[BUG] claude-for-msft-365-install connects to bedrock but doesnt support AU region models

Bug report — Claude for Microsoft 365 add-in: 400 The provided model identifier is invalid in AU Bedrock

Filed: 2026-05-16 Severity: Pilot-blocking (AU customers) Add-in build: 8d8ce3c9ad29c1f96a339a407e22e9a0b350789a Office host: PowerPoint Win32 16.01 build 19 (en-US); same in Word / Excel Cloud provider: AWS Bedrock direct ("Connect another way → Bedrock") Region: ap-southeast-2 (Sydney)

Related to:

https://support.claude.com/en/articles/13945233-use-claude-for-microsoft-365-with-third-party-platforms (Document highlights we can use the plugins in AWS Bedrock)

Document also incorrectly calls out the setup as:

claude plugin marketplace add anthropics/financial-services-plugins
claude plugin install claude-in-office@financial-services-plugins
/claude-in-office:setup

It is actually

/plugin marketplace add anthropics/financial-services
/plugin install claude-for-msft-365-install@claude-for-financial-services
/claude-for-msft-365-install:setup

Summary

The Claude for Microsoft 365 add-in fails on first model invocation with 400 The provided model identifier is invalid against bedrock-runtime.ap-southeast-2.amazonaws.com. Authentication (Entra OIDC → STS AssumeRoleWithWebIdentity → temporary Bedrock credentials) succeeds end-to-end. The failure is solely on the Bedrock model-identifier validation step: the add-in is sending a us.anthropic.* / foundation-model-shape identifier that does not resolve in AU regions.

Repro

1. Install Claude for Microsoft 365 via the claude-for-msft-365-install:setup wizard.
2. Configure Bedrock direct, region ap-southeast-2.
3. Hand-fix the wizard's IAM inline policy from us.anthropic.* → `au.anthropic.* (au.anthropic.* is for data residancy governance and compliance)
4. Paste role ARN + region into the add-in's Bedrock dialog, click Continue.

Observed error

Claude for Office connection failed (Bedrock)
Build: 8d8ce3c9ad29c1f96a339a407e22e9a0b350789a
400 The provided model identifier is invalid.
Request:
aws_role_arn: arn:aws:iam::01XXXXXXXXX1:role/ClaudeBedrockAccess
  aws_region:   ap-southeast-2
Manifest params:
  _host_Info: Powerpoint$Win32$16.01$en-US$$$$19
Bootstrap response: (not called)

Root cause

In ap-southeast-2, every Anthropic Claude 4-x model has inferenceTypesSupported = [INFERENCE_PROFILE] only — ON_DEMAND invocation of the foundation-model ID is not supported, and us.* cross-region profiles do not exist at the Sydney endpoint. The only invokeable form is the au.* cross-region inference profile (e.g. au.anthropic.claude-sonnet-4-6). The add-in's Bedrock client appears to send a US-shape identifier regardless of the configured region.

Verified independently with aws bedrock list-foundation-models --region ap-southeast-2 --by-provider anthropic and aws bedrock list-inference-profiles --region ap-southeast-2 — the au.* profiles in our account are ACTIVE and invoke correctly via the AWS CLI and via Cowork desktop (which uses the same Bedrock endpoint with the same role).

No viable customer-side workaround

• Add-in dialog accepts only role ARN + region — no model override.
• update-user-attrs (Graph extension attributes) exposes only aws_role_arn, aws_region, gateway_url, gateway_token. No model key.

Requested fix

1. Have the add-in's Bedrock client send au.anthropic.* (and analogous eu.* / apac.*) cross-region inference-profile IDs when the configured region requires them.
2. Fix the wizard's IAM policy template to derive the geographic prefix (us.* / eu.* / au.* / apac.*) from the selected region instead of hardcoding us.anthropic.*.
3. Optionally: expose a model / default_model key via update-user-attrs so customers can override per user without deploying a bootstrap endpoint.