Microsoft 365 MCP Server

Environment

• SILENT

  Set to 'true' or '1' to disable console output.

• LOG_LEVEL

  Set logging level (default: 'info').

• READ_ONLY

  Set to 'true' or '1' to start server in read-only mode, disabling write operations.

• ENABLED_TOOLS

  Regex pattern to filter tools (alternative to --enabled-tools flag).

• MS365_MCP_MAX_TOP

  Hard cap for Graph $top / top on list requests (positive integer).

• MS365_MCP_ORG_MODE

  Set to 'true' or '1' to enable organization/work mode from start (includes Teams, SharePoint, etc.).

• MS365_MCP_CLIENT_ID

  Custom Azure app client ID (defaults to built-in app).

• MS365_MCP_MAX_ITEMS

  Maximum number of items accumulated when fetchAllPages is true (positive integer, default 10000).

• MS365_MCP_MAX_PAGES

  Maximum number of pages followed when fetchAllPages is true (positive integer, default 100).

• MS365_MCP_TENANT_ID

  Custom tenant ID (defaults to 'common' for multi-tenant). Personal accounts should set to 'consumers'.

• MS365_MCP_CLOUD_TYPE

  Microsoft cloud environment: 'global' or 'china' (21Vianet).

• MS365_MCP_REDACT_PII

  Set to 'true' or '1' to scrub PII from log messages.

• MS365_MCP_BODY_FORMAT

  Set to 'html' to return email bodies as HTML instead of plain text.

• MS365_MCP_OAUTH_TOKENsecret

  Pre-existing OAuth token for Microsoft Graph API (BYOT method).

• MS365_MCP_EXTRA_SCOPES

  Append additional Graph scopes to the token request.

• MS365_MCP_KEYVAULT_URLsecret

  Azure Key Vault URL for secrets management.

• MS365_MCP_CLIENT_SECRETsecret

  Azure app client secret (optional for public apps).

• MS365_MCP_OUTPUT_FORMAT

  Set to 'toon' to enable experimental TOON output format for token reduction.

• MS365_MCP_ALLOWED_SCOPES

  Limit exposed tools to Graph scopes covered by this allowlist.

• MS365_MCP_ALLOW_PAGINATION

  Set to '0', 'false', or 'no' to disable multi-page following entirely.

• MS365_MCP_TOKEN_CACHE_PATHsecret

  Custom file path for MSAL token cache.

• MS365_MCP_TRUST_PROXY_HOPS

  Number of trusted reverse-proxy hops in HTTP mode (default 1).

• MS365_MCP_EXPECTED_USERNAME

  Require local MSAL auth to use this Microsoft account username (case-insensitive).

• MS365_MCP_FORCE_WORK_SCOPES

  Backwards compatibility alias for MS365_MCP_ORG_MODE (deprecated).

• MS365_MCP_AUTH_CACHE_COMMAND

  External executable wrapper for provider-neutral auth-cache storage.

• MS365_MCP_RATE_LIMIT_DISABLED

  Set to 'true' or '1' to disable per-IP rate limiting in HTTP mode.

• MS365_MCP_SELECTED_ACCOUNT_PATH

  Custom file path for selected account metadata.

• MS365_MCP_EXPECTED_HOME_ACCOUNT_ID

  Require local MSAL auth to use this exact MSAL homeAccountId.

• MS365_MCP_AUTH_CACHE_COMMAND_TIMEOUT_MS

  Per-invocation timeout for MS365_MCP_AUTH_CACHE_COMMAND (default: 10000).