# How to Fix Claude OneDrive Permissions and Access Blocked Errors

Claude OneDrive permissions are OAuth 2.0 delegated authorizations granted through Microsoft Entra ID allowing Anthropic models to read, parse, and cite documents in Microsoft 365 OneDrive repositories. Connecting storage often triggers Access Blocked errors due to tenant admin consent rules. Resolving these errors requires granting delegated Microsoft Graph read scopes in Microsoft Entra admin center or routing OneDrive folders into an indexed Fast.io workspace using Model Context Protocol.

Source: https://fast.io/resources/claude-onedrive-permissions/
Author: [Tom Langridge](https://fast.io/authors/tom-langridge/)
Last reviewed: 2026-10-13

## Why Claude OneDrive Permissions Trigger Admin Approval Errors

When a team member attempts to link Claude to Microsoft OneDrive, the authorization sequence does not fail inside Anthropic's interface. Instead, it halts abruptly at Microsoft Entra ID's consent screen with the message "Access blocked: Need admin approval". This error occurs because standard enterprise tenant policies block non-administrative users from granting third-party OAuth applications access to organizational repositories.

Claude OneDrive permissions are OAuth 2.0 delegated authorizations granted through Microsoft Entra ID allowing Anthropic models to read, parse, and cite documents in Microsoft 365 OneDrive repositories. The Anthropic native Microsoft 365 connector requires Entra ID Global Administrator consent or pre-approved enterprise app assignment before any employee can query documents stored in OneDrive.

Microsoft Entra ID enforces delegated access for third-party AI connectors. When a user authorizes Claude, Anthropic receives a delegated bearer token rather than direct application credentials. The model acts strictly on behalf of the authenticated human, inheriting the user's existing security profile. If an employee cannot open a confidential financial workbook in OneDrive, Claude cannot view or summarize that workbook either.

### How Microsoft Entra ID Evaluates Consent Requests

When an organization configures Microsoft 365, Entra ID governs third-party application access using three distinct consent policies:

* **User Consent Disabled:** Default configuration for security-conscious tenants. Users cannot authorize any external application that connects to company data, regardless of the requested permissions.
* **Consent for Verified Publishers:** Users may consent to low-risk permissions for applications created by verified publishers, but data-access scopes remain restricted.
* **Custom Admin Consent Workflows:** Users see an approval request screen where they submit a justification to tenant administrators rather than facing an outright block.

Anthropic completed Microsoft publisher verification, associating its verified Microsoft Partner Network identity with the connector. However, because the connector requests broad access across multiple services including OneDrive files, mail, and calendar entries, Entra ID flags the authorization as requiring administrative approval.

### The Scope Requirements of Anthropic's Pre-Built Connector

The native connector packages its capabilities across several Microsoft Graph API scopes. When linking OneDrive, Entra ID presents an all-or-nothing consent screen that includes:

* `User.Read`: Reads the basic user profile to confirm identity.
* `Files.Read`: Reads files and folder structures located in the user's personal OneDrive partition.
* `Files.Read.All`: Allows the connector to read files shared with the user across other accounts and site collections.
* `Sites.Read.All`: Permits traversal of shared document libraries throughout corporate SharePoint environments.

Because `Files.Read.All` and `Sites.Read.All` grant visibility into shared organizational records, Microsoft Entra ID classifies them as high-impact permissions. If tenant administrators have not pre-consented to the application, the authorization flow stops at the initial sign-in attempt.

## How to Resolve Admin Consent Errors in Microsoft Entra ID

Resolving the admin approval error requires an administrator to update enterprise application permissions in the Microsoft Entra admin center. End users cannot bypass this security barrier from Claude's interface.

Follow this numbered troubleshooting sequence to grant delegated permissions and unblock access:

1. Identify the requested enterprise application: Anthropic's integration registers as `M365 MCP Client for Claude` and `M365 MCP Server for Claude` within your tenant directory.
2. Sign in to Microsoft Entra admin center: Navigate to `entra.microsoft.com` using Global Administrator, Privileged Role Administrator, or Cloud Application Administrator credentials.
3. Open Enterprise Applications: In the left navigation menu, expand **Identity**, select **Applications**, and click **Enterprise applications**.
4. Locate the Claude connector: Use the search field to find `M365 MCP Client for Claude` or `Claude`. Select the application to open its management panel.
5. Review requested permissions: In the left sidebar under **Security**, click **Permissions**. You will see the delegated permissions requested by Anthropic, including `User.Read`, `Files.Read`, `Files.Read.All`, and `Sites.Read.All`.
6. Grant tenant-wide administrative consent: Select the **Grant admin consent for your organization** button located at the top of the permissions pane. Review the permissions in the popup window and click **Accept**.
7. Enforce targeted pilot assignment: To avoid opening the integration to all employees at once, navigate to **Manage > Properties**. Set **Assignment required?** to **Yes** and click **Save**. Next, open **Manage > Users and groups**, click **Add user/group**, and assign only designated pilot security groups.
8. Re-authenticate the connection: Have the user return to Claude, open **Customize > Connectors**, disconnect any failed attempt, select **Microsoft 365**, and complete the sign-in prompt. The authorization completes without error.

### Managing the Admin Consent Workflow

If your organization prefers not to grant broad pre-consent, you can enable the built-in admin consent workflow in Entra ID. This setting allows users to request administrator review directly from the consent dialog.

To enable this workflow:

1. In the Microsoft Entra admin center, navigate to **Identity > Applications > Enterprise applications > Consent and permissions > Admin consent settings**.
2. Set **Users can request admin consent to apps they are unable to consent to** to **Yes**.
3. Select which administrators receive notifications, assign email notification groups, and set an expiration window for pending requests.
4. When a user attempts to connect Claude, Entra ID presents a text field where the user inputs a business justification.
5. Administrators review incoming requests under **Identity > Applications > Enterprise applications > Admin consent requests** and approve them individually.

## How OneDrive Partitions Differ from SharePoint Site Collections

Most integration guides treat OneDrive and SharePoint as identical targets, but Microsoft Graph architecture manages them through distinct drive partitions. Conflating these two environments leads to unexpected permission denials even after an administrator grants initial consent.

### Architecture of OneDrive for Business Partitions

OneDrive for Business is not an isolated storage platform. Architecturally, every corporate OneDrive account is a personal SharePoint site collection partition provisioned at `https://<tenant>-my.sharepoint.com/personal/<user>_<domain>_com`.

Microsoft Graph addresses this storage through specific endpoints:

* The `/me/drive` endpoint maps directly to the authenticated user's personal partition.
* The `/users/{user-id}/drive` endpoint accesses another user's personal partition, provided the caller has explicit delegation.
* The `/sites/{site-id}/drives` endpoint accesses shared team document libraries in standard SharePoint site collections.

When Claude interacts with OneDrive, it issues requests against `/me/drive/root/children` to browse folders and `/me/drive/items/{item-id}/content` to download document text.

The scope `Files.Read` grants Claude access to files stored in the user's personal drive partition. However, if a user asks Claude to analyze a spreadsheet located in a shared department site, `Files.Read` alone will fail. The connector requires `Files.Read.All` to traverse documents shared by colleagues and `Sites.Read.All` to query root SharePoint libraries. If an administrator consents to `Files.Read` but strips `Sites.Read.All`, Claude can read personal OneDrive files while failing on company team shares.

### Personal Microsoft Accounts vs. Entra ID Tenants

A frequent source of support tickets involves personal Microsoft accounts. Users often attempt to link Claude to personal OneDrive storage associated with `@outlook.com`, `@hotmail.com`, or consumer Microsoft 365 Personal subscriptions.

Anthropic native Microsoft 365 connector requires a Microsoft Entra ID tenant tied to a commercial business plan. Personal Microsoft accounts cannot authenticate through the pre-built connector.

When a user attempts to authenticate a consumer account, the identity provider returns an immediate authentication error. Anthropic's multi-tenant OAuth endpoint targets organizational directory tenants (`/common` or specific tenant GUIDs) configured for work and school accounts. Consumer identity tokens issued by Microsoft Accounts (`live.com`) are rejected during the initial token exchange.

To access personal OneDrive files with Claude, users must adopt an alternative connection strategy. Options include running a community-developed local MCP server configured with custom Azure multi-tenant consumer credentials, or syncing OneDrive folders into an intelligent workspace designed for multi-agent access.

## Why Native Connectors Face Latency Limits and How Fast.io Resolves Them

Teams deploying AI workflows across enterprise storage quickly discover that resolving OAuth permissions addresses only the first operational hurdle. The native connector queries Microsoft Graph API on demand, which introduces significant latency and cost bottlenecks when handling large document repositories.

When a user asks Claude to evaluate fifty technical specifications or find clauses across several hundred vendor agreements, the native connector must crawl the folder tree item by item. Each folder traversal requires a distinct Graph API call.

This sequential querying model creates distinct operational penalties:

* **Microsoft Graph Rate Throttling:** Microsoft imposes strict concurrency and transaction limits on Graph API endpoints. Heavy folder crawling triggers HTTP 429 Too Many Requests responses, forcing Claude to back off and delaying response generation.
* **Context Window Bloat:** To answer a query across multiple files, the native connector retrieves full text payloads over the network and injects entire documents into Claude's prompt context. This consumes tens of thousands of tokens before analysis begins.
* **Attention Degradation:** Large language models show reduced recall accuracy when relevant details are buried in massive multi-document prompt contexts.
* **Lack of Deep Indexing:** The native connector does not create a pre-indexed vector or hybrid search database. Every complex question requires fresh Graph API round-trips.

### The Fast.io Hybrid Workspace Architecture

Fast.io provides an alternative architecture for teams that want to keep their existing cloud storage while equipping AI agents with fast, citation-backed document access. If your team already keeps files in Dropbox, Google Drive, OneDrive, Box or SharePoint, the setup starts from that existing foundation.

Rather than pointing Claude directly at an unindexed cloud drive, the team links their storage to a Fast.io workspace:

1. **Storage Persistence:** Your files remain in your corporate OneDrive or SharePoint libraries.
2. **Cloud Sync:** Folders sync into a Fast.io workspace. Cloud Sync supports Google Drive, Dropbox, Box, and OneDrive (one-way or two-way, on a schedule or on demand; SharePoint libraries connect through the OneDrive connector).
3. **Intelligence Mode:** Once files enter the workspace, Fast.io indexes them for hybrid search combining full-text keyword retrieval, semantic understanding, and search-by-metadata-value.
4. **Structured Document Processing:** Teams can configure [Metadata Views](/product/document-data-extraction/) to convert unstructured PDFs, Word documents, and spreadsheets into queryable structured data without writing custom parsing scripts.
5. **Remote MCP Querying:** AI models query the pre-indexed workspace through Fast.io's remote Model Context Protocol server. Instead of downloading whole files over Microsoft Graph, Claude runs targeted searches, pulling only the relevant excerpts and verified source citations into context.

Fast.io was measured the fastest and lowest cost of the providers tested in published connector benchmarks ([fast.io/benchmarks/](https://fast.io/benchmarks/)). By answering queries using indexed excerpts rather than raw file downloads, agents consume fewer prompt tokens and complete complex retrieval tasks with minimal latency.

### Connecting Claude to Fast.io via Remote MCP

Connecting Claude to a Fast.io workspace requires no local software installation or custom code. Fast.io hosts a remote MCP server over Streamable HTTP.

To connect Claude desktop, web, or mobile apps:

1. In Claude, navigate to **Customize**, then select **Connectors**.
2. Select **Add custom connector**.
3. In the URL field, enter `https://mcp.fast.io/mcp/tools`.
4. Click **Connect**. A secure browser window opens displaying the Fast.io authorization screen.
5. Review permissions and select your authorized organization and workspace. Complete the sign-in.
6. In any chat window, click the **+** menu under **Connectors** and enable Fast.io.

For developers using Claude Code in a terminal environment, configure the connection with a single command:

```bash
claude mcp add --transport http fast-io https://mcp.fast.io/mcp/code
```

After adding the server, complete browser OAuth sign-in to authorize access. Claude Code can then query files, search workspace content, and store generated artifacts directly in Fast.io.

## Steps to Audit, Scope, and Revoke Claude Storage Access

Enterprise IT leaders must maintain strict governance when connecting language models to corporate records. Both Microsoft Entra ID and Fast.io provide comprehensive audit trails and revocation mechanisms to maintain organizational control.

### Audit Trails and Compliance Logging

Every file request made by Claude through Anthropic's native connector logs to the Microsoft 365 audit trail. Security analysts can inspect these events in the Microsoft Purview compliance portal:

* **Event Identification:** Look for events with the application identifier associated with `M365 MCP Client for Claude`.
* **Captured Attributes:** Logs capture the timestamp, requesting user principal, specific Graph API operation, and target file path.
* **Retention:** Audit records persist according to your tenant's Microsoft 365 retention policies.

Fast.io provides a complementary detailed activity log of changes within its workspaces. The activity log records file creations, uploads, edits, moves, deletions, membership updates, and share configurations. It tracks actions taken by both humans and autonomous agents, giving teams visibility into how documents change over time.

### Scoping Permissions and Multi-Tier Revocation

Fast.io structures access through role-based permissions set per organization, workspace, and share. There are no folder-level or file-level permissions; every workspace member accesses the workspace according to their assigned role. When external collaborators or client agents require access to specific project files, teams create a scoped share rather than opening the entire workspace.

If an administrator or user must revoke Claude's storage access, multiple revocation paths exist:

* **End-User Revocation in Claude:** An individual can disconnect the connector at any time by opening **Customize > Connectors**, selecting the active integration, and clicking **Disconnect**.
* **Tenant-Wide Revocation in Entra ID:** Administrators can open the Microsoft Entra admin center, navigate to **Enterprise applications**, select the Claude client, open **Permissions**, and click **Revoke permissions**. Deleting the enterprise application registration removes access for all tenant members immediately.
* **Fast.io Device Revocation:** To revoke access granted to an MCP agent, remove the connector in Claude, then log in to Fast.io, open **Settings**, select **Devices & Agents**, navigate to **Connected Devices**, and click **Revoke**.

### Transparent Pricing and Implementation Plans

Organizations operate on paid subscription tiers designed for teams collaborating with AI agents. Monthly plans start with a 14-day free trial, which requires a credit card.

| Plan Tier | Monthly Billing | Annual Billing | Storage Included | Included Seats | Monthly Credits | Maximum Upload Size |
|---|---|---|---|---|---|---|
| Starter | $9.99/mo | $99/yr | 250 GB | 3 | 100,000 | 25 GB |
| Business | $49.99/mo | $499/yr | 5 TB | 10 | 600,000 | 50 GB |
| Enterprise | $199.99/mo | $1,999/yr | 25 TB | 30 | 3,000,000 | 100 GB |

Credits meter AI operations, including automatic indexing, hybrid search, and Metadata Views extraction. Additional member seats and credit overages scale with organizational needs.

## Frequently asked questions

### Why does Claude say admin approval is required for OneDrive?

Claude displays an admin approval message because Microsoft Entra ID security policies restrict non-administrative users from granting third-party applications access to corporate data. Anthropic's connector requests high-impact Microsoft Graph permissions, including Files.Read.All and Sites.Read.All. An Entra Global Administrator or Cloud Application Administrator must grant tenant-wide consent or approve the application in Enterprise Applications before individual employees can connect their OneDrive repositories.

### Can Claude access personal OneDrive accounts?

Anthropic's native Microsoft 365 connector cannot authenticate personal Microsoft accounts such as @outlook.com or @hotmail.com. The pre-built connector requires an enterprise Microsoft Entra ID tenant tied to a business Microsoft 365 plan. To use Claude with personal OneDrive storage, users must deploy a custom community MCP server configured with consumer credentials or sync their personal OneDrive folders into an intelligent workspace platform like Fast.io.

### How do I configure Microsoft 365 permissions for Claude?

To configure permissions, an administrator signs in to the Microsoft Entra admin center at entra.microsoft.com, opens Identity > Applications > Enterprise applications, and selects the Claude connector app. Under Security > Permissions, click Grant admin consent for your organization to approve delegated Graph scopes such as Files.Read.All and Sites.Read.All. To restrict access to a pilot group, navigate to Properties, set Assignment required? to Yes, and assign designated security groups under Users and groups.

### What is the difference between Files.Read and Files.Read.All in Claude's connector?

Files.Read grants Claude permission to view only the files and folders stored in the authenticated user's personal OneDrive partition. Files.Read.All allows Claude to access files shared with that user across other colleagues' OneDrive drives and organization-wide SharePoint libraries. Sites.Read.All is additionally required to search and traverse root SharePoint site collections.

### How can teams prevent Microsoft Graph rate limits when Claude searches OneDrive?

Teams can prevent Microsoft Graph rate limits by syncing OneDrive folders into an indexed workspace platform such as Fast.io using Cloud Sync. Instead of having Claude traverse nested folders item by item over the Graph API, Fast.io pre-indexes the files with hybrid search. Claude connects through Fast.io's remote Model Context Protocol endpoint (documented at https://mcp.fast.io/docs) to retrieve exact semantic excerpts, reducing token usage and eliminating Graph API throttling.

## Sources

- [Claude Help Center](https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide): Anthropic's Microsoft 365 connector requires a Microsoft Entra ID tenant tied to a business plan and cannot authenticate personal Microsoft accounts.

## About Fast.io

Fast.io provides shared workspaces where people and AI agents work on the same files, with built-in semantic search and citation-backed chat over what they hold. Agents reach it through a remote MCP server, a REST API at https://api.fast.io/current/, and a command line client published on npm as @vividengine/fastio-cli. MCP setup is at https://mcp.fast.io/docs: Claude and most MCP clients connect to https://mcp.fast.io/mcp/tools, ChatGPT to https://mcp.fast.io/mcp/operations, and coding agents to https://mcp.fast.io/mcp/code.