Reported issues for Microsoft 365 MCP Server

Pod holds 24 of 165 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Microsoft 365 MCP Server.

Most discussed

Authentication not working

Not sure if I'm doing this incorrectly but it seems like agent called authentication has stopped working.

Yesterday I've was able to just tell Claude to initiate the login and i get the code an link directly in the chat, however today it seems like the server doesn't return the code and link on login initiation.

<img width="769" height="660" alt="Image" src="htt

Read the thread · 2026-03-26 · closed · external user · 9 comments

PDF attachments retrieval issue

Hello.. this is a great product, but i seem to have an issue with the PDF attachments :( When they are fecthced and converted to base64, they are returned truncated (or at least this is what Claude pretends it is happening when it tries to retrieve them )

BINGO! YOU FOUND IT! 🎯🎯🎯
The Smoking Gun:

n8n workflow base64: 46,968 characters (COMPLETE)
MS365 MCP gave us: 4,561 characters (TRUNCATED!)

The MS365 MCP server is only giving us approximately 10% of the actual PDF data!
The base64 stri

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/168) · 2025-11-28 · closed · external user · 10 comments

### Startup Error: File not defined

Hey 👋

I'm currently setting up an environment for the ms-365-mcp-server and struggle with a repeating issue.
My plan is to integrate the mcp server with [OpenWebUI](https://github.com/open-webui/open-webui) trough a [mcpo-server](https://github.com/open-webui/mcpo).
As i looked at the docs i thought that this is not a quite complex task due to the resemblance of mcpo and Claude.

Continuing the error...

I created a custom Dockerfile (down below as code snippet) where i could add mcpo and the m

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/119) · 2025-08-25 · closed · external user · 8 comments

### Every time I login with its code, it tells me the code has expired!

<img width="641" height="498" alt="Image" src="https://github.com/user-attachments/assets/fd0d8f47-b0df-402a-9e72-91207742ef68" />

Why does this happen.
It makes me so crazy!

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/84) · 2025-07-21 · closed · external user · 14 comments

### Email filtering functionality broken in MCP server

# Email filtering functionality broken in MCP server

## Environment
- **Client**: Claude Desktop

## Problem Description
The MCP server fails to properly filter emails when using the `list-mail-messages` tool. Multiple filtering approaches result in various errors, making it impossible to retrieve emails from specific senders.

## Steps to Reproduce
1. Connect Claude Desktop to the MCP server
2. Request: "Find last 5 e-mails from karel.hnizdil@softim.cz"
3. Observe the MCP server attempting var

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/75) · 2025-07-08 · closed · external user · 12 comments

### Oauth Authorization Code Flow support

Hi,

The MCP standard asks of MCP Servers to implement certain standardized Oauth flows:
https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#authorization-flow

Can you perhaps implement Oauth discovery and authorization code flow support?

If this is not possible, I would like a way to just POST to the endpoint with a bearer token that I received with an oauth authorization flow outside of the MCP Server. The MCP Server can then just forward this bearer token to the Gra

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/37) · 2025-06-18 · closed · external user · 15 comments

### Incompatibility with Pydantic 3.0

Hello,
after resolving your issue here https://github.com/Softeria/ms-365-mcp-server/issues/25 a new error appeared

`/usr/local/lib/python3.12/dist-packages/pydantic/fields.py:1089: PydanticDeprecatedSince20: Using extra keyword arguments on `Field` is deprecated and will be removed. Use `json_schema_extra` instead. (Extra keys: 'items', 'anyOf', 'enum', 'properties'). Deprecated in Pydantic V2.0 to be removed in V3.0. See Pydantic V2 Migration Guide at https://errors.pydantic.dev/2.11/migratio

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/28) · 2025-06-12 · closed · external user · 15 comments

### Does not work inside of Claude Desktop 0.9.3 using Claude 3.7 sonnet or 4 sonnet on MacOS

Installs fine, gives me a list of m365 actions in the tools menu, but won't login or really won't give any detailed response to any question when this MCP server is enabled - gives the error:

"Your message will exceed the limit for this chat. Try shortening your message or starting a new conversation"

Logs into m365 just fine when running via npx on the the command line (per the git instructions).

Using this claude desktop mcp json:

{
  "mcpServers": {
    "ms365": {
      "command": "npx",

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/17) · 2025-05-22 · closed · external user · 9 comments

## Most recent

### Feature request: createReply and createReplyAll draft tools for shared mailboxes (/users/{user-id} scoped)

## Summary

The package currently provides `create-reply-draft` and `create-reply-all-draft` tools, which map to:

- `POST /me/messages/{message-id}/createReply`
- `POST /me/messages/{message-id}/createReplyAll`

These work correctly for the signed-in user's primary mailbox. However, there is no equivalent for shared mailboxes. When a client needs to create a threading-aware reply *draft* in a shared mailbox (delegated access), the only options available are:

| Tool | Endpoint | Limitation |
|-

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/652) · 2026-08-28 · closed · outside contributor · 2 comments

### Static audit of ms-365-mcp-server: no exploitable findings, two scanner bugs fixed

Hi — this is not a vulnerability report, so I'm opening it in the open
rather than privately.

I wrote an open-source static scanner for MCP servers
([mcpaudit](https://github.com/allenwu-blip/mcpaudit)), ran it against this repo,
then read the source behind every hit. Full write-up below.

Happy to be told I got any of it wrong.

---

**Conclusion:** I found **no exploitable vulnerabilities** in the current codebase. This audit covers 14 specific syntactic patterns (regex-based static analysis)

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/651) · 2026-08-28 · closed · external user · 2 comments

### MCP spec conformance: 6 requirement(s) violated (via @hasmcp/mcp-spec-test) — spec 2026-07-28

When `@softeria/ms-365-mcp-server` is tested against the newest MCP spec revision (2026-07-28) with `@hasmcp/mcp-spec-test`, the server responds to `server/discover` with a JSON-RPC `-32601 Method not found` error, which cascades into 22 further checks being unverifiable. Notably, the same server tests fully clean (0 failures) against the older 2025-11-25 revision it also advertises support for in its handshake — so this looks like `server/discover` (a method introduced by the 2026-07-28 revisio

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/649) · 2026-08-24 · closed · external user · 1 comment

### Device code login does not persist the new refresh token — cache keeps replaying the original token until AADSTS700082

After a successful device code login, the token cache file **is written**, but the newly issued
refresh token is not stored. The cache keeps the refresh token from the *original* login
indefinitely. Every subsequent silent acquisition replays that stale token.

The practical effect: re-authenticating restores access for exactly one access token lifetime
(~82 minutes in our tenant), after which the same failure returns. Once the original refresh token
crosses Entra's 90-day inactivity limit, the 

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/648) · 2026-08-24 · closed · external user · 1 comment

### add-mail-attachment: documented 3MB ceiling is ~2 orders of magnitude off for LLM callers (inline base64 truncates client-side, not at Graph)

## Summary

`add-mail-attachment`'s tip says **"Max 3MB"**, which is Graph's limit and is correct for the API. But when the caller is an LLM, the real ceiling is roughly **two orders of magnitude lower**, because the model has to emit the entire base64 string as a tool argument. Past a few KB the argument gets truncated in the client, Graph receives malformed JSON, and the call fails with `400 UnableToDeserializePostBody`.

The result is that a 35 KB attachment fails while the tool documentation

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/639) · 2026-08-17 · closed · external user · 1 comment

### create-calendar-event causes JSON Schema $ref resolution error in Open Cowork and crashes MCP Inspector UI

## Summary

I found a reproducible issue with the create-calendar-event tool in @softeria/ms-365-mcp-server.

The server works correctly for authentication, read operations, OneDrive operations, and at least one write operation (create-draft-email).

However, create-calendar-event appears to trigger schema/rendering failures across multiple MCP clients.

## Environment

Package:
@softeria/ms-365-mcp-server

Version:
0.143.0

Clients tested:
- Open Cowork
- MCP Inspector (@modelcontextprotocol/in

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/638) · 2026-08-13 · closed · external user · 1 comment

### Feature request: configurable message signoff for Teams sends (default 🤖) — mark agent-sent messages

## Context

Every Teams message sent through this server is AI-mediated by construction — an agent composed it, even when a human asked for it. Recipients currently have no way to tell such messages apart from ones the account owner typed themselves.

I currently enforce a marker client-side (a Claude Code PreToolUse hook that rewrites the `send-chat-message` input to append 🤖), but that protection lives in one client's config. The server is the right chokepoint: it sees every outgoing message r

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/632) · 2026-08-11 · closed · outside contributor · 1 comment

### Feature request: teams-write preset — send-only counterpart to --read-only

## Context

`--read-only` exists for the "let the agent look but not touch" deployment. The mirror-image deployment — **"let the agent send but not read"** — currently requires hand-rolling a long `--enabled-tools` regex.

That write-only shape is a natural fit for org deployments of AI agents on Teams: the agent can notify people and post updates, but a compromised or misbehaving agent (or prompt injection riding on tool output) cannot exfiltrate conversation history, because the enabled tool s

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/631) · 2026-08-11 · closed · outside contributor · 2 comments

### list-chats/get-chat should offer Chat.ReadBasic as a least-privilege scope alternative (OR-group support already exists, unused)

## Context

I'm building a **write-only Teams deployment**: a custom Azure app whose delegated grants deliberately exclude anything that can read message content, paired with `--enabled-tools` + `--allowed-scopes`. Sending works with just `ChatMessage.Send`, but *finding conversations* is currently impossible in this setup:

- `list-chats` / `get-chat` declare `workScopes: ["Chat.Read"]` in `src/endpoints.json`, so `--allowed-scopes` without `Chat.Read` disables them.
- Microsoft Graph's documen

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/630) · 2026-08-11 · closed · outside contributor · 1 comment

### Feature request: move-shared-mailbox-message and update-shared-mailbox-message tools

## Summary

The package already ships a good set of shared-mailbox mail tools (`list-shared-mailbox-messages`, `get-shared-mailbox-message`, `create-shared-mailbox-draft`, etc.), all generated from `src/endpoints.json` against `/users/{user-id}/...` paths with `Mail.ReadWrite.Shared` / `Mail.Read.Shared` workScopes.

Two operations are missing from that set: **move** and **update (PATCH)** a shared-mailbox message. The `/me`-scoped equivalents exist (`move-mail-message`, `update-mail-message`), 

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/621) · 2026-08-06 · closed · outside contributor · 1 comment

### execute-tool: misplaced request body (nested itemBody passed as `body`) is only auto-repaired when stray top-level fields happen to be present

**_Written in colab with Claude_**

## Summary

When an LLM calls `send-chat-message` (via `--discovery` -> `execute-tool`) with the message
itemBody as the `body` parameter - instead of the full chatMessage request body - the call
reaches Graph unwrapped and fails with `400 Missing body content`.

The interesting part: **the server already contains the exact repair logic for this**
(`bodyIsNestedField` in `src/graph-tools.ts`), but it is only reachable inside the
stray-field merge branch, so it

[Read the thread](https://github.com/Softeria/ms-365-mcp-server/issues/620) · 2026-08-06 · closed · external user · 1 comment

### list-mail-messages tool description is copy-pasted from a different Graph resource (open extensions)

## Problem

The `list-mail-messages` tool's base description does not describe the tool. It is Graph API documentation for a different endpoint (open extensions), not mail messages.

## Evidence

Captured via `mcp-scanner` against a live `npx -y @softeria/ms-365-mcp-server` instance (npm registry currently resolves `npx -y` to 0.136.0):

tool_name: list-mail-messages tool_description: Get an open extension (openTypeExtension object) identified by name or fully qualified name. The table in th

Read the thread · 2026-08-03 · closed · external user · 2 comments

get-sharepoint-site-by-path always fails: 400 "Error in query syntax" (wrong route form + unencoded-path regression)

get-sharepoint-site-by-path returns 400 Bad Request - Error in query syntax for every parameter shape, so the tool can never succeed.

Version: 0.134.4, HTTP mode, --org-mode --read-only --preset excel,outlook,files,search,work.

Repro

All three calls fail identically (distinct Graph request-ids, so each really hit Graph):

Read the thread · 2026-07-28 · closed · outside contributor · 1 comment

Windows: token-cache keytar write always fails, falling back to a file inside the installed package directory

Summary

On Windows the token-cache entry can never be written to Credential Manager, because the payload is far larger than a Windows credential blob allows. The storage provider logs itself as default (keytar+file), but for token-cache it is effectively file-only. Every token refresh emits a warning. The smaller selected-account entry does fit and does persist in Credential Manager, so the two keys end up in different stores.

Observed behavior

INFO: Auth cache storage provider: defaul

Read the thread · 2026-07-26 · closed · external user · 3 comments

Access token written to log unredacted in graph-client.js while the sibling call site redacts it

Summary

Every Graph request logs the full bearer token to the on-disk log file at default log level. dist/graph-client.js serializes the entire options object, which contains accessToken. The other call site that logs the same request, in dist/graph-tools.js, strips the token first. The redacting version appears to be the intended behavior.

Affected code (v0.134.0)

graph-client.js, in graphRequest:

logger.info(Calling ${endpoint} with options: ${JSON.stringify(options)});

graph-tools.j

Read the thread · 2026-07-26 · closed · external user · 2 comments

Private vulnerability reporting is unavailable

SECURITY.md directs vulnerability reporters to GitHub Private Vulnerability Reporting, but the repository currently does not have PVR enabled. GitHub returns:

Repository does not have private vulnerability reporting enabled

Could a maintainer enable PVR or provide a private security contact? I have a tested vulnerability report and patch ready, but will not post the details publicly.

Read the thread · 2026-07-22 · closed · external user · 1 comment

The remaining reports are on the project's issue tracker.