Why does Microsoft see M365 connector requests as coming from Anthropic's IP rather than the user's location?
Why does Cowork's connector architecture route API calls through the server side rather than having the user's device connect directly?
Mechanically, how does a Conditional Access policy evaluate and Block connector traffic?
What's the practical impact on how an enterprise IT or security team designs policy?
The security team followed standard procedure and set a Conditional Access rule on the Microsoft 365 connector: only allow requests from the company VPN or office network range. It's their routine approach for every enterprise application, and on paper it should be airtight. The moment the policy went live, everyone's Cowork connector dropped at once — including employees sitting in the office, genuinely connected to the company VPN.
The rule wasn't written wrong. The problem is an easily-overlooked architectural fact: Conditional Access checks where a request's network location comes from, and an M365 connector's requests never come from an employee's computer in the first place.
The official security guide states it plainly: "server-side requests always appear to come from Anthropic's IP range." When you use the M365 connector in Cowork to search email or read a SharePoint document, the actual API call isn't made by your desktop's browser — it's Anthropic's backend servers calling the Microsoft Graph API on your behalf. From Microsoft's side, the source IP of that request is always within Anthropic's server range, entirely independent of where you personally are or what network you're on.
This means any Conditional Access rule based on location or network is inherently ineffective against connector requests — not because the rule was misconfigured, but because that entire category of rule assumes the request originates from the user's device, and the connector architecture was never built to work that way. MFA and group-based policies remain unaffected, since those check the user's identity itself rather than network location.
If an ineffective rule simply let the connector keep working as normal, the worst-case outcome would be a missing layer of defense — not an emergency. The reality is often worse: since all connector traffic shares the same Anthropic IP range, if the company's Conditional Access rule is set to Block (rather than simply ignore) anything outside the corporate network, the entire organization's M365 connector goes down all at once — not one employee losing access, but everyone using that connector disconnecting simultaneously. And the symptoms look exactly like "the connector itself is broken," which tends to send IT teams troubleshooting in the wrong direction.
On the permissions side, the connector can only see content the user already has permission to access — it cannot bypass SharePoint sharing settings or folder permissions, and it cannot see other users' private files or emails. Delegated access to shared mailboxes is allowed, but read-only. This means the connector isn't an additional access channel — it's an extension of the user's existing permissions, a point often misunderstood as "the connector has its own separate permission system."
Another easily-misjudged detail is the Online Archive mailbox: the official documentation notes that "email search covers each user's primary mailbox... and any shared mailboxes they can access. It doesn't cover the separate Online Archive mailbox." If a company has a mail retention policy that automatically moves old messages into an archive mailbox, those messages become unsearchable afterward — users typically assume the connector missed an email, when in fact it was never within the connector's searchable scope to begin with. Device compliance policies have a similar timing quirk: compliance is evaluated against the device that originally established the connection, not the device currently in use, so a non-compliant device usually doesn't get blocked at connection time — it fails on the first tool call instead, a delay that makes troubleshooting harder to line up with when the actual problem occurred.
If you're the one responsible for setting enterprise connector policy, the real fix here isn't writing stricter rules — it's first understanding which category of Conditional Access rule actually makes sense for connector architecture: the identity layer (MFA, group membership, device compliance) is a meaningful control point, while the network-location layer is meaningless for connector requests and will only produce confusing outages if applied. If you're already troubleshooting a sudden, organization-wide connector outage, the first thing to check is whether any IP- or location-based policy has been applied to that connector — not the connector's own health status.