Sharepoint via Graph API permissions
Use the following sequence to setup permissions in Entra for access to Sharepoint object via Graph API. This is the modern approach to integration with Sharepoint, and requires an iPaaS license for Square 9. To configure the iPaaS node you will need the following from the App registration:
Tenant ID
Applicaiton (client) ID
Client Secret
Microsoft will from time to time update interfaces and documentation. It’s always advised to refer to current docs for proper configuration.
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
Creating the App Registration
Login to your Microsoft Entra admin center (Azure AD) and create an App registration. Expand Entra ID, select App registrations, then click +New registration.
Create a New App Registration
Give your App registration a Name and select the appropriate Supported account types. A Redirect URI is not required for this application.
Name your App
Click Register.
From the Applications left menu, select API Permissions.
Access Permissions
Click + Add a permission.
Adding New Permissions
From Request API permissions select Microsoft Graph.
Adding New Permissions (con)
Select Application permissions.
Add Graph API permissions. Use Sites.ReadWrite.All for broad access, or Sites.Selected for granular access. Navigate and expand Sites or start typing to filter the available permissions.
Sites.Selected configuration:
Use PowerShell (
Grant-PnPAzureADAppSitePermission) or Graph API to grant site-level access.You can specify
read,write,fullcontrol, ormanagepermission levels.
Click Add permissions.
Adding Site Permissions
An administrator must grant consent for those permissions. Click Grant admin consent.
Granting Access
You will need to generate a Client Secret. From the Applications left menu, select Certificates & secrets.
Generating a Client Secret
On the Client secrets tab, click + New client secret.
Creating a New Secret
Give your new secret a Description and set an Expires date.
You will need to make sure you refresh the secret prior to it’s expiration for continued fuction.
Secret Description and Expiration
App registration will generate a client secret. Make sure you record the Value of this secret as it will be obscured and can no longer be accessed.
If you lose the secret value or don’t record it, you will need to generate a new secret.
Record the Secret Value
From the Applications left menu, select Overview.
In the Essentials area of the overview, you can find the Application (client) ID and Directory (tenant) ID. Record these values.
Record the Applicaiton ID and the Tenant ID
Please note, Square 9 cannot assist with granular permissions assignments for how to implement them. Contact your Entra support team if you need help specifically with point 4 above.
Getting the siteId and the driveId
When configuring the document release, you will need to obtain the Site ID and the Drive ID for your SharePoint instance.
There are multiple ways in which to obtain this information.
Site ID
Copy the URL of your SharePoint server and add it to a new browser tab.
https://yourcompany.sharepoint.com/sites/yoursitenameAdd /_api/site/id/ to the end of the URL.
https://yourcompany.sharepoint.com/sites/yoursitename/_api/site/id/In the string that appears, the value after Emd.Guid is the Site ID.
Getting Site ID
Drive ID
Open Microsoft Graph Explorer and login.
Using the Site ID, use the query below to list the drives and document libraries.
https://graph.microsoft.com/v1.0/sites/yourcompany.sharepoint.com,yoursiteID/drivesSelect Run query.
In the Response Preview window, the response will list all the document libraries and their Drive IDs.
Identify the library of interest and copy its id.
Getting the Drive ID
Using Graph API to Make Requests
Tools like Powershell or Postman will support making Graph API requests. You can also use plugins to VS Code for quick testing and pulling of data. REST Client for VS Code has > 6 million downloads and is easy to use for quick tests.
Graph API testing with SharePoint