dtwo Policy Store

Ms365 policies

Policies (8)

About these policies

Reusable DTwo policies for Microsoft 365 MCP servers, targeting the softeria ms-365-mcp-server tool vocabulary (the de-facto full-capability community server, ~200+ Graph-derived tools covering Outlook mail, Calendar, Teams, SharePoint/OneDrive, Excel, and directory operations). Because a single suite connector spans email, files, chat, spreadsheets, and the Entra directory — plus a raw Graph passthrough (graph-batch) that can reach any endpoint the token allows — its blast radius is the largest of any app in this catalog: one compromised or prompt-injected agent session can exfiltrate mail, mint anonymous share links, plant BEC persistence rules, and mutate group membership through one connection.

Available policies

Policy Direction Purpose Framework bundles
deny-graph-batch ingress Deny the raw graph-batch Graph passthrough — the escape hatch that bypasses every per-tool policy — for everyone outside the m365-admin group. —
freeze-destructive-ops ingress Deny every delete-* / cancel-* tool call (mail, files, groups, calendar, lists) unless the caller is in the m365-admin group. sox, soc2, hipaa, gdpr-ccpa
freeze-identity-plane ingress Deny group/team membership, ownership, and directory mutations for everyone outside the iam-admins group; identity reads fail closed. —
guard-external-send ingress Deny send-class mail tools (send, reply, forward, drafts, shared mailbox) when any visible recipient is outside the corporate-domain allowlist; external-comms group exempt. soc2, hipaa, gdpr-ccpa
guard-mailbox-persistence ingress Unconditionally deny the BEC persistence surface: mail-rule creation/update, mailbox-settings changes, and Graph change-notification subscriptions (webhooks). No exemptions. —
guard-share-links ingress Downgrade anonymous share links to organization scope, inject a 7-day expiry when missing, deny anonymous edit links outright, and deny sharing invitations to external recipients (collab-admins exempt). soc2
redact-pii-egress egress Redact PII (SSN, payment card, IBAN, phone, and more) from mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and Teams messages before the response reaches the agent (transform-only). soc2, hipaa, gdpr-ccpa
role-gate-writes ingress Read-only baseline: reads pass for everyone; anything not recognizably a read (sends, creates, updates, deletes, unknown verbs) is denied unless the caller is in the m365-writers group. soc2, hipaa, pci-dss, gdpr-ccpa, sox

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway. A Microsoft 365 server registered as ms365 surfaces tools like ms365-send-mail and ms365-graph-batch, while a different registration name changes the prefix. The policies in this directory match on the suffix (-send-mail, -create-mail-rule, -graph-batch, etc.) so they stay portable across naming conventions — but you should always confirm the exact tool names your gateway sends using the dump-input debug technique before deploying. Note that name-based matching does not cover the merill/lokka server, whose single generic Graph tool carries the endpoint in its arguments; see each policy's Known limitations.

Identity claims

The group-gated policies read input.subject.claims.groups (an IdP-asserted array) and fail closed when claims are missing. The group names — m365-admin, m365-writers, iam-admins, external-comms, collab-admins — are placeholders: replace them with your IdP's group names at import time.

Compliance

Compliance note. This policy supports alignment with the cited framework controls on the MCP path only. No policy or bundle makes an organization compliant with any framework; web-UI, native-API, and in-app access are outside the gateway's reach by design. Validate against your own compliance program before relying on it.

Contributing

To add a Microsoft 365 policy:

  1. Create apps/ms365/<policy-slug>/ with policy.md and a tests.yaml test file.
  2. Add a row to the table above.
  3. Declare apps: ["ms365"] in the policy frontmatter, plus any industry / bundle slugs that apply.
  4. If the policy fits a framework bundle (e.g. bundles/soc2 or bundles/hipaa), link to it from the matching landing page.
  5. Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.