How do I add Sharepoint to my Cloud connectors?

The “Cloud connectors” tab in the “Your organization” menu is designed to centralize the management of access to your organization’s storage spaces. Manage the cloud connectors linked to your account to enable the automatic transfer of data to your offerings, or the automatic retrieval of acquired data.

Connecting to a cloud connector depends on your platform subscription plan and your Data Exchange Platform configuration. To find out your current plan, click on your name > "Your organization", and review the "Subscription plan and quotas" section, or contact the support team.

How to choose the authentication method?

Microsoft SharePoint can be used to retrieve files for your data offerings or to automatically transfer acquired files.

The solution accesses SharePoint using an application context (App-Only), which allows it to connect on its own behalf rather than on behalf of a specific user.

The available methods are:

• Azure AD App-Only: recommended method for SharePoint Online, as it offers centralized permission management in Office 365, simplified through the Azure portal.
• SharePoint App-Only: preferred method for “on-premises” versions.

Configure via Azure AD App-Only

Refer to the Microsoft documentation on Azure AD App-Only

Information to provide

• SharePoint site URL: in the format https://<tenantname>.sharepoint.com/sites/<sitename> or https://<tenantname>.sharepoint.com
• Authentication authority URL: in the format https://login.microsoftonline.com/<tenantname>.onmicrosoft.com
• Client ID: the application ID, available in the “App registrations” section of Microsoft Entra ID (link to documentation).
• X.509 certificate: the certificate registered with the application in Azure AD, in PEM format. It begins with -----BEGIN CERTIFICATE-----.
• Private key: the RSA private key associated with the X.509 certificate, used to sign authentication requests. It begins with -----BEGIN PRIVATE KEY-----.

Is your certificate a .cer file? Certificates exported from Windows or Azure are often in binary format (DER), which is not supported. To convert it to PEM format: openssl x509 -inform der -in certificate.cer -out certificate.pem 
The certificate and the private key must come from the same key pair. If you regenerate one, regenerate the other as well.

Grant permissions to the application

Refer to the Microsoft documentation on SharePoint permissions

The connector accesses the SharePoint site on behalf of the application. The application must therefore have read and write access to the specified site.

In Microsoft Entra ID, go to App registrations > your application > API permissions > Add a permission, then choose one of the two options below.

Option 1: Access limited to the site (recommended)

1. Select SharePoint > Application permissions > Sites.Selected.
2. Click Grant admin consent.
3. Explicitly grant the application write access to the site. A SharePoint administrator can do this with PnP PowerShell:
   Grant-PnPAzureADAppSitePermission -AppId <Client ID> -DisplayName "<application name>" -Site https://<tenantname>.sharepoint.com/sites/<sitename> -Permissions Write

Option 2: Access to all sites in the tenant

1. Select SharePoint > Application permissions > Sites.ReadWrite.All.
2. Click Grant admin consent.

Points to check

• The permission must be added under the SharePoint API. A permission with the same name exists under Microsoft Graph, but it is not used by the connector.
• It must be of type Application, not "Delegated".
• The status must read "Granted for <your organization name>".
• A permission change can take up to about fifteen minutes to take effect. Wait before testing again.

Configure via SharePoint App-Only

Refer to the Microsoft documentation on SharePoint App-Only

Information to provide

• SharePoint site URL: in the format https://<tenantname>.sharepoint.com/sites/<sitename> or https://<tenantname>.sharepoint.com
• Authentication authority URL: depends on your installation. Example: https://accounts.accesscontrol.windows.net/<tenantId>/tokens/OAuth/2
• Client ID: provided when creating the application in the SharePoint admin center. Available in the “App registrations” section of Microsoft Entra ID (link to documentation).
• Client secret: provided when creating the application in the SharePoint admin center. Available in the “App registrations” section of Microsoft Entra ID (link to documentation).

Grant permissions to the application

Refer to the Microsoft documentation on SharePoint permissions

The application’s permissions are defined in an XML file to be entered in the SharePoint admin center (see documentation). This XML must include at least:

• Read and Write permissions on the scope http://sharepoint/content/sitecollection/web;
• the parameter AllowAppOnlyPolicy="true".

XML example

<AppPermissionRequests AllowAppOnlyPolicy="true"> 
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read"/> 
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Write"/> 
</AppPermissionRequests>