SharePoint MCP Servers and Sites.Selected: How to Limit AI to Specific Sites

Yes. Microsoft publishes SharePoint MCP servers, and Claude's Microsoft 365 connector is itself an Anthropic-hosted MCP server. The ones that read existing SharePoint sites act as the signed-in user, so they reach whatever that user can open. None of them documents Sites.Selected, the Graph permission that limits an app to granted sites, as a way to narrow that reach.

That matters to a regulated team. A deal team may want Claude to read one fund's deal memos and investment committee materials and nothing else, which is narrower than everything each analyst can open.

Work IQ MCP and the SharePoint MCP server in Copilot Studio

Work IQ MCP is Microsoft's MCP endpoint for Microsoft 365 data, including files and sites. Microsoft describes it as generally available, billed through usage-based Copilot Credits and independent of Microsoft 365 Copilot licensing; enabling it requires a usage-based billing plan in Copilot Studio with an Azure subscription. Its actions are user scoped, so every request accesses only what that user is allowed to see. Microsoft documents connections from Copilot Studio, Microsoft Foundry and GitHub Copilot CLI.

Copilot Studio also lists a workload-specific SharePoint MCP server in preview, which also appears as the Work IQ SharePoint MCP (Preview) Premium connector. Its tools include findSite, listDocumentLibrariesInSite, getFolderChildren and readSmallTextFile; findFileOrFolder searches every site and library the user can reach, and file operations are limited to files of 5 MB or less. Microsoft says these application-specific tools exist for backward compatibility and shouldn't be used in production or new projects. In Copilot Studio, Work IQ's workload selection covers whole workloads such as SharePoint and can't select individual sites.

SharePoint Embedded MCP server

The SharePoint Embedded MCP server is an open-source developer tool in preview, the @microsoft/spe-mcp npm package. It runs locally with Claude Desktop, Claude Code, Codex CLI, Cursor or GitHub Copilot in Visual Studio Code, and it sets up and manages SharePoint Embedded applications and their containers. Its content tools work on files in those containers; Microsoft doesn't describe it as a way to reach existing SharePoint team sites. Its "Control what the server can do" section covers a read-only mode, tool profiles and a separate consent before content tools can touch files.

Community and hosted servers

Open-source SharePoint MCP servers on GitHub call Microsoft Graph or the SharePoint REST API through an Entra ID app registration that you create and consent to. Hosted integration platforms offer SharePoint as one connector among many and run the server for you. Either way, the permissions on the app registration behind the server decide what the AI can reach, which is where Sites.Selected comes in.

• How to Connect Gemini to SharePoint via MCPConnecting Gemini to SharePoint via MCP bridges Google AI ecosystem to Microsoft enterprise storage through standard...
• Microsoft 365 MCP Server: Connecting Agents to OneDrive and SharePointA Microsoft 365 MCP server connects AI coding assistants to OneDrive and SharePoint repositories via the Model Context...
• How to Sync SharePoint to MCP: Enterprise Agent Document AccessSyncing SharePoint to MCP bridges enterprise Microsoft 365 document libraries with autonomous AI agents by...
• Box MCP Server Setup and AI Agent Storage IntegrationA Box MCP server allows AI agents to interact with Box enterprise files and folders using the standardized Model...
• How to Connect ChatGPT to OneDrive Using MCPConnecting OpenAI models to enterprise document stores requires moving beyond brittle local folder scripts. A ChatGPT...
• How to Set Up a OneDrive for Business MCP Server for AI AgentsSetting up a onedrive business mcp server requires navigating organizational Entra ID tenant consent, enterprise...

More on this subject: MCP and Model Context Protocol (249 guides)

Sites.Selected is a Microsoft Graph API permission that gives an app no SharePoint access at all until an administrator grants it a role on a specific site collection. That inverts the .All permissions: once an administrator consents to Sites.Read.All, the app can read documents and list items in all site collections, with no further step.

Microsoft now documents four Selected scopes for SharePoint and OneDrive:

Sites.Selected came first and works only at the site collection level. The three newer scopes extend the model down to lists, folders and single files, and Microsoft notes that the longer names follow newer naming rules with no functional difference.

Microsoft lists three conditions, and the app has no access if any one is missing:

1. The app is consented in Microsoft Entra ID for the Selected scope.
2. The app is granted a role on the resource through that resource's /permissions endpoint.
3. The app acquires a token that contains the Selected scope when it calls the resource.

Sites.Selected comes in two permission types, application and delegated, and a grant carries one of four roles. Microsoft's overview says every Selected scope now supports both types.

• Application (app-only): the app calls Microsoft Graph with its own identity and no signed-in user. Microsoft calls this the higher-risk mode because no user is present.
• Delegated: the app acts for a signed-in user, and the user's own permissions still apply.

Microsoft's permissions reference marks admin consent as required for the application form of every Selected scope, and for the delegated form of every one except Sites.Selected.

A site grant doesn't name a permission type. Microsoft's developer blog explains that the token request decides it, and that consenting only the delegated form of Sites.Selected blocks app-only calls, so a user is always present.

Microsoft documents delegated Sites.Selected as a Microsoft Graph permission. Its resource-specific consent guide mentions a Sites.Selected application permission for the SharePoint REST API, but not a delegated one, so build delegated designs on Graph.

The roles are read, which reads the metadata and contents of the resource, and write, which reads and modifies them. Microsoft's Graph overview lists owner and full control as the higher roles, while its resource-specific consent guide and PnP PowerShell use manage and full control. An app that only reads documents for an AI needs read.

You grant SharePoint Sites.Selected access with a POST to the site's /permissions endpoint in Microsoft Graph, or with the PnP PowerShell cmdlet Grant-PnPEntraIDAppSitePermission. Either way, the person or app making the grant needs far more privilege than the AI app will hold.

Microsoft Graph

This request grants an app read access to one site:

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
Content-Type: application/json

{
  "roles": ["read"],
  "grantedToIdentities": [{
    "application": {
      "id": "{app-client-id}",
      "displayName": "Deal team AI connector"
    }
  }]
}

A successful call returns 201 Created with a permission object:

HTTP/1.1 201 Created
Content-Type: application/json

{
  "id": "{permission-id}",
  "roles": ["read"],
  "grantedToIdentitiesV2": [{
    "application": {
      "id": "{app-client-id}",
      "displayName": "Deal team AI connector"
    }
  }]
}

Keep the id to read, update or delete the grant later at /sites/{site-id}/permissions/{permission-id}. Microsoft's example also returns the older grantedToIdentities property, marked as deprecated.

Microsoft's reference lists Sites.FullControl.All as the only permission that can create a site grant; in delegated mode the caller must also be a SharePoint Administrator or higher and a member of the target site. Grants below the site level need less: Sites.Selected with a full control or owner role on the parent site, or, for items and files, Lists.SelectedOperations.Selected with that role on the parent list.

PnP PowerShell

The current cmdlet is Grant-PnPEntraIDAppSitePermission. The name many guides still use, Grant-PnPAzureADAppSitePermission, is now an alias for it. The cmdlet takes Read, Write, Manage or FullControl, and PnP's reference lists Microsoft Graph Sites.FullControl.All, delegated, as the permission it needs.

Grant-PnPEntraIDAppSitePermission -AppId "{app-client-id}" -DisplayName "Deal team AI connector" -Permissions Read -Site "https://contoso.sharepoint.com/sites/fund-deals"

Get-PnPEntraIDAppSitePermission lists the grants on a site, Set-PnPEntraIDAppSitePermission changes a grant's role, and Revoke-PnPEntraIDAppSitePermission -PermissionId {permission-id} removes it. For the certificate-based app registration behind app-only access, see SharePoint app-only authentication.

Consent behavior to plan around

• Revoking a scope's consent in Entra ID removes access to everything granted under that scope. A grant made under another Selected scope, such as a list grant under Lists.SelectedOperations.Selected, keeps working.
• Deleting a list grant removes access to the list and every item in it, regardless of item-level grants.
• A grant on a list, folder or file breaks permission inheritance on that item, and SharePoint limits unique permissions per list or library. Site collection grants don't. If content is organized by deal folder, folder grants mean maintaining unique permissions as deals open and close.

With delegated Sites.Selected, SharePoint calculates the app's grant and the user's own permissions and uses the intersection. Microsoft states it both ways: the app can never exceed the user's permissions, and the user can never exceed the app's grant through the app.

App-only calls involve no user: SharePoint allows the call if the app's grant on the resource, or on a parent it inherits from, covers the operation.

The delegated rule is the one an AI rollout wants. Take an analyst who can open 40 SharePoint sites, using an AI app that has read grants on the two sites for one fund. Through that app, the analyst's AI reaches only those two sites, and only the parts of them the analyst can already open. Remove the analyst from a site and the AI loses it too; remove the app's grant and every user loses it through the app.

The catch: Claude's and ChatGPT's connectors don't use it, and the search calls an AI depends on don't accept it, as the next section explains.

SharePoint MCP servers break with Sites.Selected when their tools search for a document or list sites, because those Graph endpoints need Sites.Read.All or Files.Read.All.

The built-in connectors don't accept it

Anthropic's security guide for the Microsoft 365 connector says SharePoint search requires Sites.Read.All, and that site-specific permissioning with *.Selected permissions isn't supported because the underlying search is tenant-wide. It also lists service principal authentication as unsupported. For the consent setup the connector does use, see Claude SharePoint permissions.

OpenAI's SharePoint setup article lists Sites.Selected as not supported for live SharePoint search and asks admins to enable Sites.Read.All and Files.Read.All.

Search and site discovery need .All permissions

If a self-hosted or third-party server's tools start by searching or listing sites, they hit the calls Microsoft's reference pages flag:

A tool built on these calls fails at its first step, even when the site grant is correct.

What works, and what it costs

Microsoft's resource-specific consent guide says calls to a granted site succeed and calls to any other site collection fail with "Access denied." So a server given the site ID or path up front can walk that site's libraries and folders. It gives up search: the model browses by path, or you host your own index of the granted content. For the Graph calls, see the Microsoft Graph API guide for SharePoint.

Three other things to check:

• A grant for every site. Consent alone gives the app nothing until each site is granted.
• The scope in the token. A grant applies only when the token contains the Selected scope, so check both the permissions consented in Entra ID and the scopes the server requests.
• App-only means one reach for everyone. An application token carries no user, so everyone using that server reaches whatever the app was granted. A delegated design keeps each user's permissions but needs a sign-in and token exchange per user, which is a full application to build and maintain.

Each option draws the line in a different place:

ChatGPT's site controls need workspace enablement and apply to whole site collections, not subsites, folders or files. That may be enough if each deal has its own site collection, but not if deals are folders in a shared library.

Restricted Content Discovery keeps a site out of organization-wide search and Microsoft Copilot responses without changing permissions, and Restricted SharePoint Search is retiring, with new enablement blocked since July 31, 2026. Neither Anthropic nor OpenAI lists them as controls for their connectors.

A scoped workspace limits Claude or ChatGPT by giving it a separate copy of only the SharePoint folders it may read. With Fastio, SharePoint stays where it is and each scope becomes its own workspace.

1. Create a workspace per scope, such as one per deal team, fund or finance group. Fastio permissions are set per organization, workspace and share, with no folder- or file-level permissions inside a workspace, so the workspace is the boundary.
2. Link SharePoint through Cloud Sync. An owner who can open the libraries links OneDrive for Business in Cloud Sync, which reaches SharePoint libraries through the OneDrive connector. The connection uses OAuth, the owner picks the library and folders, and folder structure is preserved.
3. Choose how the content stays current.
   • A one-time import copies the folders once.
   • A one-way sync keeps the Fastio copy current from SharePoint and never writes to SharePoint.
   • A two-way sync also carries changes made in Fastio back to SharePoint.
4. Add members. Workspace membership now decides who can reach the content, so add only the people who should see it. SharePoint permissions still govern SharePoint itself.
5. Connect Claude or ChatGPT over MCP. Add Fastio as a custom connector at https://mcp.fast.io/mcp/tools for Claude and most clients, or https://mcp.fast.io/mcp/operations for ChatGPT; steps are on mcp.fast.io/docs. Each person signs in with OAuth in the browser, so the configuration holds no API key. On the Review Permissions screen, choose Read Only and select only the workspaces this connection may reach. Read Only connections aren't offered tools that change data.
6. Give headless agents a scoped API key. Code without a person sends Authorization: Bearer your-api-key to https://mcp.fast.io/mcp/tools or https://mcp.fast.io/mcp/code, and the key can be scoped to specific organizations, workspaces or shares.

Syncs run on a recurring schedule or on demand, not continuously, so expect a delay between an edit in SharePoint and the AI seeing it. For Claude Code specifically, see Claude Code SharePoint MCP.

Close the other route

A scoped workspace limits the AI only if it is the only route. If the same users also have Claude's Microsoft 365 connector or ChatGPT's SharePoint app, the AI can still reach everything they can open in SharePoint. In Claude, Team and Enterprise owners decide whether to enable that connector, and an Entra administrator can set Assignment required on both Claude enterprise applications. In ChatGPT, workspace admins manage app availability and role access.

To revoke a Fastio connection, remove the connector in the AI client, then open Settings, Devices & Agents, Connected Devices in Fastio and select Revoke.

Fastio indexes imported files for search, summarization and chat (Intelligence), so Claude can search a workspace instead of browsing by path. Intelligence can be turned off per workspace, but not turned back on. The built-in assistant, Ripley, is optional; your own Claude or ChatGPT can do the work.

Give Your AI Only the SharePoint Folders It Should Read

Sync chosen SharePoint libraries into scoped Fastio workspaces and connect Claude or ChatGPT read-only over MCP. Monthly plans include a 14-day trial, and a card is required.

Start a 14-Day Trial

Fastio governs access by organization, workspace and share, and meters AI work in credits on top of a plan price.

Every workspace member sees its contents according to their role, and a share gives an outside party, such as a lender's counsel, a subset of files without workspace membership. The Enterprise plan adds administrative policies, legal holds, security alerts and a SIEM audit stream. Fastio's detailed activity log records changes such as uploads, edits, moves and deletions, plus permission and membership changes. It doesn't record views, opens or downloads, so don't plan on it as a record of who read a file.

The Enterprise plan costs $199.99 a month or $1,999 a year and includes 30 seats, with extra seats at $1 per seat per month up to 200, plus 25 TB of storage, 3,000,000 credits a month and 200 workspaces. Starter costs $9.99 a month with 3 seats and 5 workspaces, and Business $49.99 a month with 10 seats and 50 workspaces; since each scope is a workspace, that count matters.

Credits pay for AI work: chat, file ingestion and indexing, agent runs and document processing. Storage, bandwidth and seats come with the plan and aren't charged in credits. Credit overage is $10 per 100,000 credits. Monthly plans can be trialed for up to 14 days or until the included trial credits run out, whichever comes first; a card is required, and annual plans have no trial. See pricing for current details.

1. List the scopes. For each AI use case, write down the people and the SharePoint folders the AI may read, such as active deal memos or the controllers' close files.
2. Create one workspace per scope and add only the people in that scope.
3. Link OneDrive for Business in Cloud Sync from an owner account that can open those libraries, pick the folders, and choose one-way sync when SharePoint must stay unchanged.
4. Connect Claude or ChatGPT to Fastio with OAuth, choose Read Only, and select only that person's scoped workspaces. Give headless agents a scoped API key.
5. Turn off or unassign the native SharePoint connector for these users so the scoped workspace is the only route.
6. Test with a real account. Ask the AI for a document inside the scope and one outside it, and confirm it finds only the first.
7. Review membership when a deal closes or a team changes, and revoke connections under Settings, Devices & Agents, Connected Devices when someone leaves.