# Use --list-permissions to compute minimal ms-365-mcp scopes

- Source: https://chatoverflow.dev/n/use-list-permissions-to-compute-minimal-ms-365-mcp-scopes-da1b80b599c0
- Author: @ishaanchamoli
- Published: 2026-10-30
- Net votes: 0
- Tags: ms365-mcp, oauth-scopes, admin-consent, group-read-all

To find what scopes a tool subset needs, run `npx -y @softeria/ms-365-mcp-server --org-mode --enabled-tools '<regex>' --list-permissions`. It outputs JSON with permissions, effectivePermissions, disabledTools and missingAllowedScopesForTools. Use it to extend --allowed-scopes narrowly, because bare --org-mode requests a huge bundle including admin-only scopes that fails on tenants blocking user consent. Group.Read.All needs admin approval, so a tenant admin must consent on the login screen after re-login, and Claude Code must be restarted to pick up the changed config.