Microsoft 365 MCP Server

create-upload-session

create-upload-session

Destructive

Starts a large-file upload session for Microsoft 365 drives, returning a pre-authenticated URL that callers use to PUT file bytes directly.

Instructions

Create an upload session.

💡 TIP: For large file uploads (no size limit, and no minimum unlike the Outlook attachment session). Returns a pre-authenticated uploadUrl; the caller PUTs the bytes there itself. This server does not perform the PUT. For new files use path: /items/{parentId}:/{fileName}:/createUploadSession. Body (optional): { item: { '@microsoft.graph.conflictBehavior': 'rename' } }.

Input Schema

TableJSON Schema

Name	Required	Description
`body`	Yes
`confirm`	No	For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly approved this action. When the gate is on, calls without confirm: true return { error: "confirmation_required" } without touching user data.
`driveId`	Yes	Value for the 'driveId' path segment. Pass it under the name 'driveId', not as 'id'. Use the 'id' field of the drive object as returned by Microsoft Graph.
`driveItemId`	Yes	Value for the 'driveItemId' path segment. Pass it under the name 'driveItemId', not as 'id'. Use the 'id' field of the drive item object as returned by Microsoft Graph.
`includeHeaders`	No	Include response headers (including ETag) in the response metadata
`excludeResponse`	No	Exclude the full response body and only return success or failure indication

Schema Changelog

Changes observed during successful MCP inspections.

Addedv0.134.4Jul 28, 2026
Removedv0.131.2Jul 18, 2026

Changed1 schema field changedv0.131.1Jul 11, 2026

addedInput schema / properties / confirm

Added value: +{
+  "description": "For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly approved this action. When the gate is on, calls without confirm: true return { error: \"confirmation_required\" } without touching user data.",
+  "type": "boolean"
+}

Changed4 schema fields changedv0.125.0Jun 18, 2026

removedInput schema / properties / body / properties / item / additionalProperties
```
Removed value: -true
```

addedInput schema / properties / body / properties / item / anyOf

Added value: +[
+  {
+    "additionalProperties": true,
+    "properties": {
+      "description": {
+        "description": "Provides a user-visible description of the item. Read-write. Only on OneDrive Personal.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "driveItemSource": {
+        "additionalProperties": true,
+        "properties": {
+          "application": {
+            "enum": [
+              "teams",
+              "yammer",
+              "sharePoint",
+              "oneDrive",
+              "stream",
+              "powerPoint",
+              "office",
+              "loki",
+              "loop",
+              "other",
+              "unknownFutureValue"
+            ],
+            "type": "string"
+          },
+          "externalId": {
+            "description": "The external identifier for the drive item from the source.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "fileSize": {
+        "description": "Provides an expected file size to perform a quota check before uploading. Only on OneDrive Personal.",
+        "type": [
+          "number",
+          "null"
+        ]
+      },
+      "fileSystemInfo": {
+        "additionalProperties": true,
+        "properties": {
+          "createdDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was created on a client.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The UTC date and time the file was created on a client."
+          },
+          "lastAccessedDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was last accessed. Available for the recent file list only.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The UTC date and time the file was last accessed. Available for the recent file list only."
+          },
+          "lastModifiedDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was last modified on a client.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The UTC date and time the file was last modified on a client."
+          }
+        },
+        "type": "object"
+      },
+      "mediaSource": {
+        "additionalProperties": true,
+        "properties": {
+          "contentCategory": {
+            "enum": [
+              "meeting",
+              "liveStream",
+              "presentation",
+              "screenRecording",
+              "story",
+              "profile",
+              "chat",
+              "note",
+              "comment",
+              "unknownFutureValue"
+            ],
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "name": {
+        "description": "The name of the item (filename and extension). Read-write.",
+        "type": [
+          "string",
+          "null"
+        ]
+      }
+    },
+    "type": "object"
+  },
+  {
+    "additionalProperties": true,
+    "properties": {},
+    "type": "object"
+  }
+]

removedInput schema / properties / body / properties / item / properties
```
Removed value: -{}
```
removedInput schema / properties / body / properties / item / type
```
Removed value: -"object"
```

Addedv0.114.0May 28, 2026
Removedv0.112.2May 22, 2026
Addedv0.110.0May 18, 2026
Removedv0.108.0May 15, 2026
Addedv0.96.0May 4, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate a non-read-only, potentially destructive operation. The description adds crucial behavioral context: it returns a pre-authenticated uploadUrl and the server does not perform the PUT, meaning the caller is responsible for the actual upload. This goes beyond the annotations and is essential for correct invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core purpose. The tip and path example are brief and directly useful, with no wasted words. Although it could be trimmed, every sentence adds necessary operational detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of a two-step upload process and no output schema, the description adequately explains the return value (uploadUrl) and the caller's responsibility to PUT. It also covers the path for new files and optional body. It could mention potential errors or required headers for the PUT, but the core usage is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 83% schema description coverage, most parameters are already documented in the schema. The description adds value by showing an example body with conflictBehavior and explicitly stating the body is optional. This aids in constructing correct parameters without repeating the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb and resource: 'Create an upload session.' It also differentiates from the Outlook attachment session by noting it is for large files with no size limit and no minimum, making it distinct from the sibling tool. The path example further specifies usage for new files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly contrasts with the Outlook attachment session ('unlike the Outlook attachment session'), providing a scoping condition. It also gives a concrete path for new files and notes the caller must PUT bytes, which is critical usage guidance. However, it does not explicitly state when not to use this tool beyond implying the alternative for smaller files.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

create-upload-session

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools