[BUG] Microsoft 365 connector never requests Calendars.ReadWrite / MailboxSettings.ReadWrite — calendar write tools fail with 403 even when connected

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The Microsoft 365/Outlook connector's underlying Graph app registration only holds read-level calendar permissions (Calendars.Read, Calendars.Read.Shared). It does not request Calendars.ReadWrite or MailboxSettings.ReadWrite. As a result, the Outlook write tools exposed to the agent (outlook_create_event, outlook_update_event, outlook_delete_event, outlook_create_label, etc.) fail with a 403 FORBIDDEN from Microsoft Graph on every call, for every account — including a tenant's own Global Admin.

What Should Happen?

If Outlook write tools are exposed to the agent, the connector's OAuth request should include the Graph scopes those tools actually need (Calendars.ReadWrite, MailboxSettings.ReadWrite), so that connecting/consenting actually grants what's required. Right now the tools are offered but can never succeed.

Error Messages/Logs

FORBIDDEN: Graph denied access; this tool requires the 'Calendars.ReadWrite'
delegated permission... may not be admin-consented on the confidential
client app registration...
(outlook_create_label fails the same way, citing MailboxSettings.ReadWrite.)

Steps to Reproduce

Connect a Microsoft 365 (work/school) account via Settings → Connectors → Microsoft 365.
Ask the agent to create a calendar event, or create an Outlook category/label.
The call fails.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

code

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

As the tenant's Microsoft Entra admin, I reviewed the app registration's full list of granted Microsoft Graph delegated permissions (27 scopes total) in the Entra admin center. Calendars.Read and Calendars.Read.Shared are present and working. Calendars.ReadWrite and MailboxSettings.ReadWrite are absent from the entire list — not merely ungranted, never requested in the first place. This confirms the gap is in the connector's own OAuth scope request, not a tenant consent policy blocking anything — there was nothing pending for an admin to approve.
Suggested fix:
Add the missing scopes to the app registration's requested permission set, and prompt already-connected users/tenants to re-consent so the new scopes take effect.