What this allows you to do
Once set up, users in your organisation can connect Toqan to Microsoft 365 services. Common use cases:
- Search and read Outlook emails
- Create drafts, send emails, reply and reply all to messages
Calendar
- List, view, create, update, and delete calendar events
- Accept or decline meeting invitations
- Find free time across attendees
Teams
- Create chats, post and edit messages, manage members
- List teams and channels, create channels, post and reply to channel messages
User directory
- Look up user profiles, managers, and direct reports
- List users in the organisation
SharePoint
- Browse sites, document libraries, folders, and files
- Read, create, move, copy, rename, delete files and folders
- Manage SharePoint lists, items, and columns
Word
- Create new Word documents in OneDrive
- Read document content and comments
- Add comments and reply to comments
Overview
The Microsoft 365 MCP is powered by Microsoft’s official Work IQ MCP servers — currently in Preview. The servers are hosted by Microsoft, so no self-hosting is required. Seven servers are available:
| Server | Server ID | Description |
|---|---|---|
mcp_MailTools | Read, send, reply, and manage Outlook email | |
| Calendar | mcp_CalendarTools | Calendar events, meetings, scheduling, availability |
| Teams | mcp_TeamsServer | Teams chats, channels, messages, membership |
| User | mcp_MeServer | User profiles, managers, direct reports, org directory |
| SharePoint | mcp_SharePointRemoteServer | Sites, lists, document libraries, files, folders |
| Word | mcp_WordServer | Word documents: create, read content, comments |
| Windows 365 Computer Use | mcp_W365ComputerUse | Cloud PC automation: mouse, keyboard, browser, shell, screenshots |
All servers share the same URL pattern: https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/{serverName}
All are built on the Microsoft Graph API and secured via OAuth2 (Authorization Code flow, delegated — acts on behalf of the signed-in user).
⚠️
These servers are in Preview — APIs and behavior may change without notice.
What you will need
- A Microsoft 365 Copilot license per user (hard requirement — not included in standard E3/E5 plans)
- Access to the Azure portal to register an Entra app
- A Microsoft Global Admin account to grant admin consent
- Your Microsoft 365 Tenant ID (found in Microsoft Entra ID → Overview)
ℹ️
If your organisation doesn't have Microsoft 365 Copilot licences, see the FAQ at the bottom for an alternative.
Part 1: Register a Microsoft Entra app
Step 1: Find your Tenant ID
- Go to the Azure portal.
- Navigate to Microsoft Entra ID → Overview.
- Copy the Tenant ID (a GUID). You’ll need it throughout this guide.
Step 2: Register a new app
- In the Azure portal, go to Microsoft Entra ID → App registrations → New registration.
- Name the app — e.g.
Toqan MCP Client. - Set Account type to Single tenant (your organisation only).
- Add a Redirect URI:
https://work.toqan.ai/callback/oauth. - Click Register.
- Note down the Application (Client) ID — you’ll need it in Part 2.
Step 3: Add API permissions and grant admin consent
In the registered app → API permissions → Add a permission. Add the permissions for the servers you want to use:
Mail (mcp_MailTools):
- Microsoft Graph (Delegated):
Mail.Read,Mail.ReadWrite,Mail.Send - Work IQ API:
WorkIQ-MailServer
Calendar (mcp_CalendarTools):
- Microsoft Graph (Delegated):
Calendars.Read,Calendars.ReadWrite - Work IQ API:
WorkIQ-Calendar
Teams (mcp_TeamsServer):
- Microsoft Graph (Delegated):
Chat.Read,Chat.ReadWrite,ChannelMessage.Send,ChannelMessage.Read.All,Group.Read.All,Group.ReadWrite.All - Work IQ API:
McpServers.Teams.All
User (mcp_MeServer):
- Microsoft Graph (Delegated):
User.Read,User.ReadBasic.All(orUser.Read.All),Directory.Read.All
SharePoint (mcp_SharePointRemoteServer):
- Microsoft Graph (Delegated):
Sites.Read.All,Sites.ReadWrite.All,Files.Read.All,Files.ReadWrite.All,Sites.Manage.All
Word (mcp_WordServer):
- Microsoft Graph (Delegated):
Files.ReadWrite(orFiles.ReadWrite.All),Sites.Read.All - Standard scopes:
openid,profile,offline_access,User.Read
Then click Grant admin consent. Once granted, the permissions column will show a green check.
⚠️
Granting admin consent requires a Microsoft Global Admin account.
Part 2: Create a company-wide OAuth connector in Toqan
Step 1: Open OAuth Connectors
In Toqan, go to the Connections tab. Click OAuth Connectors, then click + New and select Build from scratch.
Step 2: Configure the connector
Fill in the connector details form:
- Name — e.g.
Microsoft 365(or separate connectors per service, e.g.Microsoft 365 Mail,Microsoft 365 Calendar) - Access — set to Public: Company-wide
- Authorization Endpoint —
https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize(replace{tenantId}) - Token Endpoint —
https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token(replace{tenantId}) - Redirect URI — pre-filled as
https://work.toqan.ai/callback/oauth. Make sure this matches the redirect URI from Part 1, Step 2. - Client ID — your Application (Client) ID from Part 1, Step 2
- Client Secret — your client secret from the Entra app
- Selected Scopes — the scopes for the servers you want to use (see Part 1, Step 3). For example, for Mail + Calendar:
Mail.Read, Mail.ReadWrite, Mail.Send, Calendars.Read, Calendars.ReadWrite
Everything else on the form can be left blank.
Step 3: Save
Save the connector. It will now appear as an available auth option for anyone in the organisation when they add a Microsoft 365 MCP server.
What to share with your users
Once Parts 1 and 2 are done, share the following with your users so they can connect on their own.
The MCP server URLs (with your Tenant ID already filled in):
- Mail:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_MailTools - Calendar:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_CalendarTools - Teams:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_TeamsServer - User:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_MeServer - SharePoint:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_SharePointRemoteServer - Word:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_WordServer - Windows 365 Computer Use:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_W365ComputerUse
The connector name you created in Part 2 (e.g. Microsoft 365).
What they need to do:
- Go to Connections → MCP Servers → Add, paste the URL, and select Streamable HTTP.
- For authentication, select OAuth, pick the connector you shared from the dropdown, and click Confirm.
- Click Authorise, sign in with their Microsoft 365 account, and allow the permissions.
Each user gets their own token — they only need to do this once per server.
Reference: what’s available
Outlook Mail tools (mcp_MailTools)
| Tool | Description |
|---|---|
graph_mail_searchMessages | Search messages (KQL-style queries) |
graph_mail_listSent | List sent items |
graph_mail_getMessage | Get a message by ID |
graph_mail_createMessage | Create a draft |
graph_mail_sendMail | Send an email (to/cc/bcc, HTML body) |
graph_mail_sendDraft | Send an existing draft |
graph_mail_reply | Reply to a message |
graph_mail_replyAll | Reply all to a message |
graph_mail_updateMessage | Update subject, body, or categories |
graph_mail_deleteMessage | Delete a message |
Calendar tools (mcp_CalendarTools)
| Tool | Description |
|---|---|
graph_listEvents | List calendar events |
graph_listCalendarView | View events in a date range |
graph_getEvent | Get a specific event by ID |
graph_createEvent | Create a new event |
graph_updateEvent | Update an existing event |
graph_deleteEvent | Delete an event |
graph_acceptEvent | Accept a meeting invite |
graph_declineEvent | Decline a meeting invite |
graph_cancelEvent | Cancel a meeting |
graph_findMeetingTimes | Find free slots across attendees |
graph_getSchedule | Check availability and schedule |
Teams tools (mcp_TeamsServer)
| Tool | Description |
|---|---|
mcp_graph_chat_createChat | Create a new Teams chat (oneOnOne or group) |
mcp_graph_chat_getChat | Retrieve chat metadata by ID |
mcp_graph_chat_listChats | List chats visible to the caller |
mcp_graph_chat_postMessage | Post a plain-text message to a chat |
mcp_graph_chat_getChatMessage | Retrieve a chat message by ID |
mcp_graph_chat_listChatMessages | List messages in a chat (paging/OData) |
mcp_graph_chat_updateChat | Update chat properties (e.g., topic) |
mcp_graph_chat_updateChatMessage | Edit a chat message (plain text) |
mcp_graph_chat_deleteChat | Soft-delete a chat |
mcp_graph_chat_deleteChatMessage | Soft-delete a chat message |
mcp_graph_chat_addChatMember | Add a member to a chat (member/owner roles) |
mcp_graph_chat_listChatMembers | List participants of a chat |
mcp_graph_teams_listTeams | List teams a user has joined |
mcp_graph_teams_getTeam | Retrieve team properties |
mcp_graph_teams_listChannels | List channels in a team |
mcp_graph_teams_getChannel | Retrieve channel metadata |
mcp_graph_teams_createChannel | Create a channel in a team (standard/private/shared) |
mcp_graph_teams_createPrivateChannel | Create a private channel (must include members/owner) |
mcp_graph_teams_updateChannel | Update channel displayName/description |
mcp_graph_teams_listChannelMessages | List messages in a channel |
mcp_graph_teams_postChannelMessage | Post a plain-text message to a channel |
mcp_graph_teams_replyToChannelMessage | Reply to a channel message (plain text) |
mcp_graph_teams_addChannelMember | Add a member to a private/shared channel |
mcp_graph_teams_listChannelMembers | List members of a channel |
mcp_graph_teams_updateChannelMember | Update a channel member’s role |
User tools (mcp_MeServer)
| Tool | Description |
|---|---|
mcp_graph_getMyProfile | Get the signed-in user’s profile |
mcp_graph_getUserProfile | Get another user’s profile |
mcp_graph_getMyManager | Get the signed-in user’s manager |
mcp_graph_getUsersManager | Get another user’s manager |
mcp_graph_getDirectReports | Get the signed-in user’s direct reports |
mcp_graph_listUsers | List users in the organisation |
SharePoint tools (mcp_SharePointRemoteServer)
| Tool | Description |
|---|---|
findSite | Find SharePoint sites the user can access |
getSiteByPath | Resolve a site by hostname and server-relative path |
listSubsites | List child/subsites of a site |
listDocumentLibrariesInSite | List document libraries in a site |
getDefaultDocumentLibraryInSite | Get the default document library for a site |
getFolderChildren | Enumerate files/folders in a parent folder (top 20) |
findFileOrFolder | Search for a file or folder across sites and libraries |
getFileOrFolderMetadata | Get metadata for a file or folder by ID |
getFileOrFolderMetadataByUrl | Get metadata from a sharing URL |
readSmallTextFile | Read/download a text file (≤5 MB) |
readSmallBinaryFile | Read/download a binary file (≤5 MB, base64) |
createSmallTextFile | Create/upload a text file (≤5 MB) |
createSmallBinaryFile | Create/upload a binary file (≤5 MB, base64) |
createFolder | Create a folder in a document library |
renameFileOrFolder | Rename a file or folder |
deleteFileOrFolder | Delete a file or folder |
moveFileOrFolder | Move a file or folder (async, cross-library) |
copyFileOrFolder | Copy a file or folder (async, cross-library) |
checkOperationStatus | Check status of an async copy/move operation |
uploadFileFromUrl | Upload a file from a SharePoint/OneDrive URL |
shareFileOrFolder | Send a sharing invitation (read or write) |
setSensitivityLabelOnFile | Set or remove a sensitivity label on a file |
listLists | Get all SharePoint lists on a site |
createList | Create a new SharePoint list |
deleteList | Delete a SharePoint list |
sendInviteForList | Send sharing invitations for a list |
listListItems | Get items (rows) from a list |
getListItem | Get a single list item by ID |
createListItem | Create a new list item with field values |
updateListItem | Update fields on an existing list item |
deleteListItem | Delete a list item |
listColumns | Get all columns for a list |
createColumn | Create a column in a list |
updateColumn | Update an existing column’s properties |
deleteColumn | Delete a column (removes all data in that column) |
Word tools (mcp_WordServer)
| Tool | Description |
|---|---|
WordCreateNewDocument | Create a new Word document in OneDrive (HTML/plain-text content) |
WordGetDocumentContent | Fetch a DOCX from OneDrive/SharePoint; returns text + comments |
WordCreateNewComment | Add a comment to a Word document |
WordReplyToComment | Reply to an existing comment in a Word document |
Windows 365 Computer Use (mcp_W365ComputerUse)
A specialised server for Cloud PC automation with 50+ tools covering:
- Session management: start/end/get session details
- Mouse & keyboard: move, click, drag, scroll, type, press keys
- Screen capture: screenshots, zoom, OCR analysis
- Window management: list, activate, close, resize windows
- Browser automation: navigate, click, type, get text/HTML, eval JS, form filling, tab management
- System: shell commands, Python execution, clipboard, process management
- UI automation: accessibility tree, find UI elements
Note: The exact permissions/scopes for Windows 365 Computer Use are not yet documented in the public preview. Consult your tenant admin or the Windows 365 for Agents documentation.
General Work IQ MCP Server
In addition to the workload-specific servers above, there is a general Work IQ MCP server that provides 10 core tools for interacting with any Microsoft Graph resource:
| Category | Tool | Description |
|---|---|---|
| Entity | fetch | Read entities by Graph resource path |
| Entity | create_entity | Create a new entity (POST to collection) |
| Entity | update_entity | Update an existing entity (PATCH) |
| Entity | delete_entity | Delete an entity (DELETE) |
| Entity | do_action | Invoke side-effect actions (e.g., send mail, copy/move) |
| Entity | call_function | Call Graph functions (calendarView, delta, search) |
| Copilot | ask | Ask Microsoft 365 Copilot a natural-language question |
| Copilot | list_agents | List available agents |
| Schema | get_schema | Retrieve OpenAPI schema for a Graph operation |
| Schema | search_paths | Search available API paths by prefix or regex |
This server is useful for Graph operations not covered by the specialised servers above.
FAQ
Q: What if my organisation doesn’t have a Microsoft 365 Copilot licence?
The official Work IQ MCP servers require a Copilot licence per user. If your org doesn’t have one, a community-maintained alternative exists: stefanskiasan/outlook-mcp on GitHub. It covers 75+ tools for mail, calendar, Teams, and Tasks using the same Microsoft Graph API with a standard Entra app registration — no special licence required. It requires self-hosting the MCP server.
Q: Can users add just one server without the others?
Yes. Each server is added independently. Share only the URL relevant to their use case.
Q: How long do policy changes take to propagate?
Work IQ implements a Rego-based policy layer for tenant-level control over MCP tool requests. Policy changes can take up to 24 hours to propagate.
References
- Microsoft Agent 365 Tooling Servers Overview
- Use Work IQ
- MCP Mail Work IQ
- MCP Calendar Work IQ
- MCP Teams Work IQ
- MCP User Work IQ
- MCP SharePoint Work IQ
- MCP Word Work IQ
- MCP Windows 365 Agents Work IQ
- Work IQ MCP Overview
- Work IQ MCP Tool Reference
- Work IQ MCP Policy Governance
- stefanskiasan/outlook-mcp on GitHub