SharePoint Connector

The SharePoint connector syncs one folder in a SharePoint document library, subfolders included, into a connected folder. There are two ways to connect it:

Card	Signs in as	Pick this when
SharePoint	You, through a Microsoft sign-in popup	You want to sync sites your own account can open
SharePoint Keys	An Entra app registration, with a client secret	You want a connection that isn’t tied to a person, or your tenant doesn’t allow user consent

Connect SharePoint by signing in

1. On Files → Connections, click Add connection, pick SharePoint, and click Authorize.
2. Sign in with your Microsoft work account and accept every permission the popup asks for.

The connection reads the SharePoint sites your account can open. It asks for the delegated Sites.Read.All and Sites.FullControl.All permissions. The second lets a sync notice when a folder is shared or unshared; without it, permission changes only show up on a full resync. Many tenants only let an admin grant these. If the popup asks for admin approval, the dialog may show a link labeled “Your admin may need to approve SharePoint access”; send that link to a Global or Application Administrator in your tenant. Once they approve it, try again.

If you untick a permission during sign-in, the connection is refused with a message naming the missing permission, such as “This connection is missing Sites.FullControl.All”. Connect again and accept everything.

Connect SharePoint with an Entra app registration

The app registration reads SharePoint as itself, with no user signed in.

1. In the Microsoft Entra admin center, go to App registrations and create a new registration. The defaults are fine; it doesn’t need a redirect URI.

2. Under API permissions, click Add a permission → Microsoft Graph → Application permissions and add:

   • Required, one of: Sites.Selected, Sites.Read.All, Sites.ReadWrite.All, or Sites.FullControl.All. Sites.Selected is the narrowest: the app reads only the sites an admin grants it one by one. The others reach every site in the tenant.
   • Optional: Sites.FullControl.All, which also lets a sync read who has access to each file. Without it, files and folders still sync.

3. Click Grant admin consent for your tenant. The status column should show a green check for each permission.

4. If you chose Sites.Selected, grant the app access to each site it should read. A SharePoint or Global Administrator does this per site, for example with Graph:

   POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
   {
     "roles": ["read"],
     "grantedToIdentities": [
       { "application": { "id": "{client-id}", "displayName": "LlamaCloud" } }
     ]
   }

   or with PnP PowerShell’s Grant-PnPAzureADAppSitePermission.

5. Under Certificates & secrets, create a client secret and copy its Value. Azure shows the value once. The secret’s ID is a different thing and won’t work.

6. On Files → Connections, click Add connection, pick SharePoint Keys, and fill in:

Field	Where to find it
Directory (tenant) ID	The app’s Overview page. Your tenant’s verified domain also works.
Application (client) ID	The app’s Overview page
Client secret	The secret value from step 5

Click Connect. LlamaCloud gets a token for the app and checks the permissions it carries before saving, so most setup mistakes show up right here with Entra’s own error. The two common ones:

• “This app registration has no SharePoint site permission”: none of the required permissions was consented, or one was added as a delegated permission instead of an application permission. The error lists what the token actually carries.
• An AADSTS error about the secret: you pasted the secret ID instead of the value, or the secret has expired.

Which sites a Sites.Selected app may read isn’t part of its token, so that’s checked when you create a folder from the connection, not here.

Create a folder from a SharePoint connection

From Files → New folder → Connected folder, pick your SharePoint connection.

Signed-in connection: Microsoft’s own file picker opens. Choose one folder; everything in it syncs, subfolders included.

App registration connection: there’s no picker, because an app has no user to browse as. Enter the location by ID:

Field	What to enter
Site	The site ID, e.g. contoso.sharepoint.com,7a2b…,9c4d…
Document library	The library (drive) ID, e.g. b!xY3z…
Folder	The folder’s item ID, e.g. 01ABCDEF2GHIJKLM…

The form also has boxes for names and paths, but IDs are the reliable way in today. You can get all three from Graph Explorer while signed in as someone who can open the site:

# Site ID
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/Marketing

# Document library IDs for that site
GET https://graph.microsoft.com/v1.0/sites/{site-id}/drives

# Folder ID, by its path inside the library
GET https://graph.microsoft.com/v1.0/drives/{drive-id}/root:/brand/assets

The id field in each response is what goes in the form. Name the folder and click Create folder.

How the SharePoint connector syncs

After the first full copy, each sync asks Microsoft Graph for what changed since the last one. Edited files are downloaded again, and files deleted or moved out of the folder are removed from your project folder.

Troubleshooting the SharePoint connector

Message	What to check
”This app registration has no admin-consented application permissions”	Admin consent wasn’t granted, or the permissions were added as delegated. Add them under Application permissions and grant consent.
”This app registration has no SharePoint site permission”	Add Sites.Selected or a tenant-wide Sites.* permission under Application permissions and grant consent.
”Scope not accessible” when creating a folder from an app registration connection	With Sites.Selected, the app hasn’t been granted access to that site. Grant it as in step 4.
”SharePoint refused this connection despite …”	For a signed-in connection: consent was granted in a different tenant from the one you signed in to.
”SharePoint rejected this connection’s token”	For a signed-in connection: sign in again.
”This account’s token is for …, but the SharePoint file picker requires one for …”	The picker can’t open with this sign-in. Use an app registration connection and enter the folder by ID.