Microsoft 365 connector: write-type tools fail with "This tool is not available" from Claude Code CLI despite tool permission set to Always allow

**Summary**

Write-type tools on the managed Microsoft 365 connector (`microsoft365.mcp.claude.com`, configured via claude.ai → Settings → Connectors → Microsoft 365) consistently fail when called from Claude Code CLI, even though every other signal indicates the call should succeed.

**Environment**

- Claude Code CLI (latest)
- Remote/managed connector: Microsoft 365 (`microsoft365.mcp.claude.com`), configured through claude.ai web Settings → Connectors
- Tools affected: `sharepoint_create_folder`, `sharepoint_upload_file` (write-type). Read-type tools on the same connector (`sharepoint_folder_search`, `sharepoint_search`, `get_me`) work fine from the same CLI session.

**Steps to reproduce**

1. Connect the Microsoft 365 connector in claude.ai (Settings → Connectors → Microsoft 365) with a work/school account that has confirmed read+write access to a SharePoint document library.
2. In claude.ai → Settings → Connectors → Microsoft 365 → tool permissions, set `Sharepoint create folder` (and/or `Sharepoint upload file`) to **"Always allow"**.
3. From Claude Code CLI, call `mcp__claude_ai_Microsoft_365__sharepoint_create_folder` with a valid `driveId`/`parentItemId` (obtained from a successful `sharepoint_folder_search` call) and a folder name that does not already exist at that path.
4. Observe the call fail immediately with:
```
Streamable HTTP error: Error POSTing to endpoint: {"type":"error","error":{"type":"permission_error","message":"This tool is not available."},"request_id":"..."}
```

**What we ruled out**

- **Not an M365/Graph permission issue**: verified directly through the SharePoint web UI, logged in as the same account used by the connector — the account has full read+write access to the target document library, and creating a folder there through the browser UI succeeds instantly.
- **Not the claude.ai tool-permission toggle**: confirmed in Settings → Connectors → Microsoft 365 that `Sharepoint create folder` and `Sharepoint upload file` are already set to "Always allow" (not "Ask" or "Never"). The failure persists identically even after this was verified.
- **Not a naming/OAuth-reconnect issue**: reconnected the Microsoft 365 OAuth login (fresh interactive sign-in) between attempts; `get_me` confirms the correct account/user GUID is active both before and after. The write-tool call fails identically before and after reconnect.
- **Not a conflict error**: tested with folder names that don't already exist at the target path — the error is the generic `permission_error: This tool is not available`, not a Graph 403 or a "name already exists" conflict error, which suggests the call may not be reaching the Graph API at all.

**Expected behavior**

`sharepoint_create_folder` (and other write-type tools with permission set to "Always allow") should succeed when the underlying account has valid write access, consistent with how read-type tools on the same connector behave from the same CLI session.

**Actual behavior**

Every write-type tool call fails at what looks like a connector-gateway or client-side gate, before reaching Microsoft Graph, regardless of the account's real permissions or the claude.ai tool-permission setting.

**Additional notes**

Read-type tools work correctly in the same session/connector configuration, so the connector's OAuth session itself is valid and functional — this appears isolated to write-type tool invocation specifically from Claude Code CLI.

Happy to provide additional `request_id`s or reproduce with more logging if useful.