Microsoft SharePoint Files connection

Prerequisite

To use this connector, you must register an application in the Microsoft Azure portal and add the following API permissions:

1. In the app menu, go to API permissions.
2. Click Add a permission, then Microsoft Graph.
3. Click Delegated permissions.
4. Search for the following permissions and enable these permissions:
   1. Sites.ReadWrite.All: Required to discover, read, and write files, and to read permissions or Sites.Read.All for readonly access.
   2. AllSites.Read: Required to discover sharepoint group users.
   3. offline_access: Required to maintain access to data you have given it access to.
   4. openid: Required to sign users in.
5. Click Add permissions.
6. Click Grant admin consent for [Your Organization name] to suppress consent prompts for users.

Create a connection to Microsoft SharePoint Files

To create the connection asset, you need these connection details:

• Host: The path of the endpoint for which the server is configured in HTTP transport mode.
• Site: Name of the SharePoint site being accessed.

Credentials

• Tenant ID: The Microsoft Entra tenant ID. To find the Tenant ID, go to Microsoft Entra ID> Properties. Scroll down to the Tenant ID field. For more information, see How to find your Microsoft Entra tenant ID.
• Client ID: The client ID for authorizing access to Microsoft SharePoint. To find the Client ID for your application, select Microsoft Entra ID. From App registrations, select your application. Click Copy to copy the Client ID of your application. For more information, see Register a Microsoft Entra app and create a service principal.
• Client secret: The authentication key that is associated with the client ID for authorizing access to Microsoft SharePoint. To get the Client secret for your application, select Microsoft Entra ID. From App registrations, select your application. Go to Certificates & secrets > Client secrets. Click New client secret to create a new Client secret and copy it. For more information, see Register a Microsoft Entra app and create a service principal.
• Refresh token: The token used to obtain a new access token when the current one expires. To generate an initial refresh token, perform the following OAuth2 authorization commands:
  1. To authorize the token, run the following:

  https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize?
  client_id={client_id}&
  response_type=code&
  scope={scope}
  

  1. Exchange the returned authorization code for a token pair (access and refresh tokens) by running:

  curl --request POST \
    --url https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data client_id={client_id} \
    --data 'client_secret={client_secret}' \
    --data grant_type=authorization_code \
    --data 'code={code}' \
    --data redirect_uri={redirect_uri}
  

Limitations

• The connector only supports the OAuth2 Refresh Token authentication (Delegated authentication). It does not support Client Credentials (App-only) authentication.
• Group expansion does not work for specific groups.
  • SharePoint groups: Returns the group name but does not expand to list individual users within that group.
  • Azure AD groups: Returns the group name but does not expand members.
• When entering the Site parameter, provide the site name without using the /sites/ prefix as the field already assumes that the structure of the entry will be /sites/{site_name}.

Microsoft SharePoint Files setup

Microsoft SharePoint Files can be set up in various deployments, see Getting started with SharePoint server.

Learn more

• Microsoft SharePoint documentation
• Adding a connection to a project