# Integrating SailPoint with Microsoft SharePoint Online Microsoft SharePoint Online is a cloud-based service that helps organizations share and manage content, knowledge, and applications. The SailPoint Microsoft SharePoint Online connector manages SharePoint users and groups from all site collections present on the Microsoft SharePoint Online directory. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Microsoft SharePoint Online. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Microsoft SharePoint Online connector supports the following features: > [!NOTE] > > Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site. #### Account Management - Manage Microsoft SharePoint Online Users as Accounts - Account Aggregation and Account Refresh - Create - \*Add or Remove Entitlements (Groups from Sites and Subsites) - \*Access Certifications (certification of entitlements connected to accounts) - \*HTTP and HTTPS Proxy Configurations #### Entitlement Management - Manage Microsoft SharePoint Online Groups as Entitlements - Aggregate Groups (from Sites and Subsites) #### Supports Native Before/After Scripts for Provisioning Requests This feature requires installation and registration of IQService. For more information, refer to [IQService Administrator's Guide](). #### Supports OAuth2.0 Authentication The Microsoft SharePoint Online connector supports OAuth 2.0 authentication. For more information, refer to [OAuth 2.0 Authentication Methods](). For more information on features, refer to [Source Features](). ## Prerequisites - The SharePoint Online connector must be registered in Microsoft Entra ID with tenant level access for all the configured Site Collections. For more information, refer to [Registering an Application Using the Azure AD Portal](<#registering-an-application-using-the-azure-ad-portal-recommended>). - (*Deprecated*) The SharePoint Online connector must be registered on SharePoint Online with tenant level access for all the configured Site Collections. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](<#registering-application-with-oauth-client-credentials-from-sharepoint-portal-deprecated>). - (*Deprecated*) The SharePoint Online administrator must be the primary administrator and must have 'FullControl' permissions for all the configured Site Collections. For more information, refer to [Grant Access and Full Control Permissions](<#grant-access-and-full-control-permissions>). > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, SAML Bearer Assertion, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. - You must install IQService to use this feature. For more information, refer to [IQService](). > [!IMPORTANT] > > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](). - Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](). - Before/After scripts can be executed by the latest version of [IQService](). You can use this feature to write custom PowerShell scripts that can be invoked before and after provisioning operations for this connector. > [!WARNING] > > To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts. - SailPoint recommends that you secure the communication path between the connector (VA) and IQService for the overall security of the Microsoft SharePoint Online connector. For more information, refer to [TLS Configuration Between VA and IQService](). - For specific prerequisites by authentication method, refer to [OAuth 2.0 Authentication Methods](). - If you are using a custom application authentication, you must manually enable it. For more information, refer to [Enabling Custom App Authentication](<#enabling-custom-app-authentication>). ### Registering an Application Using the Azure AD Portal *(Recommended)* Register a New Application in Microsoft Entra ID: 1. Sign in to the **Microsoft Entra admin center**. 2. Go to **Identity \> Applications \> App registrations**. 3. Click on **New Registration**. 4. Fill in the application details: - Name: Give your application a descriptive name. For example, `SharePoint API Client`. - Supported account types: Select **Accounts in this organizational directory only**. 5. Click Register ### Creating OAuth2.0 JWT Certificate Credentials *(Recommended)* The following are the steps for creating JWT certificate credentials for OAuth2.0 authentication. For more information refer to [OAuth 2.0 Authentication Methods](). #### Steps for registering an application and assigning API permissions 1. Create an application in Azure and register it. For more information, refer to [register a new application]() in the Microsoft documentation. > **Screenshot** > > [![Registering an application in Azure]()]() 2. Get an Application ID (Client ID) after the app registration, and then generate a Client Secret for it. 3. Assign API permissions to the Application ID (Client ID). For more information, refer to [API permissions]() in the Microsoft documentation. > **Screenshot** > > [![Assigning API permissions]()]() If you have already completed the above steps, you can skip them and proceed directly to the steps for creating and using the certificate. #### Steps for creating and using the certificate 1. Run PowerShell as an administrator on any of the windows machine, and then generate a self-signed certificate with the following command: ```text New-SelfSignedCertificate -DnsName "SPOnline" -CertStoreLocation "cert:\LocalMachine\My" ``` > **Screenshot** > > [![Generating a self-signed certificate]()]() 2. Go to **certlm.msc \> Personal \> Certificates \> Export**, the export wizard will open and you can step through the process to export the certificate in PFX format. > **Screenshot** > > [![Exporting the certificate]()]() [![Exporting the certificate]()]() 3. Select **Include all certificates in the certification path if possible** and **Enable certificate privacy**. > **Screenshot** > > [![Certificate export options]()]() 4. Provide a password to protect the private key using AES-256-SHA256 encryption. This password will be required when you sign your applications using the PFX file you are generating. > **Screenshot** > > [![Protecting the private key]()]() 5. Save on any directory of your choice. Download [openssl]() or use Git Bash. Copy the PFX file into the same directory where the command prompt or terminal is opened as an administrator, and run the following commands one by one, pressing **Enter** after each: ```text openssl pkcs12 -in test1.pfx -nocerts -out sp.key openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt openssl rsa -in sp.key -out rsasp.key ``` > **Screenshot** > > [![Extracting the key and certificate files]()]() [![Extracting the key and certificate files]()]() 6. Upload the crt file on the Azure system. > **Screenshot** > > [![Uploading the certificate]()]() 7. In the SailPoint user interface **Connection Settings** section, enter the details for SharePoint Online application in text for `rsasp.key` and `sp.crt` in **Private Key**. For more information, refer to [Connection Settings](). The **Private Key Password** is the pass-phrase you provided when generating the `sp.key`. > **Screenshot** > > [![Entering the private key and certificate]()]() ### Registering Application with OAuth Client Credentials from SharePoint Portal *(Deprecated)* > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, SAML Bearer Assertion, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. For more information, refer to [Registering an Application Using the Azure AD Portal](<#registering-an-application-using-the-azure-ad-portal-recommended>). To register the SharePoint Online connector on SharePoint Online portal, complete the following: 1. Sign in to the following URL with the account that has the global administrator role and generate the **Client Id** and **Client Secret**: `https://.SharePoint.com/_layouts/15/appregnew.aspx` Enter the respective values for the following fields: | Fields | Values | | --- | --- | | Title | Add-In | | App Domain | localhost | | Redirect Url | [https://localhost]() | 2. Select **Create**. This registers the **Add-In** and returns a success message with the created information. 3. Grant permissions to the **Add-In** to access the SharePoint data. > **Note** > > Provide `Full Control` permission level to the tenant scope to enable the ability to read, write, and manage the Site Collections information. #### Grant Access and Full Control Permissions The connector you registered in the previous section must also be registered on SharePoint Online with tenant level access with `Full Control` permissions for all configured Site Collections. To register the connector with the correct access level and permissions, complete the following: 1. Enter the following URL to redirect to the Grant Permission page (where sitename is the URL of your SharePoint site): `https://-admin.sharepoint.com/_layouts/15/appinv.aspx` 2. In the **AppId** field, enter the Client ID you generated in the previous section. 3. Select **Lookup**. This populates the values in the following fields: **Title**, **App**, **Domain**, and **Redirect URL**. 4. In the **Permissions Request XML** field, enter the following permission request (in XML format): ```xml ``` 5. Select **Create**. You are redirected to a page where you must click **Trust In**. #### Enabling Custom App Authentication If you are using a custom authentication method with your application you must manually enable it using PowerShell cmdlets. Run the following PowerShell cmdlets on Windows PowerShell: 1. Install the SharePoint Online PowerShell module (if you don't have it) and execute the following command: `$orgName = ""` 2. Authenticate as the SharePoint administrator using the following command: `Connect-SPOService - Url https://$orgName-admin.sharepoint.com` 3. Enable the custom application authentication using the following command: `Set-SPOTenant -DisableCustomAppAuthentication $false`