SharePoint Connector

The SharePoint connector syncs one folder in a SharePoint document library, subfolders included, into a connected folder. There are two ways to connect it:

Card	Signs in as	Pick this when
SharePoint	You, through a Microsoft sign-in popup	You want to sync sites your own account can open
SharePoint Keys	An Entra app registration, with a client secret	You want a connection that isn’t tied to a person, or your tenant doesn’t allow user consent

Connect SharePoint by signing in

1. On Files → Connections, click Add connection, pick SharePoint, and click Authorize.
2. Sign in with your Microsoft work account and accept every permission the popup asks for.

The connection reads the SharePoint sites your account can open. It asks for the delegated Sites.Read.All permission, and many tenants only let an admin grant that. If the popup asks for admin approval, the dialog may show a link labeled “Your admin may need to approve SharePoint access”; send that link to a Global or Application Administrator in your tenant. Once they approve it, try again.

If you untick a permission during sign-in, the connection is refused with “This connection was authorized without Sites.Read.All”. Connect again and accept everything.

Connect SharePoint with an Entra app registration

The app registration reads SharePoint as itself, with no user signed in.

1. In the Microsoft Entra admin center, go to App registrations and create a new registration. The defaults are fine; it doesn’t need a redirect URI.
2. Under API permissions, click Add a permission → Microsoft Graph → Application permissions and add all three:
   • Sites.Read.All
   • Files.Read.All
   • BrowserSiteLists.Read.All
3. Click Grant admin consent for your tenant. The status column should show a green check for all three.
4. Under Certificates & secrets, create a client secret and copy its Value. Azure shows the value once. The secret’s ID is a different thing and won’t work.
5. On Files → Connections, click Add connection, pick SharePoint Keys, and fill in:

Field	Where to find it
Directory (tenant) ID	The app’s Overview page. Your tenant’s verified domain also works.
Application (client) ID	The app’s Overview page
Client secret	The secret value from step 4

Click Connect. LlamaCloud gets a token for the app and reads your tenant’s root site with it before saving, so most setup mistakes show up right here with Entra’s own error. The two common ones:

• “This app registration is missing …”: one of the three permissions is missing, or it was added as a delegated permission instead of an application permission. The error lists what the token actually carries.
• An AADSTS error about the secret: you pasted the secret ID instead of the value, or the secret has expired.

Sites.Selected isn’t supported. The connection needs all three permissions above with tenant-wide admin consent, so it can read every site in the tenant. If that’s too broad for your tenant, use the sign-in connection instead, which is limited to what one user can open.

Create a folder from a SharePoint connection

From Files → New folder → Connected folder, pick your SharePoint connection.

Signed-in connection: Microsoft’s own file picker opens. Choose one folder; everything in it syncs, subfolders included.

App registration connection: there’s no picker, because an app has no user to browse as. Enter the location by ID:

Field	What to enter
Site	The site ID, e.g. contoso.sharepoint.com,7a2b…,9c4d…
Document library	The library (drive) ID, e.g. b!xY3z…
Folder	The folder’s item ID, e.g. 01ABCDEF2GHIJKLM…

The form also has boxes for names and paths, but IDs are the reliable way in today. You can get all three from Graph Explorer while signed in as someone who can open the site:

# Site ID
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/Marketing

# Document library IDs for that site
GET https://graph.microsoft.com/v1.0/sites/{site-id}/drives

# Folder ID, by its path inside the library
GET https://graph.microsoft.com/v1.0/drives/{drive-id}/root:/brand/assets

The id field in each response is what goes in the form. Name the folder and click Create folder.

How the SharePoint connector syncs

After the first full copy, each sync asks Microsoft Graph for what changed since the last one. Edited files are downloaded again, and files deleted or moved out of the folder are removed from your project folder.

Troubleshooting the SharePoint connector

Message	What to check
”This app registration has no admin-consented application permissions”	Admin consent wasn’t granted, or the permissions were added as delegated. Add them under Application permissions and grant consent.
”SharePoint refused this connection despite …”	Consent was granted in a different tenant from the one in Directory (tenant) ID.
”SharePoint rejected this connection’s token”	The secret was rotated or deleted after the connection was made.
”This account’s token is for …, but the SharePoint file picker requires one for …”	The picker can’t open with this sign-in. Use an app registration connection and enter the folder by ID.