# SharePoint

> Source: https://truto.one/docs/integration-guides/sharepoint/

SharePoint connects through Microsoft Graph in one of two ways: a user signs in with their Microsoft work or school account (OAuth 2.0), or Truto uses an app registration in your customer's Microsoft Entra tenant with no user involved (OAuth 2.0 Client Credentials).

## Install the SharePoint integration

Install SharePoint from [Available integrations](https://app.truto.one/integrations/available/1c925bad-07ec-40fc-9913-e7c4de124d0c) in each environment you connect accounts from.

## Use your own SharePoint OAuth app (optional)

Truto ships a SharePoint OAuth app, so OAuth 2.0 works without any setup. To show your own app on the consent screen instead, register an app in Microsoft Entra ID that allows accounts in any organizational directory, register the redirect URL below, and set the app's Client ID and Client Secret on the installed integration. See [Overriding OAuth credentials](/docs/guides/integrations/overriding-oauth-credentials).

```text
https://api.truto.one/connect/sharepoint/callback
```

By default, Truto asks SharePoint for these scopes. The connect screen lists them under **Permissions required**, and you can change them when you override the OAuth credentials.

- `email`
- `offline_access`
- `openid`
- `profile`
- `https://graph.microsoft.com/User.Read`
- `https://graph.microsoft.com/User.Read.All`
- `https://graph.microsoft.com/Group.Read.All`
- `https://graph.microsoft.com/GroupMember.Read.All`
- `https://graph.microsoft.com/Files.Read`
- `https://graph.microsoft.com/Files.Read.All`
- `https://graph.microsoft.com/Sites.Read.All`
- `https://graph.microsoft.com/Sites.ReadWrite.All`
- `https://graph.microsoft.com/Sites.FullControl.All`
- `https://graph.microsoft.com/Sites.Manage.All`
- `https://graph.microsoft.com/Files.ReadWrite`
- `https://graph.microsoft.com/Files.ReadWrite.All`

## Set up an app for client credentials

Only needed for the **OAuth 2.0 Client Credentials** method. Do this in the Microsoft Entra tenant whose SharePoint you are connecting.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and go to **Entra ID** → **App registrations** → **New registration**. Enter a name and click **Register**.
2. On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
3. Open **Certificates & secrets**, create a client secret and copy its value. Microsoft shows the value only once.
4. Open **API permissions** → **Add a permission** → **Microsoft Graph** → **Application permissions**, and add the permissions for the SharePoint data you need. The delegated permissions in the list above show what the OAuth 2.0 method reads and writes.
5. Click **Grant admin consent** for your tenant. Application permissions always need an administrator's consent.

See Microsoft's [Register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) and [Get access without a user](https://learn.microsoft.com/en-us/graph/auth-v2-service) guides.

## Connect a SharePoint account

1. Click **Connect Account**.
   ![Click Connect Account](https://docs-assets.truto.one/truto-connect-account.png)
2. Enter a Tenant ID. This can be any ID you choose. Click **Get connection link**.
   ![Get connection link](https://docs-assets.truto.one/truto-connect-account-modal.png)
3. Open the generated link. You can also share it with your customer so they connect their own SharePoint account.
   ![Share connection link](https://docs-assets.truto.one/truto-connect-account-link.png)
4. Select **SharePoint**.
5. Pick an authentication method: **OAuth 2.0**, **OAuth 2.0 Client Credentials**. Each one is described below.

### OAuth 2.0

Click **Connect**.

Sign in with a Microsoft account and allow access. Only work or school accounts can sign in. Some of the permissions Truto asks for need an administrator's consent, so an admin may have to approve the app.

### OAuth 2.0 Client Credentials

Fill in the form and click **Connect**:

| Field | Required | What to enter |
|---|---|---|
| **Client ID** | Yes | The app's **Application (client) ID**. |
| **Client Secret** | Yes | The client secret **Value**. |
| **Tenant ID** | Yes | The **Directory (tenant) ID**. |

Create the app registration first; see [Set up an app for client credentials](#set-up-an-app-for-client-credentials).

The new account appears under **Integrated Accounts**. Click its Account ID to see its details and make API calls.