Microsoft 365 connector missing Graph scope: MailboxSettings.ReadWrite

### What happened?

Creating an Outlook category or inbox rule through the M365 connector fails with a 403, even after disconnecting and reconnecting the connector (no new consent screen appeared on reconnect, so the scope was never re-requested).

Error: "requires the 'MailboxSettings.ReadWrite' delegated permission... not admin-consented on the confidential client app registration"
Tenant ID: 12acfe5d-3dce-4920-9266-831ef451a3fe
Client ID: 07c030f6-5743-41b7-ba00-0a6e85f37c17 (not found as a service principal in our Enterprise Applications, so it appears never provisioned)
Affected tools: outlook_create_label, outlook_create_filter
Everything else in the connector (mail search/read, etc.) works fine.

### What did you expect to happen?

Expected behavior: Since I'm signed in as the Microsoft 365 tenant admin, calling outlook_create_label or outlook_create_filter should either succeed outright, or, if the connector's confidential client app doesn't yet have the MailboxSettings.ReadWrite scope, reconnecting the Microsoft 365 connector should present a fresh Microsoft consent screen listing that scope so it can be granted (the way it apparently does for other write scopes like Mail.Send or Calendar). Instead, reconnecting produced no new consent screen at all, and the app that actually calls Graph for mail isn't provisioned as a service principal in the tenant, so there's no way for an admin to grant the permission from either Entra or Claude's own connector settings.

### Steps to reproduce

Steps to reproduce:

Connect the Microsoft 365 connector in Claude as a Microsoft 365 tenant admin.
Ask Claude to create an Outlook category, or call outlook_create_label directly with any displayName.
Observe a 403 FORBIDDEN response citing a missing MailboxSettings.ReadWrite delegated permission on the confidential client app registration.
Same result calling outlook_create_filter (create inbox rule), citing the same missing scope.
As tenant admin, search Microsoft Entra > Enterprise Applications for the client ID named in the error (07c030f6-5743-41b7-ba00-0a6e85f37c17), scoped to the tenant, application type = Enterprise Applications: zero results, meaning that app has no service principal in the tenant at all, so there's nothing to grant admin consent to.
Disconnect and reconnect the Microsoft 365 connector from Claude's connector settings, expecting a fresh Microsoft OAuth consent screen requesting the missing scope: none appears, reconnect completes silently, and steps 2-4 fail identically afterward.

Other Microsoft 365 connector tools (mail search/read, etc.) work normally throughout, so this is isolated to write operations that touch mailbox settings (categories, inbox rules).

### Area

OAuth / Authentication

### MCP Server (if applicable)

Microsoft 365 (shows up in Entra as "M365 MCP Server for Claude"

### Error messages or logs

```shell
{
"code": "FORBIDDEN",
"message": "FORBIDDEN: Graph denied access; this tool requires the 'MailboxSettings.ReadWrite' delegated permission. The hosted OBO path requests '.default', so 'MailboxSettings.ReadWrite' may not be admin-consented on the confidential client app registration (see docs/entra-auth.md, Step 1 > API permissions), or the signed-in user lacks permission to the target resource. caused by: FORBIDDEN: Graph API Error: Access is denied. Check credentials and try again.",
"details": {
"graphErrorCode": "ErrorAccessDenied",
"graphStatusCode": 403,
"tenantId": "12acfe5d-3dce-4920-9266-831ef451a3fe",
"clientId": "api://07c030f6-5743-41b7-ba00-0a6e85f37c17",
"userObjectId": "955319b4-a7b8-4814-88be-0a0fbaaacd99",
"userPrincipalName": "Chris@marlboroughlawfirm.com"
}
```

### Additional context

Identical on both outlook_create_label and outlook_create_filter calls, and identical again after reconnecting):

the error message references internal documentation (docs/entra-auth.md, Step 1 > API permissions)

Start with docs/entra-auth.md at Step 1, API permissions, then trace the OAuth flow used by outlook_create_label and outlook_create_filter. Reproduce the 403 and reconnect behavior with the Microsoft 365 connector; done means the required MailboxSettings.ReadWrite consent path is available and both tools no longer fail for that missing scope.

Scritto dal modello di indicizzazione a partire dal testo della issue.