> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/saas/filesharing/sharepoint-and-onedrive.md).

# M365 - Sharepoint/OneDrive

## Requirements

* Within Azure, an Entra App was created as described [here](/connectors/clouds/azure.md). Microsoft 365 tenants authenticate with a certificate that Teleskope generates during enrollment, so you do not need a client secret for Microsoft 365. Other Azure connectors that reuse the same app may still need one.
* Within Teleskope, you have a Teleskope Account with the Admin role

## Integration

{% stepper %}
{% step %}

#### Grant the Teleskope App Microsoft Graph and SharePoint API permissions

Navigate to your App Registration, then Manage -> API Permissions, and assign the following Graph API scopes via *Application Permissions*:

* **Directory.Read.All** – read users, groups, directories to map identities
* **ExternalUserProfile.Read.All** – identify guest/external users
* **Files.Read.All** – read files for discovery/scanning/classification
* **Group.Read.All** – list groups to analyze access
* **GroupMember.Read.All** – enumerate membership for permission inheritance
* **RoleManagement.Read.All** – understand privileged roles
* **SharePointTenantSettings.Read.All** – inspect tenant-wide settings (e.g., sharing rules)
* **Sites.Read.All** – enumerate SharePoint sites to index and crawl content
* **User.Read.All** – get user properties

Then select **Add a permission > SharePoint > Application permissions** and add:

* **Sites.Read.All** – read SharePoint site group (Owners, Members, Visitors) membership through the SharePoint REST API

{% hint style="info" %}
This is a separate permission from the Microsoft Graph **Sites.Read.All** above. Microsoft Graph does not expose SharePoint site group membership, so Teleskope reads it from the SharePoint REST API, which only accepts certificate-authenticated app tokens.
{% endhint %}

Optional Permissions to enable features in 'Policy Maker'

Under **Microsoft Graph**:

* **SensitivityLabels.Read.All** – list tenant-wide Purview sensitivity labels for PolicyMaker
* **InformationProtectionPolicy.Read.All** – read Purview label policies
* **Files.ReadWrite.All** – enable remediation such as applying Purview sensitivity labels, quarantining, or deletion

If you enable Policy Maker actions that apply or remove Purview sensitivity labels, also enable [metered APIs and services in Microsoft Graph](https://learn.microsoft.com/en-us/graph/metered-api-setup?tabs=azurecloudshell) for the Teleskope app registration. Microsoft treats the SharePoint and OneDrive `assignSensitivityLabel` API as a metered Graph API, so Graph permissions and admin consent alone are not sufficient for that action.

Optional Permissions to enable 'Last Accessed' for SharePoint and OneDrive files

Under **Office 365 Management APIs**:

* **ActivityFeed.Read** – read the ongoing stream of file access events

Under **Microsoft Graph**:

* **AuditLogsQuery-SharePoint.Read.All** – load existing SharePoint file access history
* **AuditLogsQuery-OneDrive.Read.All** – load existing OneDrive file access history

The two `AuditLogsQuery` permissions backfill existing history, so 'Last Accessed' is populated when you first view it rather than starting empty. All three must be added as *Application Permissions* (not Delegated) and require admin consent.

Lastly, grant admin consent to all of the permissions.
{% endstep %}

{% step %}

#### Enroll the tenant in Teleskope

1. Navigate to **Settings > Connectors > Microsoft 365** and click **Enroll**.
2. Enter your Tenant ID, a Tenant Name, and the app's Client ID, then click **Next**.
3. Click **Generate certificate**, then **Download .cer**.
   {% endstep %}

{% step %}

#### Upload the certificate to Entra

1. In the Entra admin center, open **App registrations** and select the Teleskope app.
2. Open **Certificates & secrets > Certificates** and upload the `.cer` file.
3. Confirm the thumbprint Entra shows matches the one in Teleskope.
4. Back in Teleskope, click **Activate**, then **Done**.

Entra can take a few minutes to accept a new certificate. If activation fails, wait and try again.

Teleskope holds the private key; only the public certificate leaves Teleskope. To rotate, go to **Settings > Connectors > Microsoft 365**, open the tenant row's menu and click **Edit**, then click **Next**. Click **Rotate certificate**, download the new `.cer`, and repeat this step. Keep the previous certificate registered in Entra until Teleskope confirms its services have restarted; running services keep using the previous certificate until then.
{% endstep %}
{% endstepper %}