Microsoft 365 MCP Server

create-upload-session

create-upload-session

Destructive

Creates a pre-authenticated upload URL for large files in OneDrive or SharePoint, letting callers PUT bytes directly without size limits.

Instructions

Create an upload session.

💡 TIP: For large file uploads (no size limit, and no minimum unlike the Outlook attachment session). Returns a pre-authenticated uploadUrl; the caller PUTs the bytes there itself. This server does not perform the PUT. For new files use path: /items/{parentId}:/{fileName}:/createUploadSession. Body (optional): { item: { '@microsoft.graph.conflictBehavior': 'rename' } }.

Input Schema

Name	Required	Description
`body`	Yes
`confirm`	No	For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly approved this action. When the gate is on, calls without confirm: true return { error: "confirmation_required" } without touching user data.
`driveId`	Yes	Value for the 'driveId' path segment. Pass it under the name 'driveId', not as 'id'. Use the 'id' field of the drive object as returned by Microsoft Graph.
`driveItemId`	Yes	Value for the 'driveItemId' path segment. Pass it under the name 'driveItemId', not as 'id'. Use the 'id' field of the drive item object as returned by Microsoft Graph.
`includeHeaders`	No	Include response headers (including ETag) in the response metadata
`excludeResponse`	No	Exclude the full response body and only return success or failure indication

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.176.1Oct 29, 2026

changedInput schema / properties / body / properties / item / anyOf

Previous value: -[
-  {
-    "additionalProperties": true,
-    "properties": {
-      "description": {
-        "description": "Provides a user-visible description of the item. Read-write. Only on OneDrive Personal.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "driveItemSource": {
-        "additionalProperties": true,
-        "properties": {
-          "application": {
-            "enum": [
-              "teams",
-              "yammer",
-              "sharePoint",
-              "oneDrive",
-              "stream",
-              "powerPoint",
-              "office",
-              "loki",
-              "loop",
-              "other",
-              "unknownFutureValue"
-            ],
-            "type": "string"
-          },
-          "externalId": {
-            "description": "The external identifier for the drive item from the source.",
-            "type": [
-              "string",
-              "null"
-            ]
-          }
-        },
-        "type": "object"
-      },
-      "fileSize": {
-        "description": "Provides an expected file size to perform a quota check before uploading. Only on OneDrive Personal.",
-        "type": [
-          "number",
-          "null"
-        ]
-      },
-      "fileSystemInfo": {
-        "additionalProperties": true,
-        "properties": {
-          "createdDateTime": {
-            "anyOf": [
-              {
-                "description": "The UTC date and time the file was created on a client.",
-                "format": "date-time",
-                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The UTC date and time the file was created on a client."
-          },
-          "lastAccessedDateTime": {
-            "anyOf": [
-              {
-                "description": "The UTC date and time the file was last accessed. Available for the recent file list only.",
-                "format": "date-time",
-                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The UTC date and time the file was last accessed. Available for the recent file list only."
-          },
-          "lastModifiedDateTime": {
-            "anyOf": [
-              {
-                "description": "The UTC date and time the file was last modified on a client.",
-                "format": "date-time",
-                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The UTC date and time the file was last modified on a client."
-          }
-        },
-        "type": "object"
-      },
-      "mediaSource": {
-        "additionalProperties": true,
-        "properties": {
-          "contentCategory": {
-            "enum": [
-              "meeting",
-              "liveStream",
-              "presentation",
-              "screenRecording",
-              "story",
-              "profile",
-              "chat",
-              "note",
-              "comment",
-              "unknownFutureValue"
-            ],
-            "type": "string"
-          }
-        },
-        "type": "object"
-      },
-      "name": {
-        "description": "The name of the item (filename and extension). Read-write.",
-        "type": [
-          "string",
-          "null"
-        ]
-      }
-    },
-    "type": "object"
-  },
-  {
-    "additionalProperties": true,
-    "properties": {},
-    "type": "object"
-  }
-]New value: +[
+  {
+    "additionalProperties": true,
+    "properties": {
+      "description": {
+        "description": "Provides a user-visible description of the item. Read-write. Only on OneDrive Personal.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "driveItemSource": {
+        "additionalProperties": true,
+        "properties": {
+          "application": {
+            "enum": [
+              "teams",
+              "yammer",
+              "sharePoint",
+              "oneDrive",
+              "stream",
+              "powerPoint",
+              "office",
+              "loki",
+              "loop",
+              "other",
+              "unknownFutureValue"
+            ],
+            "type": "string"
+          },
+          "externalId": {
+            "description": "The external identifier for the drive item from the source.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "fileSize": {
+        "description": "Provides an expected file size to perform a quota check before uploading. Only on OneDrive Personal.",
+        "type": [
+          "number",
+          "null"
+        ]
+      },
+      "fileSystemInfo": {
+        "additionalProperties": true,
+        "properties": {
+          "createdDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was created on a client.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "lastAccessedDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was last accessed. Available for the recent file list only.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "lastModifiedDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was last modified on a client.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "mediaSource": {
+        "additionalProperties": true,
+        "properties": {
+          "contentCategory": {
+            "enum": [
+              "meeting",
+              "liveStream",
+              "presentation",
+              "screenRecording",
+              "story",
+              "profile",
+              "chat",
+              "note",
+              "comment",
+              "unknownFutureValue"
+            ],
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "name": {
+        "description": "The name of the item (filename and extension). Read-write.",
+        "type": [
+          "string",
+          "null"
+        ]
+      }
+    },
+    "type": "object"
+  },
+  {
+    "additionalProperties": true,
+    "properties": {},
+    "type": "object"
+  }
+]

Addedv0.134.4Jul 28, 2026
Removedv0.131.2Jul 18, 2026

Changed1 schema field changedv0.131.1Jul 11, 2026

addedInput schema / properties / confirm

Added value: +{
+  "description": "For destructive operations when the confirm gate is enabled (MS365_MCP_REQUIRE_CONFIRM=true; off by default). Set to true only after the user has explicitly approved this action. When the gate is on, calls without confirm: true return { error: \"confirmation_required\" } without touching user data.",
+  "type": "boolean"
+}

Changed4 schema fields changedv0.125.0Jun 18, 2026

removedInput schema / properties / body / properties / item / additionalProperties
```
Removed value: -true
```

addedInput schema / properties / body / properties / item / anyOf

Added value: +[
+  {
+    "additionalProperties": true,
+    "properties": {
+      "description": {
+        "description": "Provides a user-visible description of the item. Read-write. Only on OneDrive Personal.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "driveItemSource": {
+        "additionalProperties": true,
+        "properties": {
+          "application": {
+            "enum": [
+              "teams",
+              "yammer",
+              "sharePoint",
+              "oneDrive",
+              "stream",
+              "powerPoint",
+              "office",
+              "loki",
+              "loop",
+              "other",
+              "unknownFutureValue"
+            ],
+            "type": "string"
+          },
+          "externalId": {
+            "description": "The external identifier for the drive item from the source.",
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "fileSize": {
+        "description": "Provides an expected file size to perform a quota check before uploading. Only on OneDrive Personal.",
+        "type": [
+          "number",
+          "null"
+        ]
+      },
+      "fileSystemInfo": {
+        "additionalProperties": true,
+        "properties": {
+          "createdDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was created on a client.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The UTC date and time the file was created on a client."
+          },
+          "lastAccessedDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was last accessed. Available for the recent file list only.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The UTC date and time the file was last accessed. Available for the recent file list only."
+          },
+          "lastModifiedDateTime": {
+            "anyOf": [
+              {
+                "description": "The UTC date and time the file was last modified on a client.",
+                "format": "date-time",
+                "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The UTC date and time the file was last modified on a client."
+          }
+        },
+        "type": "object"
+      },
+      "mediaSource": {
+        "additionalProperties": true,
+        "properties": {
+          "contentCategory": {
+            "enum": [
+              "meeting",
+              "liveStream",
+              "presentation",
+              "screenRecording",
+              "story",
+              "profile",
+              "chat",
+              "note",
+              "comment",
+              "unknownFutureValue"
+            ],
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "name": {
+        "description": "The name of the item (filename and extension). Read-write.",
+        "type": [
+          "string",
+          "null"
+        ]
+      }
+    },
+    "type": "object"
+  },
+  {
+    "additionalProperties": true,
+    "properties": {},
+    "type": "object"
+  }
+]

removedInput schema / properties / body / properties / item / properties
```
Removed value: -{}
```
removedInput schema / properties / body / properties / item / type
```
Removed value: -"object"
```

Addedv0.114.0May 28, 2026
Removedv0.112.2May 22, 2026
Addedv0.110.0May 18, 2026
Removedv0.108.0May 15, 2026
Addedv0.96.0May 4, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses the critical non-obvious behavior that the server only mints the uploadUrl and does NOT perform the PUT — the caller must upload the bytes itself. That goes well beyond the annotations (readOnlyHint=false, destructiveHint=true, openWorldHint=true) and prevents a common misuse pattern.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the first sentence, followed by a tight set of tips that each carry distinct information (size behavior, return value, caller responsibility, body example). No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nested-body upload-session tool with no output schema, the description covers the return value, who performs the byte transfer, sibling differentiation, and a usable body template. Upload session expiry is unmentioned but is minor relative to what is supplied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 83%, so the baseline is 3; the description adds a concrete body shape ({ item: { '@microsoft.graph.conflictBehavior': 'rename' } }) and a path-construction hint for new files, which is real value beyond the schema. Minor issue: it calls the body "(optional)" while the schema marks it required, which could mislead an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Create an upload session") and immediately clarifies the return contract (a pre-authenticated uploadUrl). It differentiates from the Outlook/calendar attachment session siblings by noting the lack of size limits and minimums, so an agent can pick it out of a large sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context: use for large file uploads, and unlike the Outlook attachment session there is no size limit or minimum. It does not explicitly route small uploads to the sibling upload-file-content, and never states when not to use this tool, so it stops short of full when/when-not/alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

create-upload-session

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools