MCP server for CLI for Microsoft 365 that lets Claude use natural language to search command docs and run Microsoft 365 management commands for Entra ID, SharePoint, Teams, Outlook, OneDrive, Planner, Power Platform, and more.
The MCP server does not authenticate by itself; it reuses the existing CLI for Microsoft 365 authentication context., The m365RunCommand tool can run CLI for Microsoft 365 commands that manage Entra ID, OneDrive, OneNote, Outlook, Planner, Power Apps, Power Automate, Power Platform, SharePoint Embedded, SharePoint Online, Teams, Viva Engage, and other tenant surfaces., Natural-language prompts may result in a chain of CLI commands, so review the resolved command docs and exact proposed operations before execution., Commands can create teams, lists, columns, items, Planner plans, Power Platform changes, flow state changes, posts, permissions, and other tenant resources., Prefer MFA-capable interactive or browser authentication for user sessions and certificate or secret authentication only for reviewed automation scenarios., Avoid username and password authentication when possible because the upstream best-practices guide notes MFA limitations.
Privacy notes
CLI output can expose tenant IDs, user profiles, group membership, emails, calendar or Outlook data, Teams messages, SharePoint URLs, list contents, Planner tasks, flow names, app metadata, and Power Platform environment details., Microsoft 365 tokens, certificates, client secrets, tenant IDs, site URLs, user IDs, and generated command output should stay out of prompts, issues, logs, screenshots, and committed files., Tenant-management transcripts may contain regulated business data, employee data, customer data, or internal collaboration records., Configure output and error handling carefully so sensitive command output is not written into persistent chat logs or debug logs unnecessarily.
Author
Microsoft 365 and Power Platform Community
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
6 safety and 4 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes.
5 areas
SafetyGeneralThe MCP server does not authenticate by itself; it reuses the existing CLI for Microsoft 365 authentication context.
SafetyExecution & processesThe m365RunCommand tool can run CLI for Microsoft 365 commands that manage Entra ID, OneDrive, OneNote, Outlook, Planner, Power Apps, Power Automate, Power Platform, SharePoint Embedded, SharePoint Online, Teams, Viva Engage, and other tenant surfaces.
SafetyExecution & processesNatural-language prompts may result in a chain of CLI commands, so review the resolved command docs and exact proposed operations before execution.
SafetyPermissions & scopesCommands can create teams, lists, columns, items, Planner plans, Power Platform changes, flow state changes, posts, permissions, and other tenant resources.
SafetyCredentials & tokensPrefer MFA-capable interactive or browser authentication for user sessions and certificate or secret authentication only for reviewed automation scenarios.
SafetyCredentials & tokensAvoid username and password authentication when possible because the upstream best-practices guide notes MFA limitations.
PrivacyLocal filesCLI output can expose tenant IDs, user profiles, group membership, emails, calendar or Outlook data, Teams messages, SharePoint URLs, list contents, Planner tasks, flow names, app metadata, and Power Platform environment details.
PrivacyCredentials & tokensMicrosoft 365 tokens, certificates, client secrets, tenant IDs, site URLs, user IDs, and generated command output should stay out of prompts, issues, logs, screenshots, and committed files.
PrivacyExecution & processesTenant-management transcripts may contain regulated business data, employee data, customer data, or internal collaboration records.
PrivacyExecution & processesConfigure output and error handling carefully so sensitive command output is not written into persistent chat logs or debug logs unnecessarily.
Safety notes
The MCP server does not authenticate by itself; it reuses the existing CLI for Microsoft 365 authentication context.
The m365RunCommand tool can run CLI for Microsoft 365 commands that manage Entra ID, OneDrive, OneNote, Outlook, Planner, Power Apps, Power Automate, Power Platform, SharePoint Embedded, SharePoint Online, Teams, Viva Engage, and other tenant surfaces.
Natural-language prompts may result in a chain of CLI commands, so review the resolved command docs and exact proposed operations before execution.
Commands can create teams, lists, columns, items, Planner plans, Power Platform changes, flow state changes, posts, permissions, and other tenant resources.
Prefer MFA-capable interactive or browser authentication for user sessions and certificate or secret authentication only for reviewed automation scenarios.
Avoid username and password authentication when possible because the upstream best-practices guide notes MFA limitations.
Privacy notes
CLI output can expose tenant IDs, user profiles, group membership, emails, calendar or Outlook data, Teams messages, SharePoint URLs, list contents, Planner tasks, flow names, app metadata, and Power Platform environment details.
Microsoft 365 tokens, certificates, client secrets, tenant IDs, site URLs, user IDs, and generated command output should stay out of prompts, issues, logs, screenshots, and committed files.
Tenant-management transcripts may contain regulated business data, employee data, customer data, or internal collaboration records.
Configure output and error handling carefully so sensitive command output is not written into persistent chat logs or debug logs unnecessarily.
Prerequisites
Node.js 20 or newer.
CLI for Microsoft 365 installed globally.
Authenticated CLI for Microsoft 365 session created with an approved m365 login method.
CLI configuration reviewed for prompt handling, output format, and detailed error help.
Least-privilege Microsoft 365 permissions for the tenant areas Claude should manage.
Human approval policy for tenant-changing commands, especially create, update, delete, disable, permission, and message-posting operations.
CLI for Microsoft 365 MCP Server lets Claude and other MCP clients use natural
language to work through CLI for Microsoft 365. It can search command docs, get
command documentation, run m365 commands, and retrieve best-practice guidance
for authentication, error handling, output handling, and configuration.
The server does not log in by itself. It uses the same authentication context as
the globally installed CLI for Microsoft 365, so the permissions available to
Claude match the authenticated CLI session.
These sources were reviewed on 2026-06-06. Prefer the live CLI for
Microsoft 365 docs, repository README, MCP metadata, package metadata,
best-practices guide, and license for current install commands, authentication
requirements, tool behavior, and safety guidance.
Features
MCP server for CLI for Microsoft 365 from the PnP GitHub organization.
NPM package @pnp/cli-microsoft365-mcp-server.
Stdio usage through npx -y @pnp/cli-microsoft365-mcp-server@latest.
Reuses an existing CLI for Microsoft 365 login context.
m365SearchCommands for fuzzy command search.
m365GetCommandDocs for command documentation, examples, use cases, and options.
m365RunCommand for executing CLI for Microsoft 365 commands.
m365GetBestPractices for authentication, error handling, output handling, and configuration guidance.
Microsoft 365 areas including Entra ID, OneDrive, OneNote, Outlook, Planner, Power Apps, Power Automate, Power Platform, SharePoint Embedded, SharePoint Online, Teams, and Viva Engage.
Setup guidance for VS Code, GitHub Copilot CLI, Claude Desktop, and Cursor.
Installation
Install and authenticate CLI for Microsoft 365 first:
npm i -g @pnp/cli-microsoft365
m365 setup
m365 login
The README recommends configuring CLI output, prompt behavior, and help mode so
the MCP server receives useful command output and error details.
Use Cases
Search for the correct CLI command before changing Microsoft 365 resources.
Ask Claude to explain a command's options before running it.
Create SharePoint lists, columns, and items after reviewing the proposed command chain.
Create or manage Teams resources with a human-approved prompt.
Inspect or change Power Automate flow state.
Create Planner plans, buckets, and tasks.
Draft repeatable Microsoft 365 administration scripts from best-practice guidance.
Keep CLI prompt handling disabled for non-interactive MCP command execution.
Safety and Privacy
This is a tenant-management control surface. Treat it as access to the signed-in
Microsoft 365 account, not as a documentation helper. Review the exact command
and tenant target before allowing writes, and use least-privilege identities for
the task.
Natural-language prompts can become chains of CLI commands. Require explicit
approval for create, update, delete, disable, permission, membership, posting,
messaging, flow, app, and tenant-configuration operations. Keep tokens,
certificates, secrets, tenant URLs, and sensitive command output out of prompts,
issues, logs, screenshots, and committed files.
Duplicate Check
Existing Microsoft Learn content covers Microsoft documentation search, and
Dropbox Dash mentions Microsoft 365 as a connected source. No CLI for Microsoft
365 MCP Server, pnp/cli-microsoft365-mcp-server,
@pnp/cli-microsoft365-mcp-server, or tenant-management Microsoft 365 MCP entry
was found in content/mcp, content/tools, content/guides,
content/agents, or content/skills.
Show that CLI for Microsoft 365 MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/cli-microsoft365-mcp-server)
How it compares
CLI for Microsoft 365 MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
MCP server for CLI for Microsoft 365 that lets Claude use natural language to search command docs and run Microsoft 365 management commands for Entra ID, SharePoint, Teams, Outlook, OneDrive, Planner, Power Platform, and more.
Microsoft 365 Graph API MCP server for personal and organization accounts, with OAuth, read-only mode, scope allowlists, presets, multi-account support, and Streamable HTTP deployment.
Google Cloud gcloud MCP server from googleapis that lets Claude run approved gcloud CLI commands with allowlist and denylist controls for cloud resource inspection, automation, and operations.
Stdio MCP server that lets Claude ask the Google Gemini CLI for large-file, codebase, brainstorming, and sandboxed analysis while preserving MCP tool and prompt workflows inside Claude Code or compatible MCP clients.
✓The MCP server does not authenticate by itself; it reuses the existing CLI for Microsoft 365 authentication context.
The m365RunCommand tool can run CLI for Microsoft 365 commands that manage Entra ID, OneDrive, OneNote, Outlook, Planner, Power Apps, Power Automate, Power Platform, SharePoint Embedded, SharePoint Online, Teams, Viva Engage, and other tenant surfaces.
Natural-language prompts may result in a chain of CLI commands, so review the resolved command docs and exact proposed operations before execution.
Commands can create teams, lists, columns, items, Planner plans, Power Platform changes, flow state changes, posts, permissions, and other tenant resources.
Prefer MFA-capable interactive or browser authentication for user sessions and certificate or secret authentication only for reviewed automation scenarios.
Avoid username and password authentication when possible because the upstream best-practices guide notes MFA limitations.
✓Without `--read-only`, enabled Microsoft Graph tools can create, update, send, delete, or otherwise change Microsoft 365 data.
Organization mode exposes broader work-account surfaces including Teams, SharePoint, shared mailboxes, online meetings, users, presence, and search.
Use `--preset`, `--enabled-tools`, `--allowed-scopes`, and `--read-only` to keep the tool surface smaller than the default.
HTTP mode requires OAuth bearer tokens for MCP requests and should be served only from trusted hosts with reviewed redirect URI allowlists.
Local stdio mode can cache Microsoft tokens in the OS credential store or fallback files; protect cache paths and account pinning settings.
Bring-your-own-token mode and Azure Key Vault integration require careful secret handling and rotation policies.
✓gcloud MCP Server executes gcloud CLI commands with the permissions of the active gcloud account.
Allowed commands can create, update, delete, deploy, scale, list, export, or configure Google Cloud resources depending on IAM permissions and selected services.
The server blocks command substitution, pipes, redirection, SSH-style commands, interactive commands, and a default set of sensitive command prefixes, but allowed gcloud commands can still have real infrastructure, billing, IAM, and data impact.
Use allowlists for narrow workflows and service account impersonation with limited roles when possible.
Require human approval for IAM, billing, networking, firewall, storage, database, secret, deployment, delete, and production-impacting commands.
✓Gemini MCP Tool runs locally but invokes the Gemini CLI, so prompts, file references, and command output can leave the local machine through the configured Google Gemini account or API path.
The `ask-gemini` tool can pass `@` file or directory references to Gemini CLI; current source checks that references stay under the working directory, but users should still scope prompts carefully.
Sandbox mode is exposed as an option on `ask-gemini` and forwards the Gemini CLI sandbox flag; review generated scripts, network calls, package installs, and filesystem changes before relying on sandboxed output.
Change mode can generate structured edit suggestions for Claude to apply; inspect proposed OLD/NEW replacements before applying them to source files.
Treat the project as an unofficial third-party bridge, not an official Google MCP server.
Privacy notes
✓CLI output can expose tenant IDs, user profiles, group membership, emails, calendar or Outlook data, Teams messages, SharePoint URLs, list contents, Planner tasks, flow names, app metadata, and Power Platform environment details.
Microsoft 365 tokens, certificates, client secrets, tenant IDs, site URLs, user IDs, and generated command output should stay out of prompts, issues, logs, screenshots, and committed files.
Tenant-management transcripts may contain regulated business data, employee data, customer data, or internal collaboration records.
Configure output and error handling carefully so sensitive command output is not written into persistent chat logs or debug logs unnecessarily.
✓Tool calls can expose email, calendar events, contacts, OneDrive files, Excel workbook data, OneNote pages, tasks, Planner data, Teams chats, SharePoint lists, user directory data, meeting details, and search results.
OAuth tokens, client IDs, tenant IDs, client secrets, selected account metadata, token cache paths, and Key Vault URLs are sensitive configuration.
Multi-account mode can reveal account usernames, account selection state, and which account handled a request.
Audit logs intentionally avoid tool parameters and Graph response bodies, but still record request IDs, user principal names, tool names, HTTP method, status, duration, and error classifications.
Microsoft Graph data may be governed by tenant retention, legal hold, compliance, GDPR, HIPAA, PIPEDA, SOC 2, or customer confidentiality rules.
✓gcloud output can reveal project IDs, resource names, regions, IAM bindings, service accounts, logs, errors, labels, metadata, URLs, secrets references, billing context, and infrastructure topology.
Authentication state, ADC files, service account impersonation details, access tokens, project IDs, and local gcloud configuration should stay out of prompts and repository files.
Command output may be retained by the MCP client, model provider, terminal logs, shell history, and chat transcripts.
Avoid broad listing or export commands against production projects unless data handling and retention have been reviewed.
✓Prompts, selected source files, directory context, code snippets, local paths, command output, change-mode chunks, and brainstorming context may be sent to Gemini CLI and the configured Gemini service.
Avoid referencing `.env` files, credentials, private keys, customer data, unreleased product plans, or regulated datasets in `@` references.
The MCP server and Gemini CLI may log execution details locally; protect terminal history, MCP client logs, and Gemini CLI configuration files.
Google account, project, retention, and telemetry behavior depends on the user's Gemini CLI configuration and Google service terms.
Prerequisites
Node.js 20 or newer.
CLI for Microsoft 365 installed globally.
Authenticated CLI for Microsoft 365 session created with an approved m365 login method.
CLI configuration reviewed for prompt handling, output format, and detailed error help.
Node.js 20 or newer recommended for the current package.
Personal Microsoft account or Microsoft Entra work/school account with approved Graph access.
Microsoft Graph permissions reviewed with `--list-permissions` for the selected preset, tools, org mode, and allowed scopes.
Admin consent or tenant approval for organization tools such as Teams, SharePoint, shared mailboxes, users, presence, and meetings.
Node.js 20 or newer with npm or another compatible package runner.
Google Cloud CLI installed and authenticated.
Active gcloud account, project, and configuration scoped to the intended environment.
Least-privilege user or service account impersonation for the allowed cloud actions.
Node.js 16 or newer.
Google Gemini CLI installed, authenticated, and configured before starting the MCP server.
A Claude Code, Claude Desktop, or compatible MCP client configuration that can run stdio servers.
Review of any `@file` or `@directory` references before sending prompts through Gemini CLI.
Install
npx -y @pnp/cli-microsoft365-mcp-server@latest
npx -y @softeria/ms-365-mcp-server --read-only --preset outlook