Set Up the SharePoint (Service Account) ConnectorProfessional

The SharePoint (Service Account) Connector allows you to ingest documents from SharePoint Online sites into your project using application authentication (Microsoft Entra client credentials) instead of signing in as a user. It is a separate connector from the OneDrive and SharePoint Connector, built for organizations that cannot grant delegated user consent and can only approve application-level permissions.

Because the connector authenticates as an application, there is no signed-in user and no consent screen. Airia mints a token from your stored credential on every sync, so scheduled ingestion keeps running without anyone re-authenticating.

How it differs from the OneDrive and SharePoint Connector:

Configure Your Azure AD App

This one-time setup is performed by an Azure administrator in the Microsoft Entra tenant that owns the SharePoint sites.

1. Register Your Application in Azure AD

1. Navigate to Azure Portal > Microsoft Entra ID > App registrations.
2. Click New registration.
3. Configure the application details:
   • Name: Enter a descriptive name, such as Airia SharePoint Ingestion.
   • Supported account types: Select Accounts in this organizational directory only.
   • Redirect URI: Leave empty. There is no interactive sign-in for this connector.
4. Click Register.
5. From the app's Overview page, save the Application (client) ID and the Directory (tenant) ID. You will need both later.

2. Configure API Permissions

1. In your registered application's left menu, navigate to API permissions.

2. Click Add a permission.

3. Select Microsoft Graph.

4. Choose Application permissions.

5. Add one of the following, depending on how much of SharePoint the connector should reach:

   Permission	What the connector can reach	Extra setup
   Sites.Read.All	Every SharePoint site in the tenant	None
   Sites.Selected	Only the sites you explicitly grant it	Per-site grant, see step 4

6. Click Add permissions.

7. Click Grant admin consent for [Your Tenant Name] and confirm. Application permissions do not take effect without admin consent.

⚠️ Warning: Admin consent is the only thing that limits what this app registration can read. Airia requests every permission that has been consented to the registration, so do not grant permissions the ingestion should not have. Use a dedicated app registration for this connector rather than reusing a broadly permissioned one.

3. Obtain Your Client Secret

1. In your registered application's left menu, navigate to Certificates & secrets.
2. Click New client secret.
3. Provide a Description (e.g., Airia Client Secret) and set an appropriate Expires duration.
4. Click Add.
5. Copy the Value of the client secret immediately. It will only be shown once and is required for the Airia credential.

⚠️ Warning: When the client secret expires or is rotated in Azure, syncing stops until you update the credential in Airia. Track the secret's expiry date.

4. Grant Access to a Specific Site (Sites.Selected only)

Skip this step if you granted Sites.Read.All.

Sites.Selected gives the app registration no access until you grant it per site. Use Graph Explorer, signed in as a Global Administrator or SharePoint Administrator, and consent to Sites.FullControl.All for your admin session. You can revoke that session permission once the grant is done.

1. Retrieve the site ID:

   GET https://graph.microsoft.com/v1.0/sites/{hostname}:/sites/{site-name}

   Copy the full id value from the response. It looks like contoso.sharepoint.com,3e6f8b32-...,7b8c3b24-....

2. Grant the application read access to that site:

   POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

   Request body:

   {
     "roles": ["read"],
     "grantedToIdentities": [
       {
         "application": {
           "id": "{application-client-id}",
           "displayName": "Airia SharePoint Ingestion"
         }
       }
     ]
   }

3. (Optional) Confirm the grant:

   GET https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

   Your application should be listed with the read role.

Create the Credential in Airia

1. In Airia, go to Settings > Ecosystem > Credentials.
2. Click Add credentials.
3. Select Microsoft Graph Access Token as the Credential Type.
4. Fill in the values you saved from Azure:
   • Azure Tenant ID: The Directory (tenant) ID.
   • Azure Client ID: The Application (client) ID.
   • Azure Client Secret: The client secret value.
5. Select the Project within Airia where you want to use this credential. The credential must be visible to the project where you will create the data source.

💡 Tip: One credential can back several SharePoint, OneDrive, and Outlook service account data sources.

Create a SharePoint (Service Account) Data Source

1. Add a Data Source

1. In the Airia platform, navigate to Available data sources.
2. Select the SharePoint (service account) card.

2. Configure Data Source Details

1. Provide the following details:
   • Name: A mandatory, descriptive name for your data source (e.g., Policy Library).
   • Description: (Optional) A brief description up to 1000 symbols.
   • Scope: Select the Airia project for this data source.
   • Microsoft Graph application credential: From the dropdown, select the credential you created above. There is no authentication step — the stored credential is the only authentication input.
   • Selected Site (Site Id or Site Url): (Optional) Restricts the connector to a single site. Fill this in when your app registration was granted Sites.Selected. You can enter a site ID (contoso.sharepoint.com,abc-123,def-456), a Graph-formatted URL (contoso.sharepoint.com:/sites/team), or the full site URL (https://contoso.sharepoint.com/sites/team).

💡 Note: If the credential dropdown empties itself after you change the data source's project scope, the credential you had selected is not available in the new scope. Select a credential that belongs to the new project or is shared tenant-wide.

3. Specify Ingestion Settings

(Optional) Configure the ingestion settings based on your specific use case and data requirements. More info can be found under Ingestion settings.

4. Select Folders and Start Ingestion

Browse and select the content you want to ingest.

• Click Next. The content selector opens, listing the SharePoint sites your app registration can reach. If you set a Selected Site, only that site is listed.
• Expand a site to see its document libraries, and expand a library to see its folders. Select a whole site, a library, or individual folders.
• At least one selection is required — a data source with nothing selected cannot be saved.

💡 Tip: Selecting a site, library, or folder will sync all supported content within it, including subfolders. Reprocessing the data source will automatically sync newly added content, update modified content, and delete removed items within the selected content. This also applies to configuration changes: if you deselect a folder, its previously ingested files are removed on the next sync.

💡 Note: Personal sites (OneDrive) are not listed. Use the OneDrive (Service Account) Connector for those.

Filter Documents by Metadata

This connector supports the same SharePoint metadata filters as the OneDrive and SharePoint Connector: include and exclude rules based on column values such as Status, Department, or Document Type. See Filter SharePoint Documents by Metadata for the full reference.

Two points are worth knowing before you start:

• Set rules on document libraries or folders. The filter icon also appears on sub-sites, but rules saved on a sub-site are not applied during ingestion. Move the rule down to the library or folder you want filtered.
• The rule's field must match the column's internal name. Airia matches against the internal SharePoint field name, which usually equals the display name but diverges for a column that was renamed after it was created, a name longer than 32 characters, or a built-in such as Content Type (internally ContentType). If a rule's field cannot be found on a document, that document does not pass the rule — with match mode All, a single unmatched column name filters out everything in the folder.

What Gets Ingested

• Documents: Every supported file in a selected site, document library, or folder is ingested, including files in subfolders. Standard per-file-type ingestion size limits apply.
• Metadata: File name, path, size, last modified date, and the identities that created and last modified the file.

Permissions

The SharePoint (Service Account) connector does not support per-user permission enforcement. An application credential carries no end-user identity, and SharePoint permissions frequently inherit from SharePoint site groups, whose membership cannot be read with an application credential. The Filter search results based on end user's access permissions option is therefore not available for this connector type.

Every user with access to the data store can retrieve content from all ingested sites. Scope the data source accordingly:

• Prefer Sites.Selected with a Selected Site, and select specific libraries or folders rather than whole sites.
• Control which users can query the data store, and which agents it is attached to.
• If you need search results trimmed to each end user's SharePoint permissions, use the OneDrive and SharePoint Connector for that content instead. Both connectors can be used in the same tenant.

Citation links point at the document's own SharePoint URL rather than a generated sharing link, so a user opening a citation must already have access to that document in SharePoint.

For connectors that support permission enforcement, see Permissions Enforcement.

Troubleshooting

Next Steps

After your data has been successfully ingested, the SharePoint (service account) data source is ready to be used with an Agent.