Connect SharePoint

Imports external-sharing governance data (external users, site sharing policy) from the SharePoint Online tenant-admin API, via an Entra App Registration with certificate authentication.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Global Administrator or SharePoint Administrator role on the tenant

• A Microsoft Entra App Registration

Step 1 — Generate the certificate in HARVEN

1. Create the connector, fill in the tenant, SharePoint domain and Client ID, then Save

2. Click Generate certificate — HARVEN creates the keypair and keeps the private key encrypted

3. Download the certificate (.cer) — only the public part is exported

Step 2 — Configure the Entra App Registration

1. Entra portal → App registrations → your application

2. Certificates & secrets → Certificates → Upload certificate → select the downloaded .cer

3. API permissions → SharePoint → Application → Sites.FullControl.All

4. Click Grant admin consent

Sites.FullControl.All is mandatory. The Sites.* scopes cover site content, but the APIs this connector uses (GetExternalUsers, site properties) are tenant-administration operations — a surface SharePoint only unlocks with Sites.FullControl.All. There is no "read-only admin" scope: even though the connector only reads, Sites.Read.All returns a 403.

Step 3 — Test the connection

Back in HARVEN, click Test connection.

After uploading the certificate in Entra, allow a few minutes (up to 5–10 min) for the test to succeed while Microsoft propagates the certificate and permissions.

An empty result counts as a successful connection: on an Entra B2B-integrated tenant, external users are Entra guests and don't appear here (see the Entra ID connector).

What to enter in HARVEN

• Tenant ID — Entra tenant identifier or domain (App Registration → Directory (tenant) ID)

• SharePoint domain — SharePoint short name (e.g. "contoso" for contoso.sharepoint.com) (Your SharePoint tenant URL)

• Client ID — Application identifier (App Registration → Application (client) ID)

• Certificate — Generated by HARVEN; you only upload the public .cer to Entra (Generate certificate button)

What HARVEN reads

• external_user — Tenant external users (GetExternalUsers API). Empty on an Entra B2B-integrated tenant: user_object_id (B2B guest object id; null = OTP-only user with no B2B account, pending migration), shared_with_email (email address the resource was shared with), user_type (external user type as reported by SharePoint), site_url (URL of the externally shared site/resource), created_date (when the external share was created), expiration_date (when the share expires, if set)

• site — SharePoint sites and their external-sharing policy (GetSitePropertiesFromSharePointByFilters API): site_url (site collection URL), sharing_capability (external sharing level: Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing, ExistingExternalUserSharingOnly), sharing_domain_restriction_mode (domain restriction mode: None, AllowList, BlockList), sharing_allowed_domain_list (allow-listed external domains, null when no allow-list), storage_used (storage used in MB), template (site template)

Official documentation

• App-only access via certificate (Entra)

• SharePoint/OneDrive Entra B2B integration

Need help? Contact [email protected].