As we recently announced, the SharePoint MCP (now in preview) make SharePoint expertise available to Work IQ through an authenticated MCP endpoint hosted by SharePoint. Its coverage includes lists and libraries, list items, files and folders, search, approvals, rules, Quick Steps, the recycle bin and versioning. The catalog contains more than 60 SharePoint operations, but an agent does not need to register or expose every operation as a separate tool. Work IQ presents a fixed grammar of generic tools and discovers the SharePoint paths it needs at runtime. The key sequence is search_paths to discover a matching operation, get_schema to inspect its arguments, and do_action to invoke the returned path with a request body. This runtime discovery keeps the agent’s tool surface compact while allowing the available SharePoint capabilities to grow behind it. The SharePoint provider handles paths under its registered sharepoint/ prefix. Calls run under the signed-in caller’s SharePoint identity, so an agent can only read or change what that user is already allowed to access. Site-aware operations typically use an opaque siteKey, not a raw site URL: agents can call get_site_key once for the site and pass the returned key unchanged to subsequent operations. Write operations use SharePoint’s internal field names, so resolve people, lookup and taxonomy values according to the schema rather than assuming display names will be accepted.

Let’s see how an agent interacts with the SharePoint MCP Tools in Work IQ

From a practical perspective, an agent can first establish the site context, then discover a search or list operation to find a meaningful document or content. The specific path and arguments depend on the actual flow, but here is an hypothetical flow:

1. get_site_key(siteUrl: "https://contoso.sharepoint.com/sites/project")
   → keep the returned siteKey for this site

2. search_paths(...)
   → discover the SharePoint path for the needed operation

3. get_schema(path: "<path returned by search_paths>")
   → inspect the required arguments and their types

4. do_action(
     "<discovered SharePoint path>",
     body: {
       siteKey: "<opaque key from get_site_key>",
       ...arguments shaped by get_schema...
     }
   )

Agents can use the schema returned by get_schema to construct the body of the do_action request. They do not need to guess optional fields or translate display labels into internal values. In the Work IQ generic-tool contract, arguments such as items, folders or viewIds may be represented as a JSON-encoded string rather than a nested object. Agents, can dynamically follow the returned schema exactly and keep site keys scoped to the site for which they were minted.

The returned data depends on the selected operation. A search operation could return matching pages, files, list items, or other SharePoint resources together with identifiers and URLs that the agent can use in later calls.

Security Model for SharePoint MCP tools in Work IQ

Security is always a fundamental component of any software architecture. In Work IQ, we are introducing two new permission scopes, WorkIQ.Read and WorkIQ.Act, to provide greater granularity when fine-tuning permissions. The provider for SharePoint tools in Work IQ aligns with these new scopes. This means that your agent MUST have either WorkIQ.Read or WorkIQ.Act to access SharePoint Tools in Work IQ.

Agents with only the WorkIQ.Read permission scope will receive a reduced set of top-level Work IQ verb tools: fetch, call_function, get_schema, and search_paths , which align to non-mutating operations. Agents with WorkIQ.Act permission scope will receive the full set of tools.

Both are delegated permission scopes, in accordance with the Work IQ security model, where every operation is done on behalf of a user and is therefore limited to the actions that the user is already authorized to perform.

Build your intelligent agents with Work IQ

Try the SharePoint’s discover-and-act flow when your agent needs to work with site content or operations. Experiment, inspect the returned schemas and data, and see how these new tools can help you build more powerful agents.

For more insights about Work IQ, join us at Microsoft Ignite in San Francisco, November 17–20, 2026. Watch the Microsoft Ignite site for event details and roadmap updates, and bring your questions about the future of Work IQ.

Useful links

Here you can find some useful links:

• SharePoint Tools for Work IQ | Microsoft Learn
• Learn more about Microsoft Ignite