Claude Can Now Send Your Email: Microsoft 365 Write Tools Explained (2026)

For the first year of its existence, the Claude Microsoft 365 connector could only look. It could read your inbox, skim your calendar, and pull files out of SharePoint — but every action still required a human to actually click send. On July 7, 2026, Anthropic changed that. The Microsoft 365 connector for Claude Enterprise now ships with write tools: Claude can draft and send email, manage calendar events, update mailbox settings, and create or edit files in OneDrive and SharePoint, all without you touching the keyboard.

That's a meaningful shift in what "connector" means for Claude. Read-only connectors turn Claude into a research assistant. Write-enabled connectors turn Claude into something closer to an employee — one that can act on your behalf inside the systems your company already runs on. If you're building agentic workflows, studying for a Claude certification, or just trying to figure out whether this is safe to turn on for your team, here's what actually changed and how to think about it.

What the New Write Tools Actually Do

The upgrade adds four categories of write capability to the existing read-only M365 connector:

Email. Claude can draft messages, send them, organize existing mail into folders, and manage drafts sitting in your outbox. This goes beyond "help me write an email" — Claude can now complete the loop and send it. Calendar. Claude can create, update, and delete calendar events. Point it at a scheduling conflict across 10 people's calendars and it can propose a time and put the invite out itself. Mailbox settings. Claude can change inbox rules, signatures, and auto-reply configurations — the kind of low-stakes but tedious admin work that piles up in a busy inbox. OneDrive and SharePoint files. Claude can create and update files directly in your organization's file storage, not just read what's already there.

Every one of these actions is scoped to the permissions of the individual Claude user — Claude can't do anything in Microsoft 365 that the signed-in employee couldn't already do themselves. It's not a service account with elevated access; it inherits exactly the access the person already has.

Why This Matters More Than It Sounds

Read-only integrations are safe by default because the worst-case failure is "Claude told me something wrong." Write-enabled integrations change the failure mode entirely: the worst case is "Claude did something wrong, and now it's done." An email that shouldn't have been sent. A calendar event created with the wrong attendees. A SharePoint file overwritten with a bad edit.

Anthropic's design leans hard into that distinction, and it's worth understanding the guardrails because they're a good template for how any agentic tool-use system should be built — this is also exactly the kind of design pattern tested on Claude's own certification track.

Off by default, opt-in twice. Write tools don't turn on because a user wants them. Enabling requires two separate deliberate actions: a Microsoft Entra administrator has to consent to the expanded permission scope at the tenant level, and a separate Claude organization administrator has to explicitly flip write tools on inside Claude's admin settings. A single compromised or overeager admin can't unilaterally grant write access — it takes two people, in two different systems, agreeing. Individual users can't self-serve it. Even after both admins approve, an individual employee can't just turn write tools on for themselves. The org has to enable it as a whole, which keeps rollout deliberate rather than accidental. Attribution headers. Emails Claude sends carry a header identifying them as sent via Claude, so recipients and IT admins can distinguish agent-sent mail from human-sent mail in logs and headers. Per-user rate limits. Writes and sends are capped per user, which limits the blast radius of a misfiring loop or a prompt-injection attempt that tries to get Claude to mass-send or mass-modify content. Attachment restrictions. Claude's outbound emails can't carry attachments — a deliberate constraint that closes off one of the more common vectors for data exfiltration or malware distribution via an automated sender.

How to Set It Up

If you're an IT admin evaluating this for your org, the rollout sequence looks like this:

Confirm your org already has the Microsoft 365 connector configured. Write tools are an upgrade to the existing connector, not a separate install — if you haven't set up the read-only version yet, do that first via the Claude Enterprise admin console.

Have a Microsoft Entra administrator review and consent to the updated permission scopes. This is a standard Entra app consent flow — the new scopes cover Mail.Send, calendar write, and file write permissions on top of the existing read scopes.

Have a Claude organization admin enable write tools in the connector settings inside the Claude Enterprise console. This is a distinct toggle from the Entra consent — both are required.

Pilot with a small group before org-wide rollout. Anthropic's own guidance recommends testing write tools with a limited set of users first, since the failure modes (a wrongly-addressed email, a double-booked calendar) are more visible than read-only mistakes.

Review the audit trail. Every write action is logged, and admins should treat the first few weeks as an audit period — checking what Claude actually sent and changed against what was intended.

For individual users, once your org has enabled write tools, there's nothing to configure — the M365 connector in your Claude.ai or Claude Cowork settings simply gains the new capabilities automatically.

Practical Use Cases Now Possible

With read-only access, Claude could tell you what needed to happen. With write access, it can make it happen. A few concrete examples of what shifts:

Meeting logistics. Instead of "here are three times that work for everyone," Claude can check all attendees' calendars, pick the best slot, create the event, and send the invite — completing a task that used to take five back-and-forth messages in under a minute. Inbox triage at scale. Claude can read a backlog of email, draft replies for the routine ones, file newsletters and receipts into the right folders, and flag anything that needs a human decision — closer to how a skilled executive assistant works than a chatbot. Document assembly. Ask Claude to pull data from three SharePoint spreadsheets, build a summary report, and save it back to the shared drive where the team already looks for it — without exporting anything to a local machine first. Auto-reply management during PTO or travel. Claude can set and clear out-of-office auto-replies and mailbox rules on request, rather than you remembering to do it yourself before a flight. Follow-up automation. After a call or meeting, Claude can draft and send the recap email to attendees, log the action items, and update a shared calendar — the last-mile work that usually falls through the cracks.

None of these are new ideas — automation tools like Power Automate or Zapier could technically chain some of this together before. What's different is that Claude does it from a natural-language instruction, with judgment about edge cases, instead of a rigid if-this-then-that flow you have to pre-build.

Frequently Asked Questions

Does this work on Claude Free or Pro?

No. Write tools are currently scoped to Claude Enterprise organizations with the Microsoft 365 connector configured. Individual Free, Pro, or Max users connecting their personal Microsoft account do not get write access as part of this update.

Can Claude send an email without me reviewing it first?

Yes, once write tools are enabled for your organization, Claude can send email directly as part of completing a task — it doesn't require a manual approval click for every message, though admins can pair this with their own review workflows if they want a human-in-the-loop step for sensitive communications.

What stops Claude from doing something a rogue actor tricks it into via a malicious email or document (prompt injection)?

The rate limits, attribution headers, and attachment restrictions all reduce the damage a successful injection attack could do — a compromised instruction can't mass-send attachments or blow past the per-user send cap. Anthropic's security guide recommends admins treat any inbound content Claude reads (email bodies, shared documents) as untrusted input, the same way you'd treat user-submitted text on a website.

Does write access apply retroactively to files Claude has already read?

No — write tools only govern new actions taken after the feature is enabled. There's no bulk retroactive modification of previously read content.

How is this different from Claude Cowork's existing automation features?

Claude Cowork uses the same underlying M365 connector, so once your org enables write tools, Cowork sessions on web, mobile, and desktop all inherit the new send/write capability — it's a connector-level change, not a separate feature per surface.

Where This Fits in the Bigger Agentic Picture

This launch isn't isolated. It's the latest step in a pattern Anthropic has been running all year: ship a connector read-only first, let enterprises get comfortable with it, then add write access once trust and guardrails are proven out. The same pattern played out with Claude's Google Workspace connector and with vertical launches like Claude for Legal, where MCP-based tool access started narrow and expanded as adoption grew.

It also reflects a broader industry shift worth tracking if you're building on top of Claude: the distinction between an AI that can tell you what to do and one that can do it is where most of the real engineering and safety work lives. Rate limits, attribution, dual-admin consent, and attachment restrictions aren't afterthoughts — they're the actual product. Anyone building an MCP server or agent workflow that touches production systems should study this launch as a reference implementation, not just a feature announcement.

For developers specifically, the pattern is reusable: if you're building your own MCP connector with write access to a sensitive system, Anthropic's own rollout here (scoped-to-user permissions, dual consent, rate limits, header attribution, restricted attachments) is close to a checklist for what "safe by design" looks like in production agentic tooling.

Key Takeaways

• Anthropic upgraded the Claude Microsoft 365 connector from read-only to read/write on July 7, 2026, for Claude Enterprise organizations.
• Write tools let Claude send email, manage calendar events, update mailbox settings, and create/update OneDrive and SharePoint files — always within the acting user's existing Microsoft 365 permissions.
• Enabling write tools requires two separate approvals: a Microsoft Entra admin consent and a Claude organization admin toggle. Individual users cannot self-enable it.
• Built-in safeguards include email attribution headers, per-user rate limits, and a ban on outbound attachments.
• The rollout is a useful reference pattern for anyone designing agentic tools with write access to production systems — a topic directly relevant to Claude's own certification track.

Next Steps

Understanding how Anthropic scopes permissions, rate-limits actions, and requires dual consent for agentic write access isn't just useful for IT admins — it's exactly the kind of tool-design judgment the Claude Certified Architect (CCA-F) exam tests, particularly around agent safety, permission scoping, and production deployment patterns.

→ Practice CCA-style questions on agent design and connector security for free at AI for Anything — build the judgment you'll need both on the exam and when you're the one deciding whether to flip that write-tools toggle for your org.

---

Sources:

• Claude Help Center: Microsoft 365 connector security guide
• Claude Help Center: Set up the Microsoft 365 connector
• Claude by Anthropic: Microsoft 365 Connector
• THE DAILY BRIEF: Claude Can Now Send Your Email. Should It?