> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developers.alephant.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.alephant.io/_mcp/server. # SharePoint > Configure SharePoint site, library, folder, page, and document indexing with Microsoft application credentials. ## What it indexes The SharePoint connector can index documents from SharePoint libraries and `.aspx` site pages. Configure whole sites, a library, or a folder by URL. If no site URL is supplied, the connector discovers tenant sites; tenant-wide discovery requires the application to read all sites, and individual sites can still reject content access. | Setting | Indexing effect | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | Sites | Full `https://` SharePoint URLs under `/sites/` or `/teams/`; a library or folder path narrows the selected site. Empty means tenant-wide site discovery. | | Index Documents | Includes supported files from selected libraries or folders. | | Index ASPX Sites | Includes site pages from each selected site, even when a library or folder URL is supplied. | | Excluded Sites | Exact URLs or glob patterns that are never indexed. | | Excluded Paths | Glob patterns matched against each relative document path and filename. | At least one of **Index Documents** or **Index ASPX Sites** must be enabled. The current site-path mapping recognizes the built-in shared-document library names used by English, Spanish, and German SharePoint sites. ## Prerequisites * Create a Microsoft Entra application registration in the correct tenant and grant administrator consent for the application permissions needed to list sites and read the selected content. * Record the application client ID and directory (tenant) ID. Choose either a client secret or a PFX certificate credential. * For source-permission sync, the application also needs SharePoint `Sites.FullControl.All` to enumerate role assignments and Microsoft Graph `GroupMember.Read.All` or an equivalent directory permission to expand groups. * Use full SharePoint URLs. The connector rejects non-HTTPS URLs and URLs without `/sites/` or `/teams/`. * Government cloud deployments must set the matching authority host and Graph API host; OpenCore resolves the corresponding SharePoint domain suffix from that environment. ## Credentials | Method | OpenCore credential values | Permission-sync support | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | Client secret | `sp_client_id: `, `sp_client_secret: `, `sp_directory_id: ` | The Admin UI disables Auto Sync Permissions for this authentication method. | | Certificate | `sp_client_id: `, `sp_directory_id: `, `sp_certificate_password: `, and the uploaded `sp_private_key` PFX file | Supports Auto Sync Permissions when the deployment and application permissions provide it. | SharePoint connector OAuth is not implemented. Create the application credential in the Admin panel and rotate the secret or certificate through your organization's normal process. ## Configure in OpenCore 1. In the Admin panel, open **Connectors**, choose **SharePoint**, and create a client-secret or certificate credential. 2. Add the approved site, library, or folder URLs. Leave the list empty only when tenant-wide discovery is intended and approved. 3. Enable documents, site pages, or both. 4. Add excluded site and path patterns before the first broad crawl. 5. Leave the standard authority, Graph, and domain values unchanged unless the tenant uses a supported government cloud. 6. Keep **Treat sharing links as public** disabled unless anonymous or organization-wide links are explicitly allowed to make content visible to every OpenCore account. 7. Choose the supported document access mode, create the connector, and run the initial index attempt. ## Permissions When **Auto Sync Permissions** is available, use certificate authentication and grant both permission surfaces described above. OpenCore then reads SharePoint role assignments, expands Microsoft Entra groups, and attaches source access to documents and site pages. Permission probes can reject connector creation when configured sites deny role-assignment access or Graph denies group enumeration. Client-secret authentication cannot select Auto Sync Permissions in the current Admin UI. When sync is unavailable or not selected, source permissions are not enforced automatically in search; choose **Private** with explicit OpenCore user groups, or **Public** only for content approved for every account. Enabling **Treat sharing links as public** deliberately broadens anonymous or organization-wide sharing links to public OpenCore access. ## Verify 1. Confirm credential validation can acquire a Microsoft Graph application token. 2. Run an index attempt and verify one expected document and one expected site page when both types are enabled. 3. Confirm excluded sites, paths, and unsupported files do not appear. 4. Check that a folder URL does not pull sibling folders from the same library. 5. If Auto Sync Permissions is selected, test an allowed user, a denied user, and membership through a Microsoft Entra group. ## Troubleshooting | Symptom | Check | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | Site URL is rejected | Use a full HTTPS SharePoint URL containing `/sites/` or `/teams/`. | | Tenant-wide discovery returns no usable sites | Grant the required site-read application permission and verify content access on each intended site. | | Auto Sync Permissions is disabled | Switch from client-secret to certificate authentication and create a certificate credential. | | Role-assignment validation fails | Grant SharePoint `Sites.FullControl.All`, consent it, and grant the app full control on each site when using `Sites.Selected`. | | Group expansion fails | Grant `GroupMember.Read.All` or an equivalent approved Microsoft Graph directory permission and repeat admin consent. | | Government cloud authentication fails | Use the matching authority and Graph hosts; do not mix commercial and government endpoints. | ## Related pages * [Connectors & Indexing](/opencore/knowledge/connectors) * [Index Settings](/opencore/knowledge/index-settings)