Imports external-sharing governance data (external users, site sharing policy) from the SharePoint Online tenant-admin API, via an Entra App Registration with certificate authentication.
For the general flow of adding a source, see Connect Data Sources.
Before you start
Global Administrator or SharePoint Administrator role on the tenant
A Microsoft Entra App Registration
Step 1 — Generate the certificate in HARVEN
Create the connector, fill in the tenant, SharePoint domain and Client ID, then Save
Click Generate certificate — HARVEN creates the keypair and keeps the private key encrypted
Download the certificate (.cer) — only the public part is exported
Step 2 — Configure the Entra App Registration
Entra portal → App registrations → your application
Certificates & secrets → Certificates → Upload certificate → select the downloaded .cer
API permissions → SharePoint → Application → Sites.FullControl.All
Click Grant admin consent
Sites.FullControl.All is mandatory. The Sites.* scopes cover site content, but the APIs this connector uses (GetExternalUsers, site properties) are tenant-administration operations — a surface SharePoint only unlocks with Sites.FullControl.All. There is no "read-only admin" scope: even though the connector only reads, Sites.Read.All returns a 403.
Step 3 — Test the connection
Back in HARVEN, click Test connection.
After uploading the certificate in Entra, allow a few minutes (up to 5–10 min) for the test to succeed while Microsoft propagates the certificate and permissions.
An empty result counts as a successful connection: on an Entra B2B-integrated tenant, external users are Entra guests and don't appear here (see the Entra ID connector).
What to enter in HARVEN
Tenant ID — Entra tenant identifier or domain (App Registration → Directory (tenant) ID)
SharePoint domain — SharePoint short name (e.g. "contoso" for contoso.sharepoint.com) (Your SharePoint tenant URL)
Client ID — Application identifier (App Registration → Application (client) ID)
Certificate — Generated by HARVEN; you only upload the public .cer to Entra (Generate certificate button)
What HARVEN reads
external_user — Tenant external users (GetExternalUsers API). Empty on an Entra B2B-integrated tenant: user_object_id (B2B guest object id; null = OTP-only user with no B2B account, pending migration), shared_with_email (email address the resource was shared with), user_type (external user type as reported by SharePoint), site_url (URL of the externally shared site/resource), created_date (when the external share was created), expiration_date (when the share expires, if set)
site — SharePoint sites and their external-sharing policy (GetSitePropertiesFromSharePointByFilters API): site_url (site collection URL), sharing_capability (external sharing level: Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing, ExistingExternalUserSharingOnly), sharing_domain_restriction_mode (domain restriction mode: None, AllowList, BlockList), sharing_allowed_domain_list (allow-listed external domains, null when no allow-list), storage_used (storage used in MB), template (site template)
Official documentation
Need help? Contact [email protected].
