> For the complete documentation index, see [llms.txt](https://docs.ixhello.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ixhello.com/ixhc/sharepoint-setup-on-microsoft-entra-id.md).
# SharePoint Setup on Microsoft Entra ID
1\. Create Multi-Tenant App (One-Time Setup)
Step 1: Register App
* Go to: Microsoft Entra ID
* Navigate to:
* App registrations → New registration
* Fill details:
* Name: YourAppName
* Supported account types:\
Accounts in any organizational directory (Multi-tenant)
* Redirect URI: (optional for app-only)
* Click Register
***
Step 2: Capture Required Values
After creation, copy:
* Application (Client) ID
* Directory (Tenant) ID
* Client Secret (create new client secret under *Certificates & Secrets*)
***
Configure API Permissions (Application Permissions)
Go to:\
API Permissions → Add Permission → Microsoft Graph
Add:
Required Permissions:
* Sites.Read.All *(Read access)*
* Sites.ReadWrite.All *(Write access)*
Choose Application Permissions (NOT Delegated)
***
Step 3: Grant Admin Consent
Click:\
Grant admin consent
This is required for your home tenant only
***
Multi-Tenant Client Onboarding (Important)
Each client tenant must authorize your app.
***
Admin Consent URL (Recommended)
Send this URL to client admin:
Example:
What happens:
* Client admin logs in
* Accepts permissions
* Your app is now trusted in their tenant
***
Enterprise App Auto Creation
After consent:
* Your app appears in:\
Enterprise Applications in client tenant
***
Step 4: Generate Access Token (Client Credentials Flow)
Use:
POST
Body (x-www-form-urlencoded):
client\_id=YOUR\_CLIENT\_ID\
client\_secret=YOUR\_CLIENT\_SECRET\
scope=
grant\_type=client\_credentials
***
Step 5: Access SharePoint Sites
Now you can call:
GET
or
GET
***
Problem: Shows ALL Sites?
Yes — by default:
Sites.Read.All gives access to ALL sites in tenant
***
Step 6: Restrict Site Access (IMPORTANT)
To limit access to specific sites only, use:
Sites.Selected Permission
***
Change Permission
Instead of:
Sites.Read.All
Use:
Sites.Selected
***
Grant Site-Level Access via API / PowerShell
Now your app has NO access by default\
You must explicitly assign access per site.
***
Using Microsoft Graph API
POST
Body:
{\
"roles": \["write"],\
"grantedToIdentities": \[\
{\
"application": {\
"id": "YOUR\_CLIENT\_ID",\
"displayName": "Your App Name"\
}\
}\
]\
}
***
Using PowerShell
Using Microsoft Graph PowerShell SDK:
Connect-MgGraph -Scopes "Sites.FullControl.All"\
\
Grant-MgSitePermission \`\
-SiteId "SITE\_ID" \`\
-Roles "write" \`\
-ApplicationId "YOUR\_CLIENT\_ID"
***
Step 7: How Your App Should Work (Architecture)
Your Flow:
* Store:
* TenantId
* ClientId
* ClientSecret
* When user selects tenant:
* Generate token dynamically
* Call Graph API
* Fetch:
* Sites
* Drives
* Files
***
Step 8: Show Only Allowed Sites in UI
Since you're using Sites.Selected, you can:
Step 9: Testing via Postman
* Get Token
* Call API
Example:
GET
Authorization: Bearer \
***
Step 10: Common Issues
| Issue | Reason | Fix |
| ----------------- | ------------------------------------- | ------------------------ |
| 403 Forbidden | No site permission | Grant via API |
| No sites returned | Using Sites.Selected but not assigned | Assign sites |
| All sites visible | Using Sites.Read.All | Switch to Sites.Selected |
| Consent error | Admin not granted | Use admin consent URL |
***
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ixhello.com/ixhc/sharepoint-setup-on-microsoft-entra-id.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.