> For the complete documentation index, see [llms.txt](https://docs.blockbrain.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blockbrain.ai/for-admins/agents/sharepoint-agent.md).

# SharePoint Agent

This page provides detailed configuration instructions for the SharePoint Agent, which enables integration with SharePoint Online for file and site management

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-cover data-type="image">Cover image</th></tr></thead><tbody><tr><td><strong>Overview</strong></td><td><ul><li>Search and retrieve documents and files stored in SharePoint Online through Blockbrain</li><li>Access, read, and manage content within SharePoint sites and document libraries</li><li>Extract and summarize file content and metadata for reporting or AI analysis</li><li>Navigate SharePoint site structures, lists, and libraries</li><li>Automate document management and workflow processes using SharePoint data</li></ul></td><td><a href="https://3232460952-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIabFtGTeQzwfWCzp8vd6%2Fuploads%2FUwHxKX9rpt3NC6yRBTXA%2FScreenshot%202025-12-04%20at%2013.51.34.png?alt=media&amp;token=c5a58bce-5ede-4ad9-985e-556b4ebeed5e">Screenshot 2025-12-04 at 13.51.34.png</a></td></tr><tr><td><strong>Prerequisites</strong></td><td><ul><li>Complete the <a href="https://docs.en.theblockbrain.ai/for-users/agents">general setup steps</a> from the main AI Agents page</li><li>Ensure users have active Microsoft 365 accounts with access to SharePoint Online</li><li>Verify appropriate Microsoft 365 licensing for SharePoint Online and related services</li></ul></td><td><a href="https://3232460952-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIabFtGTeQzwfWCzp8vd6%2Fuploads%2Fvi22Kf04WdMUhdg0dI0h%2FScreenshot%202025-12-04%20at%2013.51.48.png?alt=media&amp;token=cc189408-a272-40e5-988b-b7486983d97e">Screenshot 2025-12-04 at 13.51.48.png</a></td></tr></tbody></table>

### Azure App Registration Configuration

#### Required API Permissions

Add the following Microsoft Graph permissions to your app registration:

| Permission                    | Type      | Description                                         |
| ----------------------------- | --------- | --------------------------------------------------- |
| `offline_access`              | Delegated | Maintain access to data you have given it access to |
| `User.Read`                   | Delegated | Sign in and read user profile                       |
| `Files.Read.All`              | Delegated | Read all files that user can access                 |
| `Sites.Read.All`              | Delegated | Read items in all site collections                  |
| `User.ReadBasic.All`          | Delegated | Search for user information                         |
| `Tasks.Read`                  | Delegated | Read the signed-in user's tasks and task lists      |
| `GroupMember.Read.All`        | Delegated | Read the members of all groups in an organization   |
| `Group-Conversation.Read.All` | Delegated | Read conversations in Microsoft 365 groups          |

> As alternative, you can use the `.default` scope (uses all scopes set in the app).

#### Redirect URL

* Add <https://nango.theblockbrain.ai/oauth/callback> as allowed redirect URL to your app registration

#### Permission Configuration Steps

1. In your Azure app registration, go to **API permissions**
2. Click **"Add a permission"** > **Microsoft Graph** > **Delegated permissions**
3. Search for and select each required permission
4. Click **"Add permissions"**
5. Click **"Grant admin consent"** (recommended for organization-wide deployment)

### Agent Configuration in Blockbrain

<div data-with-frame="true"><figure><img src="https://3232460952-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIabFtGTeQzwfWCzp8vd6%2Fuploads%2FYDD88tH94jV3rWXarKIo%2Fimage.png?alt=media&amp;token=b46c04ed-62ec-439a-9347-01e93ecd33b0" alt=""><figcaption></figcaption></figure></div>

<div data-with-frame="true"><figure><img src="https://3232460952-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIabFtGTeQzwfWCzp8vd6%2Fuploads%2Fq4T77hWPCgG2WecvAJRc%2Fimage.png?alt=media&amp;token=c731bd25-3948-4fbb-885c-b1d40cb6637a" alt=""><figcaption></figcaption></figure></div>

1. **Access Agent Settings**:
   * Navigate to your Blockbrain admin panel
   * Go to **Agents** > **SharePoint Agent**
   * Click **"Configure"**
2. **Enter Azure Credentials**:
   * **Client ID**: Enter the Application ID from your Azure app registration
   * **Client Secret**: Paste the client secret you generated
   * **Tenant**: Enter your Azure tenant ID
3. **Configure OAuth Scopes**:
   * Add each required scope individually using the **"Add"** button as mentioned [here](#required-api-permissions)
   * Each scope will appear as a removable tag
   * Use the **"X"** button to remove incorrect scopes
4. **Additional Configuration** (Optional):
   * Add custom key-value pairs if needed for specific requirements
   * Configure any organization-specific settings
5. **Save Configuration**:
   * Click **"Save"** to apply the settings
   * Wait for the confirmation message

### Alternative: Admin Consent Configuration

For simplified scope management with admin pre-approval:

1. In Azure, grant admin consent for all required permissions
2. In Blockbrain configuration, use `.default` scope instead of individual scopes
3. This eliminates the need for users to consent to individual permissions

### SharePoint REST Configuration

Some SharePoint content cannot be read through Microsoft Graph. This applies to classic Web Part Pages and to web parts embedded in wiki pages. SharePoint REST is a second, optional connection that lets the SharePoint Agent read this content as well.

{% hint style="info" %}
SharePoint REST is optional. Without it, the SharePoint Agent keeps working as before. When a user opens a classic page, the agent returns the content it can read and notes that the page's web parts need the SharePoint REST connection.
{% endhint %}

**Prerequisites**

* The SharePoint Agent is already configured as described above
* SharePoint REST is enabled for your organization (contact your Blockbrain Customer Success Manager)
* You know your SharePoint tenant name. It is the first part of your SharePoint address. For `https://contoso.sharepoint.com`, the tenant name is `contoso`

**Step 1: Grant the SharePoint permission in Microsoft Azure**

SharePoint REST uses the same Azure app registration as the SharePoint Agent. It needs one additional permission from the **SharePoint** API (not Microsoft Graph).

1. In the Azure portal, open the app registration you use for the SharePoint Agent
2. Go to **API permissions**
3. Click **"Add a permission"** > **SharePoint** > **Delegated permissions**
4. Search for and select **`AllSites.Read`**
5. Click **"Add permissions"**
6. Click **"Grant admin consent"**

| Permission      | API        | Type      | Description                                            |
| --------------- | ---------- | --------- | ------------------------------------------------------ |
| `AllSites.Read` | SharePoint | Delegated | Read items in all site collections the user can access |

{% hint style="warning" %}
`AllSites.Read` is listed under the **SharePoint** API. The Microsoft Graph permission `Sites.Read.All` has a similar name but does not cover SharePoint REST.
{% endhint %}

**Step 2: Configure SharePoint REST in Blockbrain**

1. Navigate to your Blockbrain admin panel
2. Go to **Agents** > **Tools** and select the **SharePoint** tool
3. Switch to the **"SharePoint REST"** tab at the top
4. **Enter Azure Credentials**. Use the same values as in the **"SharePoint"** tab:
   * **Client ID**: the Application ID from your Azure app registration
   * **Client Secret**: the client secret of that app registration
   * **Tenant**: your Azure tenant ID
5. **Configure OAuth Scopes**. Add each scope individually using the **"Add"** button:

| Scope                                      | Purpose                                                                   |
| ------------------------------------------ | ------------------------------------------------------------------------- |
| `offline_access`                           | Keeps the connection active without asking users to sign in again         |
| `openid`                                   | Signs the user in                                                         |
| `https://<tenant>.sharepoint.com/.default` | Grants access to SharePoint REST with the permissions consented in Step 1 |

Replace `<tenant>` with your SharePoint tenant name. Example: if your SharePoint address is `https://contoso.sharepoint.com`, the scope is `https://contoso.sharepoint.com/.default`.

6. Click **"Save"** to apply the settings

**Step 3: Connect and test**

1. Have a test user connect **SharePoint REST** from their agent connections
2. Ask the agent to read a classic SharePoint page that contains web parts
3. Verify the answer includes the web part content

**Troubleshooting**

**Problem**: The agent says the page's web parts need the SharePoint REST connection

* **Solution**: The user has not connected SharePoint REST yet, or the connection was not saved. Connect it and try again

**Problem**: "Access denied" or 401 errors on classic pages

* **Solution**: Check that `AllSites.Read` from the **SharePoint** API is added and admin consent is granted
* **Check**: The tenant in the `.default` scope must match your SharePoint address exactly, for example `https://contoso.sharepoint.com/.default` and not `https://contoso.onmicrosoft.com/.default`

### Testing the SharePoint Agent

#### Verification Steps

1. **Connection Test**:
   * Use the built-in connection test in Blockbrain
   * Verify successful authentication with Microsoft Graph
2. **User Testing**:
   * Have a test user connect their SharePoint account
   * Attempt to access a known SharePoint file or site
   * Verify file retrieval and search functionality
3. **Permission Validation**:
   * Check that the agent can access appropriate SharePoint sites
   * Confirm file read permissions are working correctly

### Common SharePoint Integration Use Cases

* **Document Search**: Find files across multiple SharePoint sites
* **File Retrieval**: Access specific documents for AI analysis
* **Site Navigation**: Browse SharePoint site structures and libraries
* **Metadata Extraction**: Retrieve file properties and metadata

### Troubleshooting

#### Authentication Issues

**Problem**: "Access denied" or authentication failures

* **Solution**: Verify admin consent is granted for all required permissions
* **Check**: Ensure the redirect URL is exactly `https://nango.theblockbrain.ai/oauth/callback`

#### Permission Errors

**Problem**: "Insufficient privileges" when accessing SharePoint

* **Solution**: Confirm the app registration has `Sites.Read.All` and `Files.Read.All` permissions
* **Check**: Verify the user has SharePoint access in your organization

#### Scope Configuration Issues

**Problem**: Scopes not saving correctly

* **Solution**: Add each scope individually using the "Add" button
* **Check**: Remove any duplicate or incorrect scopes using the "X" button

### Security Considerations

* **File Access**: The agent inherits the user's SharePoint permissions
* **Site Scope**: Access is limited to sites the authenticated user can access
* **Data Privacy**: Files are processed according to Blockbrain's data handling policies
* **Audit Trail**: SharePoint access is logged in both Azure AD and SharePoint audit logs

### Next Steps

After successful SharePoint Agent configuration:

* Train users on SharePoint integration features
* Configure [Outlook Agent](/for-admins/agents/outlook-agent.md) if email integration is needed
* Monitor usage and performance through Azure AD reports


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.blockbrain.ai/for-admins/agents/sharepoint-agent.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.