SharePoint - Restrictive Permissions (App Registration)

How to connect SharePoint to Couchdrop using an application registered in Microsoft Entra

Overview

Couchdrop can connect to SharePoint using Application Access through an application registered in Microsoft Entra.

This method uses the Microsoft Graph Sites.Selected permission to restrict the application to specific SharePoint sites, rather than granting access across the entire SharePoint environment.

To configure this connection, you will create an application in Microsoft Entra, grant it access to the required SharePoint site using Microsoft Graph Explorer, and then connect the application to Couchdrop.

How to connect SharePoint using Application Access

Before you start

To configure SharePoint Application Access, you will need:

• Access to the Microsoft Entra admin center
• Permission to register applications and grant admin consent in Microsoft Entra
• Access to Microsoft Graph Explorer
• The SharePoint site you want Couchdrop to access

Configure an application in Microsoft Entra

1

Register an application

Open the Microsoft Entra admin center and go to App registrations.

Select New registration, enter a name for the application, such as Couchdrop-SharePoint, and leave the remaining options at their defaults.

Select Register.

2

Copy the Client ID and Tenant ID

From the application's Overview page, copy:

• Application (client) ID
• Directory (tenant) ID

You will need both values when configuring the SharePoint connection in Couchdrop.

3

Create a Client Secret

Open Certificates & secrets and select New client secret.

Enter a description, select an expiry period, and select Add.

Copy the secret Value before leaving the page. Microsoft Entra will not display the value again.

4

Add the Sites.Selected permission

Open API permissions and select Add a permission.

Select:

Microsoft Graph → Application permissions

Find and enable:

Sites.Selected

Select Add permissions, then select Grant admin consent for [Your Organization].

Grant access to the SharePoint site

The Sites.Selected permission does not give the application access to SharePoint sites by itself.

You must explicitly grant the application permission to each SharePoint site Couchdrop needs to access.

Find the SharePoint Site ID

Open the following URL in your browser, replacing the tenant and site name with your SharePoint values:

https://<tenant>.sharepoint.com/sites/<siteName>/_api/site/id

For example:

https://couchdropdemo.sharepoint.com/sites/MySite/_api/site/id

The response contains the SharePoint Site ID. For example:

<d:Id xmlns:d="http://schemas.microsoft.com/ado/2007/08/dataservices" xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata" xmlns:georss="http://www.georss.org/georss" xmlns:gml="http://www.opengis.net/gml" m:type="Edm.Guid">29cf2814-a045-4b48-8b1b-6bd01f57d632</d:Id>

Copy the GUID value. You will use it when granting the application access.

Grant permissions using Microsoft Graph Explorer

1

Sign in to Graph Explorer

Open Microsoft Graph Explorer and sign in with your Microsoft account.

Select your user icon, then select Consent to permissions.

Grant your account the Sites.FullControl.All permission.

2

Grant the application access to the SharePoint site

In Graph Explorer, send a POST request to:

https://graph.microsoft.com/v1.0/sites/<site_id>/permissions

Replace <site_id> with the Site ID retrieved earlier.

Use the following request body:

{
  "roles": ["write"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "<APPLICATION_CLIENT_ID>",
        "displayName": "<APPLICATION_DISPLAY_NAME>"
      }
    }
  ]
}

Replace:

• <APPLICATION_CLIENT_ID> with the Application (client) ID from Microsoft Entra
• <APPLICATION_DISPLAY_NAME> with the name of your registered application

Select Run Query.

A successful request returns:

201 Created

3

Grant the application access to the root site

Send another POST request to:

https://graph.microsoft.com/v1.0/sites/root/permissions

Use the same application details:

{
  "roles": ["write"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "<APPLICATION_CLIENT_ID>",
        "displayName": "<APPLICATION_DISPLAY_NAME>"
      }
    }
  ]
}

Select Run Query.

A successful request returns:

201 Created

Connect SharePoint to Couchdrop

Once the Microsoft Entra application has been configured and granted access to the required SharePoint site, you can use it to create the SharePoint connection in Couchdrop.

1

Add a SharePoint connection

In Couchdrop, add a new storage connection and select SharePoint from the list of available connections.

Enter a name for the integration and select the Couchdrop folder path where the connection will appear.

2

Use Application Access

Disable Delegated OAuth Access to configure the connection using Application Access.

Enter:

• SharePoint Domain
• Client ID
• Directory (Tenant) ID
• Client Secret

Use the values from the Microsoft Entra application you configured earlier.

3

Specify the SharePoint folder path

When using Sites.Selected, manually specify the SharePoint location that Couchdrop should access.

Use the following path format:

/sharepointsite:/sites/<siteName>:/Documents/<optional-subfolder-path>

Replace <siteName> with the SharePoint site that was granted access.

You can also include a subfolder beneath the site's Documents library when required.

4

Verify your connection

Select Save and Test to verify the SharePoint connection.

The connection will succeed only where the registered application has been granted the required SharePoint site permissions.

5

Add the integration

Optionally, configure Transfer Shield to surface or block unexpected, non-compliant, or malicious files uploaded through this connection.

When the configuration is complete, select Add Integration.

Frequently asked questions

Why use Sites.Selected instead of broader SharePoint permissions?

Sites.Selected allows the Microsoft Entra application to be granted access only to specific SharePoint sites.

The application cannot access a site until permission to that site has also been explicitly granted through Microsoft Graph.

Do I need to grant access to every SharePoint site?

Yes. When using Sites.Selected, grant the application permission to each SharePoint site Couchdrop needs to access.

Why do I need to manually enter the SharePoint folder path?

Application Access using Sites.Selected limits the SharePoint locations available to the application.

Manually specifying the path ensures Couchdrop connects to the SharePoint site that has been granted access.

What happens when the Client Secret expires?

The SharePoint connection uses the Client Secret created for the Microsoft Entra application. If that secret expires, you will need to create a replacement secret and update the connection in Couchdrop.