"Analyze data, create presentations, write documents and manage your inbox with Claude." The promise is accurate, but it covers two very different mechanisms: Office add-ins that read and edit your files, and a Microsoft 365 connector that is read-only. The permissions, subscriptions and data flows are not the same.
The Claude add-ins for Excel, PowerPoint, Word and Outlook appear as a side panel. Claude reads the open file or message and, depending on the app, edits it directly. The Microsoft Marketplace listing says it plainly: the add-in can read and modify the document and send data over the internet. They require a paid subscription (Pro, Max, Team or Enterprise).
The Microsoft 365 connector in Claude is different: from Claude, it queries your content in Outlook, OneDrive, SharePoint, Teams and calendars. It is available on all plans, including Free, but requires a work account tied to a Microsoft Entra tenant and admin consent. It uses delegated permissions and is read-only: Claude only sees what the user can already see, and creates, modifies, deletes or sends nothing.
In the app, on the open file or message. Paid plan. Read and edit. Email drafted, not sent. To produce and edit.
In Claude, on the tenant. All plans, Entra consent. Read-only, per the user's rights. To search and summarise.
With the add-ins, the needed content is sent to Claude's infrastructure. Anthropic states that add-in inputs and outputs are deleted from its backend within 30 days, with exceptions. Importantly, these add-ins are currently not included in Enterprise audit logs or the Compliance API. With the connector, files stay in the tenant at rest and are not cached, but to answer, Claude receives and processes the excerpts, and results may be retained with a saved conversation.
Installing from Marketplace does not guarantee data stays in the Union. For its commercial products, Anthropic states traffic may be routed to countries in the US, Europe, Asia and Australia, with default storage in the US. GDPR compliance, data residency and sovereignty are three distinct things.
Decide independently for the add-ins and the connector. Start with a pilot on low-sensitivity data.
Fix overly broad SharePoint, OneDrive and shared-mailbox rights before enabling cross-tenant search.
Disable cross-app work by default, define forbidden categories, check the DPA, sub-processors and international transfers.
Human validation before any email is sent or document shared, and a token-revocation procedure.
Molderez Consult SRL maps the Microsoft 365 and Claude flows, reviews permissions and contracts, and defines a usage policy tailored to your data.
Frame my rolloutTransparence : cet article a été rédigé avec l'aide de l'intelligence artificielle, puis relu par Molderez Consult SRL. Information générale, vérifiée le 17 juin 2026 ; les fonctionnalités et conditions peuvent évoluer.