Microsoft Drive (SharePoint)

Prerequisites

Use a Microsoft Entra tenant and an account able to register applications. Review the official Microsoft Graph SharePoint resource, app registration guide, and Entra app registrations. Choose a multi-tenant account type for a public SaaS and single tenant for an internal deployment.

Self-hosted setup

1. Create or open a Web app under Microsoft Entra admin center → App registrations.
2. Add the exact Web redirect URI https://<your-authlane-host>/api/v1/oauth/microsoft-sharepoint/callback under Authentication.
3. Under API permissions, add the delegated Microsoft Graph permissions for the policy below.
4. Grant administrator consent when required. SharePoint permissions are commonly restricted by tenant policy even when Microsoft marks user consent as possible.
5. Create a client secret and copy its Value immediately; the value is shown only once.

The same Entra app may serve Mail, Calendar, and SharePoint if it contains all three exact callbacks and their union of delegated Graph permissions.

Configure authentication

Open Dashboard → Services → Microsoft Drive (SharePoint). Set Client ID to the Entra Application (client) ID, set Client Secret to the new secret Value, select read_only or full, and enable the service. Authlane encrypts the secret server-side.

Scopes

Full policy requests:

• offline_access
• openid
• profile
• User.Read
• Files.ReadWrite.All
• Sites.ReadWrite.All

Read-only policy replaces the last two scopes with Files.Read.All and Sites.Read.All. These are delegated permissions: tools operate as the connected user and cannot exceed that user's access. Review the current Microsoft Graph permissions reference before granting consent.

Execution path

Microsoft lists OneDrive/SharePoint servers in the Agent 365 MCP catalog, but those Frontier endpoints are not credential-compatible with an ordinary delegated Graph connection. They require an Agent 365 blueprint, separate MCP audience and per-server permission, plus tenant-admin setup. The local Authlane adapter therefore calls the GA https://graph.microsoft.com/v1.0 sites, drives, items, permissions, and sharing APIs directly from the SaaS runtime. Normal file bytes, tool arguments, and Graph responses never pass through Authlane. Explicit administrator Sandbox runs use the identical local adapter for testing.

Available tools

• microsoft_sharepoint_search_sites
• microsoft_sharepoint_get_site
• microsoft_sharepoint_list_drives
• microsoft_sharepoint_get_drive
• microsoft_sharepoint_list_items
• microsoft_sharepoint_get_item
• microsoft_sharepoint_download_file
• microsoft_sharepoint_list_permissions
• microsoft_sharepoint_create_folder
• microsoft_sharepoint_upload_file
• microsoft_sharepoint_update_item
• microsoft_sharepoint_move_item
• microsoft_sharepoint_copy_item
• microsoft_sharepoint_create_sharing_link
• microsoft_sharepoint_invite_users
• microsoft_sharepoint_delete_item
• microsoft_sharepoint_delete_permission

Read-only policy exposes discovery, metadata, download, and permission-list tools. Write and delete actions retain MCP risk metadata so the host can require human approval or disable them.

Connection lifecycle

Authlane encrypts the OAuth credential, refreshes access when possible, and exposes effective status. The Microsoft Graph migration marks old Microsoft connections expired and removes their legacy credential so each user must reconnect once. Policy changes also require fresh consent.

Troubleshooting

• AADSTS50011 means the exact redirect URI is missing from the Entra Web platform.
• Confirm the user can open the target SharePoint site or drive in Microsoft 365.
• Check that Client ID and client secret Value belong to the same non-expired app credential.
• If Graph returns 403, verify both delegated scopes, tenant admin consent, and the user's own site permissions.