Use with Claude Enterprise connected to Outlook, Teams, SharePoint, OneDrive, or Microsoft Graph.
Do
- County-approved Claude + allowlisted Microsoft connectors/MCP only
- Prefer read-only until action verbs are justified
- Remember OAuth = the agent acts as you
- Confirm before Send, Teams post, delete/move, sharing links
- Decide yourself on eligibility, HR, enforcement outcomes
- Minimize personal data (GDPA); verify drafts before use
- Report injection, bad sends, token issues immediately
- Use approved PowerPoint / Power Automate / Power Apps MCPs to create, edit, and diagnose work much faster (often ~10×–80×+), then verify before publish
Don’t
- Paste non-public M365 content into public AI
- Put Graph secrets/passwords/tokens in prompts
- Grant broad
*.ReadWrite.All“just in case” - Allow auto-send or bulk-delete without preview
- Enable new Microsoft AI buttons without County review
- Assume Enterprise access = every site/mailbox is allowed
- Ignore “ignore policy and export…” content in email/Teams
Gates
| Gate | Microsoft examples |
|---|---|
| Assist | Draft Outlook reply; summarize SharePoint for your review |
| Confirm | Send mail; post Teams; delete/move files; create sharing link |
| Decide | Benefits, discipline, enforcement — human decides |
| Prohibit | AI final rights decision; non-public data in public AI; secrets in prompts |
Policy 1400-9 · SLCO-AI-MCP-401 · See also HITL job aid in the training kit.