Set up the SharePoint connector in Microsoft Entra (IT guide)

The SharePoint connector lets AutogenAI users search and read documents in SharePoint Online at the moment they ask a question. This guide is for the IT, security, and identity teams who set it up.

The connector uses the Microsoft Graph API with delegated permissions. Each user signs in to Microsoft once. From then on, AutogenAI can read only the SharePoint content that user can already open. Nothing is written back to SharePoint, and nothing is synced or indexed in advance.

The connector is separate from SharePoint sync, which copies chosen folders into an AutogenAI library ahead of time. You can use both side by side.

What you'll do

1. Confirm the four checks.
2. Register an app in your own Microsoft Entra tenant.
3. Grant admin consent for three delegated Microsoft Graph permissions.
4. Send AutogenAI the app's details, and paste the client secret into a secure link AutogenAI sends you.

Before you proceed: four checks

Go through these checks before you start planning or setup. Your AutogenAI customer success contact will also confirm them with you. If you can't confirm all four, talk to them before going further.

1. You use commercial Microsoft 365 (SharePoint Online)

   The connector isn't deployed on FedStart. GCC High would need an app registered in Microsoft's US Government cloud.

2. Your IT team can register an app in Entra

   You'll create an app registration and a client secret, and grant admin consent. This needs a role such as Application Administrator, Cloud Application Administrator, or Global Administrator.

3. Your pilot users have accounts in your Microsoft tenant

   Each user connects their own work account, so an AutogenAI login alone can't reach their SharePoint.

4. Your content is text documents on SharePoint sites

   The connector reads Word, PDF, PowerPoint, Excel, JSON, and plain text files. It doesn't read OneDrive, images, image-only scans, or SharePoint columns and tags.

What you need before you start

• The callback URL for your environment. Your AutogenAI contact sends it with this guide. See Callback URL to see how it's formed.
• A support ticket. Your AutogenAI contact gives you one to send your app details on.
• An admin who can register apps and grant consent. Application Administrator, Cloud Application Administrator, or Global Administrator.

Why you register your own app

Your organization registers the app in its own Entra tenant, so the registration, its client secret, and who can sign in stay under your control. AutogenAI's own multi-tenant application isn't offered for this integration. The trade-off is a client secret that you create, send to AutogenAI securely, and renew before it expires.

Register your app in Microsoft Entra

Carry out these steps in the Microsoft Entra admin center. Note the values marked "send to AutogenAI".

1. Register the app.
   • Go to App registrations, then New registration.
   • Name it, for example, "AutogenAI SharePoint".
   • Under Supported account types, choose "Accounts in this organizational directory only" (single tenant).
   • Send to AutogenAI: the Application (client) ID and the Directory (tenant) ID.
2. Add the redirect URI.
   • Set the platform to Web.
   • Paste the callback URL your AutogenAI contact sent you, exactly as given, including https and the full path.
   • Microsoft matches it character for character. A trailing slash or a different host makes sign-in fail.
3. Add API permissions.
   • Go to API permissions, Add a permission, Microsoft Graph, Delegated permissions.
   • Add Sites.Read.All, Files.Read.All, and offline_access.
   • Don't add any Application permissions.
   • Choose "Grant admin consent" for your organization.
4. Create a client secret.
   • Go to Certificates & secrets, then New client secret.
   • Choose an expiration that fits your policy, up to 24 months, and note the date. Send to AutogenAI: the expiration date.
   • Copy the secret value immediately. It's shown only once. You'll paste it into a secure link in step 6.
5. Optional: restrict who can use it.
   • Go to Enterprise applications and find the app.
   • Open Properties and set "Assignment required" to Yes.
   • Assign the users or groups who should have access.
6. Send the details to AutogenAI. Reply on the support ticket your AutogenAI contact gave you with the Application (client) ID, the Directory (tenant) ID, and the secret's expiration date. AutogenAI support then sends you a secure link for the client secret value. See Send your details to AutogenAI.

AutogenAI then configures your environment with these values and confirms when users can connect.

Callback URL

The only URL you register in Entra is the OAuth callback on the AutogenAI backend for your environment. You add it to your app as a Web redirect URI. Your AutogenAI contact sends you the exact URL. Always use that one.

Shared environments use one callback per region, including when your users sign in at your organization's own address.

Dedicated environments are hosted for your organization alone and have their own callback: your sign-in address with "api." added in front. If your users sign in at yourcompany.autogenai.com, the callback is:

https://api.yourcompany.autogenai.com/auth/mcp/sharepoint/callback

Shared and dedicated environments can both look like yourcompany.autogenai.com. If you don't know which you have, go by the URL your AutogenAI contact sent.

How the callback is used

After a user consents, Microsoft redirects their browser to this URL with a short-lived authorization code. The code is exchanged server to server for tokens. It works only once and can't be exchanged without the PKCE verifier and client secret held by the AutogenAI backend. No other inbound URL is needed, and your tenant never connects to the AutogenAI SharePoint service directly.

Permissions requested

All three permissions are delegated. A delegated permission never gives the app more access than the signed-in user already has. AutogenAI doesn't request any application permissions, which would allow access without a user present.

Why ".All" permissions rather than Sites.Selected

• Sites.Selected only reaches sites that have been granted to the app one by one. Making those grants needs the highly privileged Sites.FullControl.All permission.
• Microsoft Graph search doesn't support Sites.Selected.
• With the delegated ".All" permissions, access means "everything this user can already open". Microsoft enforces the user's SharePoint permissions on every call, and each user then narrows access to the locations they choose.

Send your details to AutogenAI

Send details in two stages. When you're ready to go ahead, send the first three items to your AutogenAI customer success contact. Once the app is registered, reply on the support ticket with the tenant ID, client ID, and secret expiration date, then paste the secret into the secure link AutogenAI support sends you.

Paste the client secret into the secure link

• AutogenAI support sends you a secure link for the client secret value.
• Open the link and paste the secret there. It's encrypted in your browser before it's sent, and you don't need an account.
• The link expires after seven days.
• Never send the secret value by email, Slack, Teams, or in the ticket.
• Before your environment is configured, the secret passes only through AutogenAI's own one-time secret service, which deletes it once it has been read.

Go live

1. Register the app using the callback URL your AutogenAI contact sent you, and send AutogenAI the details in Send your details to AutogenAI.
2. AutogenAI configures your environment, turns the integration on for the pilot users, and confirms when this is done.
3. Optional: require user assignment on the enterprise app and assign the pilot users.
4. Join a short call with AutogenAI. It walks the first user through connecting, choosing locations, and running a first search.
5. About two months before the client secret expires, create a new secret on the same app registration and paste it into the secure link AutogenAI support sends you. See Renew the client secret.

What each pilot user does on the day

• Go to Settings, then Integrations, choose Connect next to SharePoint, and sign in with their work Microsoft account.
• Choose the SharePoint sites, libraries, or folders to use.
• Select SharePoint as a source and run a search.

With tenant-wide admin consent in place (step 3 of the registration), users see a Microsoft sign-in and aren't asked to consent individually. Without it, each user is asked, and if your policy disables user consent, they're blocked.

Renew the client secret

Renew the secret before it expires so users stay connected.

1. About two months before the expiration date, your AutogenAI contact asks you for a new secret.
2. In Entra, go to the same app registration, then Certificates & secrets, then New client secret.
3. Copy the secret value immediately. It's shown only once.
4. Paste it into the secure link AutogenAI support sends you.

Don't create a new app registration. A new registration means every user has to reconnect.

What the connector can and can't reach

• Only what the user can already open. Every call uses the signed-in user's own delegated token. If a user can't open a site, library, or file in SharePoint, AutogenAI can't read it for them. SharePoint permissions and Conditional Access policies apply as normal.
• Only inside locations the user has approved. Each user picks the sites, libraries, folders, or files AutogenAI may use. A user who has approved nothing gets no SharePoint content.
• Read-only. None of the connector's six operations can create, modify, move, share, or delete anything in SharePoint.
• No sync and no copy of your library. Nothing is crawled, indexed, or mirrored in advance. Documents are read when a request needs them. Removing a user's access in SharePoint takes effect on their next request.
• Copies only when a user makes one. A user can copy chosen files or folders from SharePoint into an AutogenAI project. The copies are stored and processed like any uploaded file, and everyone on that project can open them. Later changes in SharePoint, including removed access, don't reach the copies. Importing a file again replaces its copy.
• Per user, not per organization. One user's connection can't be used to read on behalf of another.

The six operations

Approvals and admin controls

Every SharePoint operation asks the user for approval before it runs, with the choice of Allow Once, Allow Per Session, or Deny. Each decision is recorded. An administrator in your organization can also block any individual operation for everyone from Settings, then Integrations, in AutogenAI. The block applies from each user's next session, and a blocked operation is never offered to the AI.

IT and security FAQs

Data and the AI model

What happens with our data?

Nothing is copied or synchronized in advance. When a user runs a request with SharePoint selected, AutogenAI reads only the documents that request needs, from the locations that user has approved, using that user's own Microsoft permissions. The retrieved text is used to produce the answer and is cited back to its SharePoint URL. The SharePoint service keeps no state between requests, and no index or library copy of your content is built.

What does AutogenAI store?

• User tokens: encrypted at rest with AES-256-GCM under an environment-specific key. Deleted when the user disconnects SharePoint in AutogenAI. Access tokens expire in about an hour. Refresh tokens follow your tenant's lifetime policy (Entra's default is 90 days of inactivity).
• Client secret: encrypted under the same environment key. Only the AutogenAI backend for your environment can decrypt it. Before it's configured, it passes only through AutogenAI's own one-time secret service, which deletes it once it has been read.
• Approved locations: stored per user as a list of site, library, and item identifiers, the library's web address, and the folder or file path. Where a user picks a single file, the path includes the file name. Kept if the user disconnects, so they don't have to choose again.
• Citations: each answer cites the SharePoint URL of every document used. Opening a citation takes the user to SharePoint, where SharePoint's own permissions apply.
• Copied files: only when a user chooses to copy files into a project. They're stored and processed like any uploaded file, including your organization's anonymization settings. Later edits in SharePoint don't update them until a user imports the file again.

Is our data sent to an AI model?

Yes, in the same way as today. Text retrieved from SharePoint for a request is sent to the AI model that already generates content for your AutogenAI environment, exactly as happens now for documents users upload or sync. This integration changes where the text is read from, not where it's processed. The model is used under the same model-provider terms that already apply to your environment, as set out in your contract and DPA.

Does the AI model provider connect to SharePoint?

No. The model never connects to Microsoft or to the SharePoint service. AutogenAI's backend performs the reads and passes the model only the text needed for the answer.

Where does our data go?

Retrieved text is processed in the same way as content users already upload to AutogenAI, including by the model providers set out in the DPA at autogenai.com/dpa. AutogenAI's environment is the only system that reads from Microsoft Graph.

Does this change the data processing agreement?

Documents are read on demand, and document text follows the same processing path as today, including the AI model provider. Four things are new in the SharePoint service's operational logs, which are held in Datadog: your Microsoft tenant ID, each user's Microsoft Entra object ID, the application (client) ID of your app registration, and the search terms the AI sends to SharePoint. The application ID identifies your app registration and contains no personal data. Your AutogenAI contact confirms with AutogenAI's governance team whether anything in your DPA changes before you go live.

What does AutogenAI log?

The SharePoint service writes one log line per request and per operation. Logs go to AutogenAI's logging platform and are used for support and operational monitoring. This describes the production configuration.

Separately, AutogenAI's standard application logging and audit records apply to every user's session as they do today, including an audit record each time a user approves or denies the use of an operation.

Permissions and access

What permissions does AutogenAI need?

Read-only, delegated permissions only: Microsoft Graph Sites.Read.All and Files.Read.All, plus offline_access so a connection can be renewed without a new Microsoft sign-in every hour. "Delegated" means the permission is exercised on behalf of a signed-in user and can never exceed what that user can already open in SharePoint. No application permissions are requested, so there is no access without a user present, and no write, share, or delete permission of any kind.

Does this give AutogenAI access to all of our SharePoint?

No. Access is always on behalf of a signed-in user in your organization and limited to what that user can open, then narrowed to the locations that user has approved in AutogenAI. There is no service account and no application permission.

Can it write to, delete, or share anything in SharePoint?

No. Every operation is read-only, and the permissions requested are read-only. There is no code path that writes to Microsoft Graph.

Does it copy or index our documents?

No. There is no sync and no index. A user can choose to copy specific files into an AutogenAI project, where they're stored like any upload.

Sign-in and encryption

Do Conditional Access and MFA apply?

Yes. Users sign in to Microsoft through the normal Entra sign-in, so your Conditional Access policies, MFA, and sign-in frequency settings apply to the consent step and to refresh-token use.

Which users are prompted for consent?

With tenant-wide admin consent in place, users see a Microsoft sign-in and aren't asked to consent individually. Without it, each user is asked, and if your policy disables user consent, they're blocked.

Are all connections encrypted?

Every connection that crosses the internet uses HTTPS: the user's browser to AutogenAI, the browser to Microsoft sign-in, the AutogenAI backend to Microsoft's token endpoint, and AutogenAI to graph.microsoft.com. The one internal hop, from the AutogenAI backend to the SharePoint service, stays inside the private network of the AutogenAI environment and never crosses the internet. The SharePoint service has no public endpoint.

Is the client secret exposed to users or browsers?

No. Only the AutogenAI backend uses it, server to server, when exchanging the authorization code and when refreshing tokens. It's stored encrypted and never logged.

Is the OAuth flow protected against interception?

The flow is OAuth 2.0 authorization code with PKCE (S256) and a random, single-use state value tied to the user's AutogenAI session, over HTTPS only. The callback URL is fixed and registered in Entra, so Microsoft won't redirect a code anywhere else.

Revoking access and auditing

How do we revoke access?

At any time, in Microsoft Entra, you can disable the enterprise application, remove a user's assignment, revoke the user's sessions or refresh tokens, or remove admin consent. Each takes effect on the user's next request to Microsoft Graph, within the lifetime of the current access token (typically up to one hour). Individual users can also choose Disconnect in AutogenAI, which deletes their stored tokens. Your administrators in AutogenAI can disable the integration for the whole organization.

What happens when someone leaves or loses access to a site?

Their SharePoint permissions change in Microsoft, and the next read on their behalf fails or returns nothing. Disabling the account in Entra invalidates their refresh token, after which AutogenAI can't get a new access token for them.

How can we audit usage?

Sign-ins and token issuance appear in your Entra sign-in logs under the app. Microsoft 365 audit logs record the file accesses made through Graph on the user's behalf.

Reference

Reference values

Microsoft Graph endpoints used

All calls are on the v1.0 endpoint at graph.microsoft.com and use the signed-in user's delegated token. All are GET requests (reads), except one POST, which is a search and also a read.

Need help?

Send questions about this guide to your AutogenAI customer success contact. They route technical questions to the engineering team.