> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/storage/integrations/sharepoint/sharepoint-restrictive-permissions-app-registration.md).

# SharePoint - Restrictive Permissions (App Registration)

How to connect SharePoint to Couchdrop using an application registered in Microsoft Entra

## Overview

Couchdrop can connect to SharePoint using **Application Access** through an application registered in Microsoft Entra.

This method uses the Microsoft Graph `Sites.Selected` permission to restrict the application to specific SharePoint sites, rather than granting access across the entire SharePoint environment.

To configure this connection, you will create an application in Microsoft Entra, grant it access to the required SharePoint site using Microsoft Graph Explorer, and then connect the application to Couchdrop.

## How to connect SharePoint using Application Access

{% hint style="warning" %}

#### Before you start

To configure SharePoint Application Access, you will need:

* Access to the **Microsoft Entra admin center**
* Permission to register applications and grant admin consent in Microsoft Entra
* Access to **Microsoft Graph Explorer**
* The SharePoint site you want Couchdrop to access
  {% endhint %}

### Configure an application in Microsoft Entra

{% stepper %}
{% step %}

#### Register an application

Open the [Microsoft Entra admin center](https://entra.microsoft.com/) and go to **App registrations**.

Select **New registration**, enter a name for the application, such as `Couchdrop-SharePoint`, and leave the remaining options at their defaults.

Select **Register**.
{% endstep %}

{% step %}

#### Copy the Client ID and Tenant ID

From the application's **Overview** page, copy:

* **Application (client) ID**
* **Directory (tenant) ID**

You will need both values when configuring the SharePoint connection in Couchdrop.
{% endstep %}

{% step %}

#### Create a Client Secret

Open **Certificates & secrets** and select **New client secret**.

Enter a description, select an expiry period, and select **Add**.

Copy the secret **Value** before leaving the page. Microsoft Entra will not display the value again.
{% endstep %}

{% step %}

#### Add the Sites.Selected permission

Open **API permissions** and select **Add a permission**.

Select:

**Microsoft Graph** → **Application permissions**

Find and enable:

`Sites.Selected`

Select **Add permissions**, then select **Grant admin consent for \[Your Organization]**.
{% endstep %}
{% endstepper %}

### Grant access to the SharePoint site

The `Sites.Selected` permission does not give the application access to SharePoint sites by itself.

You must explicitly grant the application permission to each SharePoint site Couchdrop needs to access.

#### Find the SharePoint Site ID

Open the following URL in your browser, replacing the tenant and site name with your SharePoint values:

```
https://<tenant>.sharepoint.com/sites/<siteName>/_api/site/id
```

For example:

```
https://couchdropdemo.sharepoint.com/sites/MySite/_api/site/id
```

The response contains the SharePoint Site ID. For example:

```xml
<d:Id xmlns:d="http://schemas.microsoft.com/ado/2007/08/dataservices" xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata" xmlns:georss="http://www.georss.org/georss" xmlns:gml="http://www.opengis.net/gml" m:type="Edm.Guid">29cf2814-a045-4b48-8b1b-6bd01f57d632</d:Id>
```

Copy the GUID value. You will use it when granting the application access.

#### Grant permissions using Microsoft Graph Explorer

{% stepper %}
{% step %}

#### Sign in to Graph Explorer

Open [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer) and sign in with your Microsoft account.

Select your user icon, then select **Consent to permissions**.

Grant your account the `Sites.FullControl.All` permission.
{% endstep %}

{% step %}

#### Grant the application access to the SharePoint site

In Graph Explorer, send a `POST` request to:

```
https://graph.microsoft.com/v1.0/sites/<site_id>/permissions
```

Replace `<site_id>` with the Site ID retrieved earlier.

Use the following request body:

```json
{
  "roles": ["write"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "<APPLICATION_CLIENT_ID>",
        "displayName": "<APPLICATION_DISPLAY_NAME>"
      }
    }
  ]
}
```

Replace:

* `<APPLICATION_CLIENT_ID>` with the **Application (client) ID** from Microsoft Entra
* `<APPLICATION_DISPLAY_NAME>` with the name of your registered application

Select **Run Query**.

A successful request returns:

`201 Created`
{% endstep %}

{% step %}

#### Grant the application access to the root site

Send another `POST` request to:

```
https://graph.microsoft.com/v1.0/sites/root/permissions
```

Use the same application details:

```json
{
  "roles": ["write"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "<APPLICATION_CLIENT_ID>",
        "displayName": "<APPLICATION_DISPLAY_NAME>"
      }
    }
  ]
}
```

Select **Run Query**.

A successful request returns:

`201 Created`
{% endstep %}
{% endstepper %}

### Connect SharePoint to Couchdrop

Once the Microsoft Entra application has been configured and granted access to the required SharePoint site, you can use it to create the SharePoint connection in Couchdrop.

{% stepper %}
{% step %}

#### Add a SharePoint connection

In Couchdrop, add a new storage connection and select **SharePoint** from the list of available connections.

Enter a name for the integration and select the **Couchdrop folder path** where the connection will appear.
{% endstep %}

{% step %}

#### Use Application Access

Disable **Delegated OAuth Access** to configure the connection using Application Access.

Enter:

* **SharePoint Domain**
* **Client ID**
* **Directory (Tenant) ID**
* **Client Secret**

Use the values from the Microsoft Entra application you configured earlier.
{% endstep %}

{% step %}

#### Specify the SharePoint folder path

When using `Sites.Selected`, manually specify the SharePoint location that Couchdrop should access.

Use the following path format:

```
/sharepointsite:/sites/<siteName>:/Documents/<optional-subfolder-path>
```

Replace `<siteName>` with the SharePoint site that was granted access.

You can also include a subfolder beneath the site's **Documents** library when required.
{% endstep %}

{% step %}

#### Verify your connection

Select **Save and Test** to verify the SharePoint connection.

The connection will succeed only where the registered application has been granted the required SharePoint site permissions.
{% endstep %}

{% step %}

#### Add the integration

Optionally, configure **Transfer Shield** to surface or block unexpected, non-compliant, or malicious files uploaded through this connection.

When the configuration is complete, select **Add Integration**.
{% endstep %}
{% endstepper %}

## Frequently asked questions

<details>

<summary>Why use Sites.Selected instead of broader SharePoint permissions?</summary>

`Sites.Selected` allows the Microsoft Entra application to be granted access only to specific SharePoint sites.

The application cannot access a site until permission to that site has also been explicitly granted through Microsoft Graph.

</details>

<details>

<summary>Do I need to grant access to every SharePoint site?</summary>

Yes. When using `Sites.Selected`, grant the application permission to each SharePoint site Couchdrop needs to access.

</details>

<details>

<summary>Why do I need to manually enter the SharePoint folder path?</summary>

Application Access using `Sites.Selected` limits the SharePoint locations available to the application.

Manually specifying the path ensures Couchdrop connects to the SharePoint site that has been granted access.

</details>

<details>

<summary>What happens when the Client Secret expires?</summary>

The SharePoint connection uses the Client Secret created for the Microsoft Entra application. If that secret expires, you will need to create a replacement secret and update the connection in Couchdrop.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.couchdrop.io/storage/integrations/sharepoint/sharepoint-restrictive-permissions-app-registration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.