Skip to main content

Back to all products

M365 Files MCP

A SharePoint and OneDrive file gateway for AI assistants that respects your sensitivity labels.

In developmentCompliance you can evidence
Talk about this product

A straight answer on where it stands, with no waiting-list theatre.

Who it is built for

Companies that want to let assistants work with documents while excluding confidential content technically, not only by policy.

The problem

An assistant with file access sees, by default, everything the signed-in person may see. In a grown environment that is regularly far more than anyone assumes, and afterwards it is hard to evidence what was accessed.

Our approach

Access is filtered on the sensitivity label before content reaches the assistant. Delegated only, no application permissions, and it fails closed rather than open.

How a request is handled

Four steps run on every request, in the same order, before any content leaves Microsoft 365.

User + AI clientAny client that speaksthe Model ContextProtocol.M365 Files MCPCENTRAL POLICY ENFORCEMENT POINT01Check Microsoft 365permissions02Check sensitivitylabel03Check AI Accesscolumn04Return approvedresults onlySharePoint andOneDriveApproved and restrictedcontent stays in thesource environment.REQUESTCONTROLLEDSEARCHRestricted content is not returnedApproved results
The position numbers key to the parts list below. All three checks lead to the same outcome when they do not pass, so what the client receives never depends on which check stopped the request.

Parts list

  • 01Check Microsoft 365 permissionsEffect: The server acts as the signed-in person, never with tenant-wide rights. A file that person cannot open is not reachable through the assistant either.
  • 02Check sensitivity labelEffect: The Microsoft Purview label is read before any content is released. The list of restricted labels is managed in Purview, so a new restriction applies at the next refresh without a change to the server.
  • 03Check AI Access columnEffect: A column you control on the document library sets each file to allow, metadata only, or hidden. Metadata only can be found but not read; hidden does not appear in results at all.
  • 04Return approved results onlyEffect: Pre-authenticated download links are stripped from every response, so the only content that reaches the assistant is content that passed all three checks.

If a check cannot be completed, the request is treated as restricted

An error, a timeout, or a label the server does not recognise all return no content. Hiding a restricted file from search results is best effort and a transient error can affect it; the content itself stays restricted either way.

What it does

  • 01Read access to SharePoint and OneDrive over the Model Context Protocol
  • 02Filtering by sensitivity label, blocking when in doubt
  • 03Delegated sign-in only, no tenant-wide application permissions
  • 04Traceable access logging for audits
Technical scopeModel Context ProtocolMicrosoft GraphSharePointMicrosoft Purview

Editions and terms are not settled yet

The product is in development. Editions, scope and terms will be set together with the first users. If you want to run it, talk to us before that is fixed.

Register as an early user