How to Setup MS SharePoint Location
Overview
This document outlines the updated procedure for configuring a Microsoft SharePoint location in Skybuffer AI.
Important Note: SharePoint has retired the ACS-based authentication model (AppRegNew/AppInv). Applications using the legacy method will experience HTTP 401 Unauthorized errors (“Token type is not allowed due to SharePoint ACS retirement”). This new procedure migrates the authentication to Microsoft Entra ID App Registration using the OAuth 2.0 Client Credentials flow.
Step 1: Register an Application in Microsoft Entra ID
- Navigate to the Azure Portal (portal.azure.com).
- Go to Microsoft Entra ID (formerly Azure AD) > App registrations > New registration.
- Name the application (e.g., “sync-sharepoint”) and choose the supported account types.
- Once created, go to the Overview page and copy the following values:
- Application (client) ID
- Directory (tenant) ID
Step 2: Generate a Client Secret
- In your App registration menu, navigate to Certificates & secrets.
- Click on “+ New client secret”.
- Provide a description (e.g., “sync-sharepoint-secret”) and select an expiration period.
- Click Add and immediately copy the Secret Value. You will need this to configure the Skybuffer destination. (Note: The Secret ID is not used for configuration).
Step 3: Configure API Permissions
- Navigate to API permissions in the App registration menu.
- Click “+ Add a permission” and select Microsoft Graph.
- Select Application permissions and check:
- Sites.Read.All
- Ensure that User.Read (Delegated) is also present if required.
- Click “Grant admin consent for <Your Organization>” to apply the permissions. The status should show as “Granted”.
Step 4: Configure Location Specific Settings in Skybuffer AI
- Open the Skybuffer AI UI and navigate to Models Hub > Model Destinations.
- Create or Edit a Microsoft Sharepoint Shared Location.
- Fill out the Location Specific Settings with the information gathered from Azure:
| Field | Value / Source |
|---|---|
| Destination Name | e.g., SL Graph |
| Directory (tenant) ID | Copied from Azure App Overview |
| Client ID | Copied from Azure App Overview |
| Client Secret | Copied from Azure Certificates & secrets |
| Scope | https://graph.microsoft.com/.default |
| Site URL | Your SharePoint URL (e.g., skybuffer.sharepoint.com) |
After saving these settings, the application will successfully retrieve SharePoint files without HTTP 401 errors. Access tokens are now issued by Microsoft Entra ID instead of ACS, ensuring full compatibility with the Microsoft Graph API.