Ask your Microsoft 365 tenant in Claude

Most questions about a Microsoft 365 tenant are small. Who has a licence and doesn't use it? Which laptops are out of compliance? What should I fix first? Each one usually means a report export, a filter in Excel and a second tab to cross-check names. The GraphPaaS connector for Claude turns them into a sentence: you ask, Claude queries the data your GraphPaaS dashboard already holds, and the answer comes back with the query it came from.

Below is the setup, then four real exchanges with our demo tenant (synthetic users, real tool calls, nothing tidied up), and the limits, stated plainly.

Three steps to connect

"Who has a licence and never uses it?"

The demo organisation can read two tenants, so the first call bounces. That is on purpose: without a tenant, the connector refuses to guess and tells Claude to ask.

get_metrics(domain="licence_waste", where={"last_activity": null})
→ 400: you can read 2 tenants — ask the user which one they mean

Pick Fabrikam HQ, and the same question runs against it.

describe_domain(domain="licence_waste", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e")
→ 42 rows, refresh: daily
get_metrics(domain="licence_waste", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"last_activity": null})
→ 5 rows
get_metrics(domain="licence_waste", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"last_activity": {"<": "2026-07-13"}})
→ 5 rows

Claude didn't know what "never uses it" means in this data. It asked describe_domain, whose note says the dashboard counts a licence as wasted when the last activity is empty or older than 90 days. That last activity is Microsoft's: the most recent intentional activity in the app, and the usage reports typically arrive 24 to 72 hours late, which is why this domain syncs once a day. The next step is the one in our dormant accounts audit: check each name with their manager before you remove anything.

"Which devices are out of compliance?"

get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            group_by="compliance_state")
→ compliant 31 · noncompliant 5
get_metrics(domain="devices", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"compliance_state": "noncompliant"})
→ 5 rows

Intune marks a device non-compliant immediately by default, and Conditional Access can then block it. But two of these five have a problem no setting will fix: Windows 10 stopped receiving security updates after 14 October 2025. Those two need an upgrade or a replacement, not a re-sync.

"What should I fix first?"

tenant_advisor(tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e", status="fail")
→ 19 failing: critical 1 · high 5 · medium 8 · low 5 (17 passing)

Read the three answers together

Three separate tools, and one name keeps coming back. Ana Dias holds a paid licence with no activity Microsoft reports, an admin role with no MFA method, and a laptop that hasn't checked in since August. That is what a dormant admin account looks like, and Microsoft's own guidance is blunt about it: accounts with administrative rights are targeted by attackers, and requiring MFA on them is an easy way to cut that risk.

What it won't do

• Write to Microsoft. Every answer comes from data GraphPaaS already collected. The one action, refreshing a single domain, queues another read, and only a tenant admin can run it.
• Answer live. The background sync runs every four hours, and once a day for what Microsoft publishes once a day. Each answer carries the time its data was collected. Browsing SharePoint and OneDrive folders is the exception: that reads Microsoft live.
• See more than you do. Claude gets your dashboard's access: the same organisation and the same tenants. Limited to three tenants in Team settings? So is Claude. Someone removed from your team loses access on their next call.
• Pick a tenant for you. With more than one, it asks, as the first exchange above shows.

Claude Code and other MCP clients that send a header can use a GraphPaaS API key instead of the Microsoft sign-in.