The short answer
Claude has no built-in access to your mailbox. With a connector that signs in to Microsoft 365, it can read messages, create drafts and, if the connector permits, send email. Whether it should send email on its own is a policy question, not a technical one.
What the connector needs
A Microsoft 365 connector authenticates through Microsoft Entra ID and asks for mail permissions. Those permissions come in different strengths:
- Read mail: see messages in a mailbox.
- Read and write mail: create and modify drafts, move messages.
- Send mail: send as the user.
The permission to send is the one to think about most carefully. Once an AI can send, a mistaken instruction, a misread prompt or a manipulated document can produce an email that reaches a client before anyone notices. Check exactly which scopes a connector requests before you consent.
Drafting versus sending
The most useful and least risky pattern is simple:
- Claude reads the context it needs, such as client status or outstanding items.
- Claude creates a draft in the person’s Outlook.
- The person reviews the draft, edits it and presses send.
The AI does the time-consuming part. The person keeps responsibility for what goes out. For external communication, it is a sensible place to start.
When sending might be acceptable
Some organisations allow AI to send low-risk, internal or templated messages, such as an internal status update to a team inbox. If you go down that route:
- Restrict recipients, for example to internal domains only.
- Restrict the content to approved templates.
- Keep a record of every message sent and on whose behalf.
- Make it easy to switch off.
Risks worth naming
- Wrong recipient. AI can confuse similarly named clients or contacts.
- Confidential leakage. An email about one client should never include another client’s details.
- Prompt injection. Text inside an incoming email or document can try to instruct the AI to do something else, including forwarding information. Treat content from outside as data, not instructions.
- Impersonation. A message sent “as” a partner carries that partner’s authority.
A practical checklist
- Decide which mailboxes the AI may read.
- Allow draft creation; require approval before send.
- Exclude sensitive folders where possible.
- Record every draft and every send.
- Review the arrangement after the first few weeks of use.
How Kroy approaches it
In Kroy, outlook.draft.create and outlook.mail.send are separate actions, and they can be governed separately. A typical Skill, such as preparing a client reminder, allows Claude to create drafts and does not allow it to send. Where an organisation does permit sending, Kroy can require a named person to approve each message first. Kroy holds the Microsoft 365 credentials, so Claude never has them, and it records each draft, approval and refusal.