> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SharePoint Client OAuth (Single-Tenant)
> Connect SharePoint via a single-tenant Microsoft app with delegated permissions using the StackOne Hub.
Ensure that your Microsoft account has the [**Global Administrator**](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide#permissions-based-on-admin-role-and-group-type-in-m365-admin-page) and [**SharePoint Administrator**](https://learn.microsoft.com/en-us/sharepoint/sharepoint-admin-role) roles assigned.
You can view and manage user role assignments in your [Microsoft Admin center](https://admin.microsoft.com/Adminportal/Home#/users).
This guide configures a single-tenant SharePoint app for use within your organization only. Users outside your organization cannot connect with this app. No Microsoft Partner Center account or publisher verification is required.
If you've been directed to StackOne to integrate with SharePoint using a single-tenant app, the following steps will help you configure a successful integration.
## Create and configure a new application
Log in to your [Microsoft Azure](https://portal.azure.com/) portal.
Go to your [Microsoft Entra admin center](https://entra.microsoft.com/).
In the left navigation bar, click **Applications** > **App registrations**.
Under **App registrations**, click the **+ New registration** button.
Under ***Register an application***, input the following details:
* Name
* Supported account types
* Select **Accounts in this organizational directory only (Single tenant)**
* Redirect URI
* Select **Web**
* Enter the URI: `https://api.stackone.com/connect/oauth2/sharepoint/callback`
Once complete, click **Register** to create the new application.
After registration, you'll be taken to the application overview page.
**Copy** the following values and store them safely to be used in a later step:
* Application (client) ID
* Directory (tenant) ID
Under *Client credentials* on the right, click **Add a certificate or secret**.
Under *Client secrets*, click the **+ New client secret** button.
Under *Add a client secret*, enter a description and select your desired expiration date for this secret.
Please keep in mind that a new secret will need to be generated when this one expires.
Click **Add** to proceed.
The new client secret will be displayed. **Copy** the **Value** and store it safely to be used in a later step.
Make sure to copy this value now. It will not be displayed again.
Under *Configured permissions*, click **Add a permission**.
Under *Request API permissions*, click **Microsoft Graph**.
The application requires the following **Delegated Permissions**:
* **Files.Read** - Read user files
* **Files.Read.All** - Read all files that user can access
* **Files.ReadWrite** - Read and upload user files
* **offline\_access** - Maintain access to data you have given it access to
* **User.Read** - Sign in and read user profile
* **User.ReadBasic.All** - Read all users' basic profiles
After selecting all of the listed permissions above, click **Add permissions**.
All of the added permissions will be listed under *Configured permissions*. Please ensure that all of the permissions above are listed.
Click **Grant admin consent** to approve all of the listed permissions.
Click **Yes** to confirm admin approval.
## User consent settings and non-admin connections
Tenant-wide [user consent settings](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent) in Microsoft Entra ID (**Identity** > **Applications** > **Enterprise apps** > **Consent and permissions** > **User consent settings**) affect when non-admin users can connect to this single-tenant app without prior admin action.
### When Microsoft manages your consent settings
When **Let Microsoft manage your consent settings (Recommended)** is selected, Microsoft’s managed consent policy applies. For a **single-tenant, unverified** app (like the one in this guide), non-admin users are often not allowed to grant consent on first use. In practice:
* **Option A:** An org admin connects via OAuth first and completes the consent screen. After that, non-admin users can connect without seeing the consent prompt.
* **Option B:** A non-admin user tries to connect first and is blocked with **Need admin approval**. An admin then goes to the app’s **Configured permissions** in the [Microsoft Entra admin center](https://entra.microsoft.com/) (**Enterprise applications** > your app > **Permissions**) and clicks **Grant admin consent**. After that, the non-admin user can connect successfully on a second attempt.
Granting admin consent only takes effect for the **Enterprise Application** (service principal) that is created when the app is first used in your tenant. If no user had connected yet, that object may not exist, which is why granting consent *before* any user attempt sometimes doesn’t help until after the first (failed) non-admin attempt.
### Allowing non-admins to connect on first attempt
To allow non-admin users to connect on their first attempt without an admin connecting first, change the tenant setting to **Allow user consent for apps from verified publishers, for selected permissions**.
That policy explicitly allows user consent for [apps registered in your organization](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent) (single-tenant apps) as well as verified publishers, but only for permissions your org classifies as **low impact**. To avoid prompts for the permissions this app uses (e.g. Files.Read, User.Read, offline\_access), an admin may need to [classify those permissions as low impact](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-permission-classifications) under **Consent and permissions** > **Permission classifications**. After that, non-admin users can typically complete the consent flow on first connection.
Changing to **Allow user consent for apps from verified publishers, for selected permissions** is a tenant-wide setting and may allow user consent for other apps registered in your tenant. Evaluate this against your organization’s security policy.
## Get your SharePoint base URL
Your SharePoint base URL follows this format:
```
https://{your-domain}.sharepoint.com
```
You can find this URL by:
1. Opening your Microsoft SharePoint site
2. Copying the base URL from your browser's address bar
## Available data
This integration has the following [Documents resources](/documents/introduction) available from the provider:
* Drives
* Files
* Folders