Imports external-sharing governance data (external users, site sharing policy) from the SharePoint Online tenant-admin API, via an Entra App Registration with certificate authentication.
For the general flow of adding a source, see Connect Data Sources.
Global Administrator or SharePoint Administrator role on the tenant
A Microsoft Entra App Registration
Create the connector, fill in the tenant, SharePoint domain and Client ID, then Save
Click Generate certificate — HARVEN creates the keypair and keeps the private key encrypted
Download the certificate (.cer) — only the public part is exported
Entra portal → App registrations → your application
Certificates & secrets → Certificates → Upload certificate → select the downloaded .cer
API permissions → SharePoint → Application → Sites.FullControl.All
Click Grant admin consent
Sites.FullControl.All is mandatory. The Sites.* scopes cover site content, but the APIs this connector uses (GetExternalUsers, site properties) are tenant-administration operations — a surface SharePoint only unlocks with Sites.FullControl.All. There is no "read-only admin" scope: even though the connector only reads, Sites.Read.All returns a 403.
Back in HARVEN, click Test connection.
After uploading the certificate in Entra, allow a few minutes (up to 5–10 min) for the test to succeed while Microsoft propagates the certificate and permissions.
An empty result counts as a successful connection: on an Entra B2B-integrated tenant, external users are Entra guests and don't appear here (see the Entra ID connector).
Field | Where to find it |
|---|---|
Tenant ID | App Registration → Directory (tenant) ID |
SharePoint domain | Your SharePoint tenant URL |
Client ID | App Registration → Application (client) ID |
Certificate | Generate certificate button |
external_user — Tenant external users (GetExternalUsers API). Empty on an Entra B2B-integrated tenant: B2B guest object id; null = OTP-only user with no B2B account (pending migration) (user_object_id), Email address the resource was shared with (shared_with_email), External user type as reported by SharePoint (user_type), When the external share was created (created_date), Always empty: SharePoint does not expose them at tenant level (site_url, expiration_date)
site — SharePoint sites and their external-sharing policy (GetSitePropertiesFromSharePointByFilters API): Site collection URL (site_url), Site title (title), External sharing level: Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing, ExistingExternalUserSharingOnly (sharing_capability), Domain restriction mode: None, AllowList, BlockList (sharing_domain_restriction_mode), Allow-listed external domains (null when no allow-list) (sharing_allowed_domain_list), Block-listed external domains (sharing_blocked_domain_list), Id of the sensitivity label applied to the site, empty if none (sensitivity_label), Lock state: Unlock, ReadOnly, NoAccess (lock_state), Storage used (MB) (storage_used), Site template (template)
Need help? Contact [email protected].
