OpenCoreDocuments & KnowledgeConnectors

SharePoint

View as Markdown

What it indexes

The SharePoint connector can index documents from SharePoint libraries and .aspx site pages. Configure whole sites, a library, or a folder by URL. If no site URL is supplied, the connector discovers tenant sites; tenant-wide discovery requires the application to read all sites, and individual sites can still reject content access.

SettingIndexing effect
SitesFull https:// SharePoint URLs under /sites/ or /teams/; a library or folder path narrows the selected site. Empty means tenant-wide site discovery.
Index DocumentsIncludes supported files from selected libraries or folders.
Index ASPX SitesIncludes site pages from each selected site, even when a library or folder URL is supplied.
Excluded SitesExact URLs or glob patterns that are never indexed.
Excluded PathsGlob patterns matched against each relative document path and filename.

At least one of Index Documents or Index ASPX Sites must be enabled. The current site-path mapping recognizes the built-in shared-document library names used by English, Spanish, and German SharePoint sites.

Prerequisites

  • Create a Microsoft Entra application registration in the correct tenant and grant administrator consent for the application permissions needed to list sites and read the selected content.
  • Record the application client ID and directory (tenant) ID. Choose either a client secret or a PFX certificate credential.
  • For source-permission sync, the application also needs SharePoint Sites.FullControl.All to enumerate role assignments and Microsoft Graph GroupMember.Read.All or an equivalent directory permission to expand groups.
  • Use full SharePoint URLs. The connector rejects non-HTTPS URLs and URLs without /sites/<NAME> or /teams/<NAME>.
  • Government cloud deployments must set the matching authority host and Graph API host; OpenCore resolves the corresponding SharePoint domain suffix from that environment.

Credentials

MethodOpenCore credential valuesPermission-sync support
Client secretsp_client_id: <CLIENT_ID>, sp_client_secret: <CLIENT_SECRET>, sp_directory_id: <DIRECTORY_ID>The Admin UI disables Auto Sync Permissions for this authentication method.
Certificatesp_client_id: <CLIENT_ID>, sp_directory_id: <DIRECTORY_ID>, sp_certificate_password: <PFX_PASSWORD>, and the uploaded sp_private_key PFX fileSupports Auto Sync Permissions when the deployment and application permissions provide it.

SharePoint connector OAuth is not implemented. Create the application credential in the Admin panel and rotate the secret or certificate through your organization’s normal process.

Configure in OpenCore

  1. In the Admin panel, open Connectors, choose SharePoint, and create a client-secret or certificate credential.
  2. Add the approved site, library, or folder URLs. Leave the list empty only when tenant-wide discovery is intended and approved.
  3. Enable documents, site pages, or both.
  4. Add excluded site and path patterns before the first broad crawl.
  5. Leave the standard authority, Graph, and domain values unchanged unless the tenant uses a supported government cloud.
  6. Keep Treat sharing links as public disabled unless anonymous or organization-wide links are explicitly allowed to make content visible to every OpenCore account.
  7. Choose the supported document access mode, create the connector, and run the initial index attempt.

Permissions

When Auto Sync Permissions is available, use certificate authentication and grant both permission surfaces described above. OpenCore then reads SharePoint role assignments, expands Microsoft Entra groups, and attaches source access to documents and site pages. Permission probes can reject connector creation when configured sites deny role-assignment access or Graph denies group enumeration.

Client-secret authentication cannot select Auto Sync Permissions in the current Admin UI. When sync is unavailable or not selected, source permissions are not enforced automatically in search; choose Private with explicit OpenCore user groups, or Public only for content approved for every account. Enabling Treat sharing links as public deliberately broadens anonymous or organization-wide sharing links to public OpenCore access.

Verify

  1. Confirm credential validation can acquire a Microsoft Graph application token.
  2. Run an index attempt and verify one expected document and one expected site page when both types are enabled.
  3. Confirm excluded sites, paths, and unsupported files do not appear.
  4. Check that a folder URL does not pull sibling folders from the same library.
  5. If Auto Sync Permissions is selected, test an allowed user, a denied user, and membership through a Microsoft Entra group.

Troubleshooting

SymptomCheck
Site URL is rejectedUse a full HTTPS SharePoint URL containing /sites/<NAME> or /teams/<NAME>.
Tenant-wide discovery returns no usable sitesGrant the required site-read application permission and verify content access on each intended site.
Auto Sync Permissions is disabledSwitch from client-secret to certificate authentication and create a certificate credential.
Role-assignment validation failsGrant SharePoint Sites.FullControl.All, consent it, and grant the app full control on each site when using Sites.Selected.
Group expansion failsGrant GroupMember.Read.All or an equivalent approved Microsoft Graph directory permission and repeat admin consent.
Government cloud authentication failsUse the matching authority and Graph hosts; do not mix commercial and government endpoints.