those tools need. Out of the box that includes reading, sending and deleting mail and writing to OneDrive.

Most people only want email and calendar. Add flags to the end of the command:

Flag	What it does
`--preset outlook`	Only Outlook: mail, calendar and contacts. No files, no shared mailboxes
`--preset mail`	Only mail tools
`--read-only`	Drops every tool that writes, sends or deletes
`--allowed-scopes`	Hides any tool whose Microsoft permission you didn't list
`--list-permissions`	Prints the exact permissions your flags will request, then exits

So a safe "read my Outlook" setup is:

claude mcp add ms365 -- npx -y @softeria/ms-365-mcp-server --preset outlook --read-only

The good part: the server asks Microsoft only for the permissions its enabled tools need. So these flags shrink the token too, not just the tool list. Fewer tools also means less of your context window spent on tool definitions. See how to limit MCP tools for the client-side settings that go with this.

If you do want Claude to send mail, there is an opt-in signoff (--message-signoff-prefix) that marks agent-sent messages so people can tell them apart. Keep tool approval on for send-mail either way.

Work accounts, Teams and shared mailboxes

--org-mode adds the work-only tools: Teams chats and channels, online meetings and transcripts, SharePoint, users and shared mailboxes. Shared mailboxes also need the Mail.Read.Shared (or .ReadWrite/.Send) permission and Exchange access to that mailbox.

Some companies block users from consenting to third-party apps. If sign-in says you need admin approval, that is your tenant's policy. Ask IT, or have them register their own Azure app and set MS365_MCP_CLIENT_ID (and MS365_MCP_TENANT_ID). The README covers this, plus app-only mode for servers with no signed-in user. App-only mode is powerful: Microsoft application permissions reach every mailbox in the tenant unless an admin limits them.

Is the Outlook MCP server safe? Our grade

TrustedMCP grades the ms-365-mcp-server listing B (see how we score servers):

Auth (lost points): sign-in is real Microsoft OAuth, and the token is stored encrypted with its key in your OS credential store. But the default tool set asks for read-write mail, calendar and files plus send. Read-only and presets are opt-in.
Maintenance (full marks): 79 contributors and a release on 2026-11-07 (v0.180.1).
Known CVEs (full marks): two advisories, both fixed fast. The high one (GHSA-9w34-3f56-vwmh): a .env file in the folder you started the server from could set MS365_MCP_AUTH_CACHE_COMMAND and run a program at startup. Fixed in 0.137.0 on 2026-08-07. The low one (GHSA-42wc-j69p-jppq): a path value of .. could point a tool at a different Graph endpoint. Fixed in 0.158.1. Make sure you run 0.158.1 or later.
Transport (biggest deduction): stdio, the default, is fine. But --http listens on every network interface with no built-in TLS. It does require a Microsoft bearer token, but if you host it, bind it to a private address and put an HTTPS reverse proxy in front.

The bigger risk with any email server is prompt injection: an email is text from a stranger, and the model reads it. A server that can read your inbox and send mail can be talked into forwarding things. Our advice: start with --preset outlook --read-only, add write tools only when you need them, and approve every send. For more, see MCP security best practices.

Need an MCP server for your own Microsoft 365 setup, with scoped access built in? Tell us about it.

Frequently asked questions

Is there an official Outlook MCP server?

Microsoft has Work IQ MCP, which covers mail, calendar, files and Teams for work accounts. It is in public preview and needs tenant admin consent. There is no official Microsoft server for personal Outlook.com accounts. The widely used open-source option is Softeria's ms-365-mcp-server.

Is there a Claude Outlook plugin or connector?

Claude's apps have a Microsoft 365 connector built by Anthropic. It searches Outlook, OneDrive, SharePoint and Teams, and is read-only unless you turn on write tools. In Claude Code or other MCP clients, use an MCP server such as ms-365-mcp-server instead.

How do I connect Claude to Outlook?

In the Claude apps, turn on the Microsoft 365 connector. In Claude Code or Claude Desktop, add an MCP Outlook server such as ms-365-mcp-server with claude mcp add ms365 -- npx -y @softeria/ms-365-mcp-server, then sign in with the login tool.

Does it work with a personal Outlook.com account?

Yes. Personal accounts (Outlook.com, Hotmail, Live) are the default mode. Add --org-mode only for work or school accounts.

Can the Outlook MCP server send email?

Yes, by default it can send, reply, forward and delete mail. Start it with --read-only to drop those tools, or --preset outlook to keep only mail, calendar and contacts.

Where does it store my Microsoft login?

In an encrypted file in your user config folder (for example %APPDATA%\ms-365-mcp-server\ on Windows). The encryption key goes into your OS credential store. Run the server with --logout to clear it.

Can I use it with Teams or SharePoint?

Yes, with a work or school account and --org-mode. Use --preset teams to load only Teams tools.

Is the Outlook MCP server safe to use?

TrustedMCP grades it B. It is well maintained and fixed both of its advisories quickly. The points it lost are for broad default permissions and an HTTP mode with no built-in TLS. Run it over stdio with --preset outlook --read-only and it is a sensible choice.