# Microsoft SharePoint Online SaaS Connector > SailPoint Microsoft SharePoint Online SaaS Connector Documentation # Documentation # Connecting SailPoint and Microsoft SharePoint Online SaaS To connect SailPoint with Microsoft SharePoint Online, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 9. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 10. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings To configure a direct connection between the Microsoft SharePoint Online source and SailPoint, specify the authentication type and grant type. > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. > [!NOTE] > > **JWT Certificate Credentials (Recommended)** > > The JWT Certificate Credentials method supports authentication based on a JWT assertion prepared from a certificate and private key. > > [![JWT Certificate Credentials]()]() > > 1. Select **JWT Certificate Credentials** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** of the application registered in Microsoft Entra ID. For more information, refer to [Registering an Application Using the Azure AD Portal](). > 3. Enter the valid **Certificate** details of the source created on the SharePoint Online managed system. > 4. Enter the valid **Private Key** text that is used to sign the JWT assertion and the corresponding **Private Key Password**. > 5. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 6. In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.partner.microsoftonline.cn`. > 7. Select **Save**. > [!NOTE] > > **Client Credentials (Deprecated)** > > Use the Client Credentials with the ID and Secret parameters. > > [![Client Credentials]()]() > > 1. Select **Client Credentials** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** and **Client Secret** of the source created on the SharePoint Online managed system. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](). > 3. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 4. (*Optional*) In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.accesscontrol.chinacloudapi.cn`. > 5. Select **Save**. > [!NOTE] > > **Refresh Token / Auth Code (Deprecated)** > > The Auth Code / Refresh Token grant type is a client credentials-based authentication protocol. In addition to client credentials, it uses a Refresh Token to authenticate. > > [![Refresh Token / Auth Code]()]() > > 1. Select **Refresh Token / Auth Code** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** and **Client Secret** of the source created on the SharePoint Online managed system. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](). > 3. Enter the valid **Refresh Token** obtained after registering the app with the Azure Active Directory Portal. For more information, refer to [Generating a Refresh Token](). > 4. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 5. In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.partner.microsoftonline.cn`. > 6. Select **Save**. ### OAuth 2.0 Authentication Methods The Microsoft SharePoint Online SaaS connector supports OAuth 2.0 authentication with the following grant types: > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. - JWT Certificate Credentials *(Recommended)* - Refresh Token/Auth Code *(Deprecated)* - Client Credentials *(Deprecated)* > [!NOTE] > > **JWT Certificate Credentials and Refresh Token/Auth Code** > > *Prerequisites* > > - Obtain the **Client ID** and **Client Secret** from Microsoft Entra ID by registering the application. For more information, refer to [Registering an Application Using the Azure AD Portal](). > > > **Note** > > > > It is mandatory to use the Global Admin and Admin of all Sites User in SharePoint Online to create the application in Microsoft Entra ID. > - If the grant type is **JWT**: > > The Certificate (self-signed or CA signed) must be uploaded and registered at the Azure Active Directory portal. To register the certificate with the Microsoft Identity Platform, complete the following: > > 1. Sign in to the **Azure Portal**. > 2. In the Azure app registrations for client application, select the client application. > 3. Select **Certificates & secrets**. > > Select **Upload certificate** and then select the certificate file that you want to upload. > 4. Select **Add**. > 5. Obtain the values for the following: > > - Private Key: The private key text file. > - Private Key Password: The password for the private key. > - Certificate: The text file of the same certificate that was uploaded to the Azure portal. > - If the grant type is **Refresh Token/Auth Code**, generate a refresh token. For more information, refer to [Generating a Refresh Token](). > > Assign the following required permissions to the application: > > 1. In the Azure Active Directory console of the registered app, select **API permissions**. > 2. Select **Add a permission**. > 3. On the **Request API permissions** page, a list of supported APIs is displayed. > > - **Microsoft Graph** is under the commonly used Microsoft API. > - **Azure Active Directory Graph** under supported Legacy API. > - **SharePoint** is under Microsoft API. > 4. Under **What type of permissions does your application require?**, select the permission type as **Delegated** or **Application**. See the following table for the type: > > | Permission | Type | Purpose | > | --- | --- | --- | > | **Microsoft GRAPH API** | | | > | Directory.ReadWrite.All | Delegated | Read, Update, and Delete Group
Add membership | > | Directory.AccessAsUser.All | Delegated | Change Password and Delete User | > | User.ReadWrite.All | Delegated | Read and Update any User | > | Group.ReadWrite.All | Delegated | Read and write all groups | > | GroupMember.ReadWrite.All | Delegated | Read and write group memberships | > | Sites.FullControl.All | Delegated | Have full control of all site collections | > | **SharePoint Online API** | | | > | AllSites.FullControl | Delegated | Have full control of all site collections | > | AllSites.Manage | Delegated | Read and write items and lists in all site collections | > | Sites.FullControl.All | Application | Have full control of all site collections | > | Sites.Search.All | Delegated | Run search queries as a user | > | User.ReadWrite.All | Delegated | Read and write user profiles | > | User.ReadWrite.All | Application | Read and write user profiles | > 5. Under **Select permissions**, select the required permissions. > 6. Select **Add permissions**. > 7. In **Grant consent**, select **Grant Admin Consent** for your configuration and directory. Select **Yes** when prompted in the pop-up dialog box. > [!NOTE] > > **Client Credentials (Deprecated)** > > This is the default grant type authentication. > > *Prerequisite* > > > **Note** > > > > It is mandatory to use the Global Admin and Admin of all Sites User in SharePoint Online to create the application in Azure Active Directory. > > Assign the following required permissions to the application: > > 1. In the Azure Active Directory console of the registered app, select **API permissions**. > 2. Select **Add a permission**. > 3. On the **Request API permissions** page, a list of supported APIs is displayed. > > - **Microsoft Graph** is under the commonly used Microsoft API. > - **Azure Active Directory Graph** under supported Legacy API. > - **SharePoint** is under Microsoft API. > 4. Under **What type of permissions does your application require?**, select the permission type as **Delegated** or **Application**. See the following table for the type: > > | Permission | Type | Purpose | > | --- | --- | --- | > | **Microsoft GRAPH API** | | | > | Directory.ReadWrite.All | Delegated | Read, Update, and Delete Group
Add membership | > | Directory.AccessAsUser.All | Delegated | Change Password and Delete User | > | User.ReadWrite.All | Delegated | Read and Update any User | > | Group.ReadWrite.All | Delegated | Read and write all groups | > | GroupMember.ReadWrite.All | Delegated | Read and write group memberships | > | Sites.FullControl.All | Delegated | Have full control of all site collections | > | **SharePoint Online API** | | | > | AllSites.FullControl | Delegated | Have full control of all site collections | > | AllSites.Manage | Delegated | Read and write items and lists in all site collections | > | Sites.FullControl.All | Application | Have full control of all site collections | > | Sites.Search.All | Delegated | Run search queries as a user | > | User.ReadWrite.All | Delegated | Read and write user profiles | > | User.ReadWrite.All | Application | Read and write user profiles | > 5. Under **Select permissions**, select the required permissions. > 6. Select **Add permissions**. > 7. In **Grant consent**, select **Grant Admin Consent** for your configuration and directory. Select **Yes** when prompted in the pop-up dialog box. ## Activity Insights Settings SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). Activity Insights Settings allows you to gather account information and activity data from Microsoft SharePoint Online. To enable Activity Insights for the Microsoft SharePoint Online application, refer to [Prerequisites]() for more information. To configure Activity Insights, complete the following: > [!NOTE] > > **Screenshot** > > [![Activity Insights Settings]()]() 1. Go to **Activity Insights Settings**. 2. Select **Enable Activity Insights** to view access to data insights on source and application activity such as logins and other app-specific events. 3. Select **Save**. ## Aggregation Settings Use the aggregation parameters to set up the aggregation of data from the managed sites. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() [![Aggregation Settings]()]() 1. Enable **Manage All Sites** if you want to manage all the sites. 2. In **Include Site Collections**, enter the list of all the site collections that are to be managed. 3. In **Exclude Site Collections**, enter the list of all the site collections that are to be excluded. 4. Enter the **Page Size**. This is the number of objects to fetch in a single page for a Site Collection. The default size is 500. 5. Select **Save**. ## Administrator Settings Configure administrator settings to troubleshoot issues with the connector. 1. If the **Debug Logging** feature is needed, please contact SailPoint. > **Important** > > Debug Logging should not be enabled without SailPoint guidance. 2. Enable **Debug Logging**, then select an **Expiry Time** to auto disable the logs. You can update the time as required for your organization. 3. Select **Save**, then refresh the page to view the detailed expiration timestamp. > **Screenshot** > > [![Enable debug logging]()]() ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with Microsoft SharePoint Online SaaS Microsoft SharePoint Online is a cloud-based service that helps organizations share and manage content, knowledge, and applications. The SailPoint Microsoft SharePoint Online SaaS connector manages SharePoint users and groups from all site collections present on the Microsoft SharePoint Online directory. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Microsoft SharePoint Online SaaS. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Onboard Microsoft SharePoint Online SaaS with SailPoint Agentic Fabric (SAF) SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your Microsoft SharePoint Online environment to SailPoint. SAF automatically creates, deploys, and configures the Microsoft SharePoint Online SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance. For detailed onboarding instructions, prerequisites, and supported deployment models, refer to [Connecting Sources](). > [!IMPORTANT] > > To enable advanced governance capabilities for Microsoft SharePoint Online resources and AI agents, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information. ## Supported Features The Microsoft SharePoint Online SaaS connector supports the following features: > [!NOTE] > > Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site. #### Account Management - Manage Microsoft SharePoint Online Users as Accounts - Account Aggregation and Account Refresh - Create - \*Add or Remove Entitlements (Groups from Sites and Subsites) - \*Access Certifications (certification of entitlements connected to accounts) - \*HTTP and HTTPS Proxy Configurations - \*Provision Microsoft SharePoint Online Accounts #### Entitlement Management - Manage Microsoft SharePoint Online Groups as Entitlements - Aggregate Groups (from Sites and Subsites) #### Supports OAuth2.0 Authentication The Microsoft SharePoint Online SaaS connector supports OAuth 2.0 authentication. For more information, refer to [OAuth 2.0 Authentication Methods](). #### Activity Insights Activity Insights supports activity from Microsoft SharePoint Online and its associated accounts. This allows you to gather account information and activity data from Microsoft SharePoint Online. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to [Activity Insights Settings](). ## Prerequisites - The SharePoint Online connector must be registered in Microsoft Entra ID with tenant level access for all the configured Site Collections. For more information, refer to [Registering an Application Using the Azure AD Portal](<#registering-an-application-using-the-azure-ad-portal-recommended>). - (*Deprecated*) The SharePoint Online connector must be registered on SharePoint Online with tenant level access for all the configured Site Collections. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](<#registering-application-with-oauth-client-credentials-from-sharepoint-portal-deprecated>). - (*Deprecated*) The SharePoint Online administrator must be the primary administrator and must have 'FullControl' permissions for all the configured Site Collections. For more information, refer to [Grant Access and Full Control Permissions](<#grant-access-and-full-control-permissions>). > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. - You must install IQService to use this feature. For more information, refer to [IQService](). - Before/After scripts can be executed by the latest version of [IQService](). You can use this feature to write custom PowerShell scripts that can be invoked before and after provisioning operations for this connector. > [!WARNING] > > To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts. - For specific prerequisites by authentication method, refer to [OAuth 2.0 Authentication Methods](). - If you are using a custom application authentication, you must manually enable it. For more information, refer to [Enabling Custom App Authentication](<#enabling-custom-app-authentication>). ### Registering an Application Using the Azure AD Portal *(Recommended)* Register a New Application in Microsoft Entra ID: 1. Sign in to the **Microsoft Entra admin center**. 2. Go to **Identity \> Applications \> App registrations**. 3. Click on **New Registration**. 4. Fill in the application details: - Name: Give your application a descriptive name. For example, `SharePoint API Client`. - Supported account types: Select **Accounts in this organizational directory only**. 5. Click Register ### Creating OAuth2.0 JWT Certificate Credentials *(Recommended)* The following are the steps for creating JWT certificate credentials for OAuth2.0 authentication. For more information refer to [OAuth 2.0 Authentication Methods](). #### Steps for registering an application and assigning API permissions 1. Create an application in Azure and register it. For more information, refer to [register a new application]() in the Microsoft documentation. > **Screenshot** > > [![Registering an application in Azure]()]() 2. Get an Application ID (Client ID) after the app registration, and then generate a Client Secret for it. 3. Assign API permissions to the Application ID (Client ID). For more information, refer to [API permissions]() in the Microsoft documentation. > **Screenshot** > > [![Assigning API permissions]()]() If you have already completed the above steps, you can skip them and proceed directly to the steps for creating and using the certificate. #### Steps for creating and using the certificate 1. Run PowerShell as an administrator on any of the windows machine, and then generate a self-signed certificate with the following command: ```text New-SelfSignedCertificate -DnsName "SPOnline" -CertStoreLocation "cert:\LocalMachine\My" ``` > **Screenshot** > > [![Generating a self-signed certificate]()]() 2. Go to **certlm.msc \> Personal \> Certificates \> Export**, the export wizard will open and you can step through the process to export the certificate in PFX format. > **Screenshot** > > [![Exporting the certificate]()]() [![Exporting the certificate]()]() 3. Select **Include all certificates in the certification path if possible** and **Enable certificate privacy**. > **Screenshot** > > [![Certificate export options]()]() 4. Provide a password to protect the private key using AES-256-SHA256 encryption. This password will be required when you sign your applications using the PFX file you are generating. > **Screenshot** > > [![Protecting the private key]()]() 5. Save on any directory of your choice. Download [openssl]() or use Git Bash. Copy the PFX file into the same directory where the command prompt or terminal is opened as an administrator, and run the following commands one by one, pressing **Enter** after each: ```text openssl pkcs12 -in test1.pfx -nocerts -out sp.key openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt openssl rsa -in sp.key -out rsasp.key ``` > **Screenshot** > > [![Extracting the key and certificate files]()]() [![Extracting the key and certificate files]()]() 6. Upload the crt file on the Azure system. > **Screenshot** > > [![Uploading the certificate]()]() 7. In the SailPoint user interface **Connection Settings** section, enter the details for SharePoint Online application in text for `rsasp.key` and `sp.crt` in **Private Key**. For more information, refer to [Connection Settings](). The **Private Key Password** is the pass-phrase you provided when generating the `sp.key`. > **Screenshot** > > [![Entering the private key and certificate]()]() ### Registering Application with OAuth Client Credentials from SharePoint Portal *(Deprecated)* To register the SharePoint Online SaaS connector on SharePoint Online portal, complete the following: 1. Sign in to the following URL with the account that has the global administrator role and generate the **Client Id** and **Client Secret**: `https://.SharePoint.com/_layouts/15/appregnew.aspx` Enter the respective values for the following fields: | Fields | Values | | --- | --- | | Title | Add-In | | App Domain | localhost | | Redirect Url | [https://localhost]() | 2. Select **Create**. This registers the **Add-In** and returns a success message with the created information. 3. Grant permissions to the **Add-In** to access the SharePoint data. > **Note** > > Provide `Full Control` permission level to the tenant scope to enable the ability to read, write, and manage the Site Collections information. #### Grant Access and Full Control Permissions The connector you registered in the previous section must also be registered on SharePoint Online with tenant level access with `Full Control` permissions for all configured Site Collections. To register the connector with the correct access level and permissions, complete the following: 1. Enter the following URL to redirect to the Grant Permission page (where sitename is the URL of your SharePoint site): `https://-admin.sharepoint.com/_layouts/15/appinv.aspx` 2. In the **AppId** field, enter the Client ID you generated in the previous section. 3. Select **Lookup**. This populates the values in the following fields: **Title**, **App**, **Domain**, and **Redirect URL**. 4. In the **Permissions Request XML** field, enter the following permission request (in XML format): ```xml ``` 5. Select **Create**. You are redirected to a page where you must click **Trust In**. #### Enabling Custom App Authentication If you are using a custom authentication method with your application you must manually enable it using PowerShell cmdlets. Run the following PowerShell cmdlets on Windows PowerShell: 1. Install the SharePoint Online PowerShell module (if you don't have it) and execute the following command: `$orgName = ""` 2. Authenticate as the SharePoint administrator using the following command: `Connect-SPOService - Url https://$orgName-admin.sharepoint.com` 3. Enable the custom application authentication using the following command: `Set-SPOTenant -DisableCustomAppAuthentication $false` # Machine Account Attributes ## Machine Account Provisioning Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. | Create Account Attribute | Description | | --- | --- | | UserName\* | The User Principal Name (UPN) for the Microsoft Entra account. | # Provisioning The Microsoft SharePoint Online SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft SharePoint Online directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes The following generator creates required information for a new Microsoft SharePoint Online account. You might need to edit the contents. | Account Attribute | Generator | Description | | --- | --- | --- | | UserName | Identity Attribute | Enter the user name for Office 365. For example, `johnny@contoso.com`. | ## Provisioning Policy Attributes The following tables list the provisioning policy attributes for creating accounts, creating groups, and updating groups. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ### Create Account | Attribute | Description | | --- | --- | | UserName\* | The user name of Office 365. For example, `johnny@contoso.com`. | ### Create Group | Attribute | Description | | --- | --- | | Title\* | The name of the group. | | SiteCollection\* | The site collection URL. | ### Update Group | Attribute | Description | | --- | --- | | OnlyAllowMembersViewMembership | Members who can view the membership list. | | AllowMembersEditMembership | Members who can edit the members. | | AllowRequestToJoinLeave | Allow request to join or leave from the group. | | AutoAcceptRequestToJoinLeave | Membership requests are automatically accepted. | | Azure AD Groups | Domain security groups. | > [!NOTE] > > You cannot add Azure Active Directory groups when creating a SharePoint Online group due to an API limitation. # Generating a Refresh Token *(Deprecated)* Before generating the refresh token, generate the client ID and client secret as described in [Registering an Application Using the SharePoint Online Portal](). To generate a refresh token, complete the following: 1. Obtain the authorization code using the following request (this process involves user consent): 1. Use the following format for the authorization URL: `https://.sharepoint.com/_layouts/15/OAuthAuthorize.aspx?client_id=client_GUID&scope=app_permissions_list&response_type=code&redirect_uri=redirect_uri` URL parameter details: ```text client_id= &response_type=code &redirect_uri= &scope=offline_access%20https://graph.microsoft.com/.default ``` Parameters details: **`client_id`** The client ID of the registered application. **`response_type`** For authorization code the value must be `code`. **`redirect_uri`** This should be the redirect URL configured while registering the application. This should be pointed to the local host and any unused port. **`scope`** You can add multiple scopes for defining the required API. You can also set the scope to `AllSites.Manage`. The default scope is `offline_access%20https://graph.microsoft.com/.default`. | Scope URI | Scope Alias | Available Rights | | --- | --- | --- | | [http://sharepoint/content/sitecollection]() | Site | Read, Write, and Manage | | [http://sharepoint/content/sitecollection/web]() | Web | Read, Write, and Manage | | [http://sharepoint/content/sitecollection/web/list]() | List | Read, Write, and Manage | | [http://sharepoint/content/tenant]() | All Sites | Read, Write, and Manage | 2. If you haven't already signed in to the SharePoint site, navigate to the URL and sign in. 3. Select **Trust It** to grant consent. The response in browser address bar will be displayed as follows: `https://localhost/?code=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrYFFcg3I0SsVRqZUlJSPK7G-g4NvlX9JtK3Q5H0RTtSD0Gmowaqid9ohxQjunSukFrvIz2px9c8V1Rm9X2khsWI1Q518jTZMS6Efi9yXoBgCJ4-KvcWsSf7whcrNhgabOM9zov1YoPtx0-zidfGBwpvcuXoUCNN4osm1lv0CW2Uwh0-91SadwJkx83itzQnD9hQwGWZPVVDdg_zEYibnoZV8N1el4hfoMKrOBib6ul1vBw1rhMt7kNcrHBs_YKs9OrhvOGCSUgKvQQ9qBwNjRZYOL8M7JVrcMFCgC70QliVMgShzjOUgMOmtx0qQcVFl4IAA` 2. Copy all the code after `code=`. This is the authorization code. > **Note** > > The received authorization code can be used only once and is valid for a short duration. 3. Obtain the refresh token using the authorization code obtained in the previous step. The authorization code and other parameters must be passed in the following request: ```text curl --location --request GET 'https://accounts.accesscontrol.windows.net/dc75061d-64a1-405d-a746-465dece42192/tokens/OAuth/2' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-raw 'client_id=cd1e9fd9-55c2-4dae-833a-fbcc150f1fad%40dc75061d-64a1-405d-a746-465dece42192&scope=offline_access%20https://graph.microsoft.com/.default&code=PAQABAAEAAAD--DLA3VO7QrddgJg7WevroypXVs207MGJClcCv_vL0wh8CzS5lXCHANO-wqepUk6_PHHTl25FiADOITB5CSwV8PGTwpLRmnQC6VN-xnXC5JVcoebz-O66U7cqIJ8i2TRQ8E2dqyeR0fYplqvwNK58xncqZNb2arXq8f50MrCYknwzkvqdkV6LXeIpDvJI4agv962w7i_NbbuPA7x8ESs0V5qgV7RcFXBFZmCU1VrvXC7KdiwKatQqRqmgXpd58gvMAX0nVy3zaRfwTw7LB5-1wccgFs4Xyx3KbfPuoBXCMTYIuEmnQK5JtdU7qXpSwmpyIcx1nfoATUkP0UXxkGR3IAA&redirect_uri=https://localhost&grant_type=authorization_code&client_secret=eroXdRLYRI3HeGksVC0n9brERZwxjqggIGv%2F%2Bcsumrk%3D&resource=00000003-0000-0ff1-ce00-000000000000%2Fsailpointdev.sharepoint.com%40dc75061d-64a1-405d-a746-465dece42192' ``` The newly added parameters are: **`code`** The authorization code obtained in previous steps. **`grant_type`** If you intend to recover the authorization code it should be `authorization_code`. **`client_secret`** The client secret of the registered application. **Response**: ```json { "token_type": "Bearer", "scope": "https://graph.windows.net/Directory.Read.All https://graph.windows.net/User.Read https://graph.windows.net/.default", "expires_in": 7199, "ext_expires_in": 7199, "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlJSSSIsImtpZCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlJSSSJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLndpbmRvd3MubmV0Iiwia...", "refresh_token": "OAQABAAAAAAAm-06blBE1TpVMil8KPQ410LOG6EPVxGfgH8rHUXApUs5fPFtel9FsKTXo2oN8Rw_ngEOpKNt1hfufYyJJnG39XxfscpcW...." } ``` Copy the **Refresh Token** received in the response. # Configuring Retry Parameters The Microsoft SharePoint Online SaaS connector supports the retry mechanism for account aggregation. Add the following attributes using the REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### retryableErrorsOnAgg Enter a list of errors that need to be retried during the aggregation operation as a string with entries separated by a comma. For example, `["Check Error 1","Authentication ticket has expired"]` ### maxRetryCount Enter the number of times to retry the request. The default is 5. ### queryTimeout Enter the time (in milliseconds) before timeout when waiting for the aggregation request to complete. For example, `45000`. ### maxThreads Enter the maximum number of threads to be created during account aggregation for optimized performance. The default is 5. # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Microsoft SharePoint Online SaaS connector uses the following default correlation and object configurations. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the Microsoft SharePoint Online SaaS source, the default correlation mapping is: | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | LoginName | Equals | Name | You can modify the correlation configuration in accordance with your requirements. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | LoginName | Account | | Group URL | Group | ### Default Account Attributes The Microsoft SharePoint Online SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | LoginName | The login name of the user. This is an Account ID which must not be changed. | | Name | The display name of user. | | Email | The e‐mail address of the user. | | FirstName | The first name of the user. | | LastName | The last name of the user. | | ID | The member ID of the user. | | Groups | Specifies all the groups to which the user belongs. | | SiteCollections | Specifies all the site collections to which the user belongs. | | AdminOfSites | Specifies all the site collections to which the user is an administrator of. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Microsoft SharePoint Online SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | ID | The identifier (ID) for the group. | | Group URL | The URL to the group in a site collection. This is an Account ID which must not be changed. | | Name | The display name of the group. | | Description | The description of the group. | | OwnerTitle | The owner title of the group. | | Azure AD Groups | Security domain groups for SharePoint Online. | | AutoAcceptRequestToJoinLeave | Gets (or sets) a value that indicates whether the request to join or leave the group can be accepted automatically. | | AllowMembersEditMembership | Gets or sets a value that indicates whether the group members can edit membership in the group. | | RequestToJoinLeaveEmailSetting | Gets (or sets) the email address to which the requests of the membership are sent. | | OnlyAllowMembersViewMembership | Gets (or sets) a value that indicates whether only group members are allowed to view the membership of the group. | | AllowRequestToJoinLeave | Gets (or sets) a value that indicates whether to allow users to request membership in the group and request to leave the group. | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## During Aggregation OneDrive Is Logging Error Messages in the Log File for OneDrive Sites Error messages are being displayed in the log from OneDrive (for example, `https://-my.sharepoint.com`) sites. **Resolution**: Add the `siteCollectionFilter` attribute using the REST API with the following value to exclude all OneDrive and personal sites: `contentclass:STS_Site Path:https://.sharepoint.com/*` For example: `contentclass:STS_Site Path:https://sailpointdev.sharepoint.com/*` The default value for the attribute is `contentclass:STS_site`. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Account or Group Aggregation Fails With an Error for Some of Your Sites Account or Group aggregation fails for some of your sites, with the following error: `processReadRequest : Attempted to perform an unauthorized operation` **Resolution**: Add the `siteCollectionFilter` attribute using the REST API with the following value, which uses a wild card entry when fetching sites: `contentclass:STS_Site Path:https://.sharepoint.com/*` This only fetches sites mentioned in the filter and will not fetch any `contentstorage/personal/other` sites that are having permission issues. > [!NOTE] > > This will only work if other sites are fetched properly and the aggregation failure is caused by a subsection of the sites. - The following example payload will fetch all the sites that start with QA and are under domain/folder sites: ```json [ { "op": "add", "path": "/connectorAttributes/siteCollectionFilter", "value": "contentclass:STS_Site Path:https://sailpoint.sharepoint.com/sites/QA*" } ] ``` - The following example payload will fetch all sites under the domain/folder sites: ```json [ { "op": "add", "path": "/connectorAttributes/siteCollectionFilter", "value": "contentclass:STS_Site Path:https://sailpoint.sharepoint.com/sites/*" } ] ``` # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the connector-runtime. These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the connector-runtime using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ```