SharePoint

• Per-user OAuth2 (central client) (oauthCentral, recommended): one Microsoft Entra OAuth Application is registered once by the platform maintainer; every end user signs in with their own Microsoft account. Nothing to register per tenant: each workspace just installs the app and clicks Connect.
• Per-user OAuth2 (tenant client) (oauth): paste your own Entra application (client) ID/secret in the connector config app. Each user signs in with their own account against your client (PKCE authorization-code flow).
• Application (client credentials) (clientCredentials): an Entra app with application Graph permissions and admin consent, acting without an interactive sign-in. Best for back-office / service automations and content indexing.
• Direct access token (accessToken): a caller-managed Microsoft Graph access token, used as-is with no exchange.

​

Who is this for?

​

Prerequisites (Microsoft side)

• A Microsoft 365 / SharePoint Online tenant, and an Azure / Microsoft Entra ID tenant where you can register an application (or a maintainer who already did).
• An app registration in Microsoft Entra ID (Azure portal → App registrations), with a client secret created under Certificates & secrets.
• Microsoft Graph delegated permissions granted on the app (for the per-user OAuth modes), covering the resources you intend to use:
  • Sites & files: Sites.Read.All (or Sites.ReadWrite.All for create/update/move), Files.Read.All (or Files.ReadWrite.All)
  • Directory (access-aware RAG): User.Read, GroupMember.Read.All (optional)
  • Sign-in / identity: openid, profile, offline_access
• For the application (client-credentials) mode instead, grant the equivalent application permissions (e.g. Sites.Read.All, Files.Read.All) and have a Global Administrator grant admin consent.

offline_access
https://graph.microsoft.com/Sites.Read.All
https://graph.microsoft.com/Files.Read.All
https://graph.microsoft.com/User.Read

<api-url>/workspaces/<workspace-id>/webhooks/oauthCallback

context_id,agent_id,user_id

context_id,agent_id,user_id

You have access to the SharePoint MCP server (tools: sites, drives, items, search, permissions, lists, directory, workbook, documents). Each tool takes an `action` argument. Use it whenever the user asks about SharePoint sites, document libraries, files and folders, SharePoint lists, sharing permissions, or who can access a document. To read a file, list its drive's children, then use the @microsoft.graph.downloadUrl the item exposes (content is not returned inline); for an Excel `.xlsx` file use the `workbook` tool and for a Word `.docx` file use the `documents` tool to read content natively. Prefer calling a tool over guessing, and confirm with the user before any write or destructive action (create, update/move, copy, delete, invite, create link, add/create worksheet or table).

offline_access https://graph.microsoft.com/Sites.Read.All https://graph.microsoft.com/Files.Read.All https://graph.microsoft.com/User.Read

{
  "name": "sites",
  "arguments": {
    "action": "search",
    "search": "marketing",
    "top": 10
  }
}

{
  "name": "drives",
  "arguments": {
    "action": "listForSite",
    "siteId": "contoso.sharepoint.com,abc-123,def-456"
  }
}

{
  "name": "items",
  "arguments": {
    "action": "listChildren",
    "driveId": "b!xyz...",
    "itemId": "01ABCDEF...",
    "top": 50
  }
}

{
  "name": "lists",
  "arguments": {
    "action": "listItems",
    "siteId": "contoso.sharepoint.com,abc-123,def-456",
    "listId": "b6c8...",
    "expand": "fields"
  }
}

{
  "name": "permissions",
  "arguments": {
    "action": "list",
    "driveId": "b!xyz...",
    "itemId": "01ABCDEF..."
  }
}

{
  "name": "workbook",
  "arguments": {
    "action": "usedRange",
    "driveId": "b!xyz...",
    "itemId": "01ABCDEF...",
    "worksheetId": "Sheet1"
  }
}

{
  "name": "documents",
  "arguments": {
    "action": "getText",
    "driveId": "b!xyz...",
    "itemId": "01ABCDEF..."
  }
}

- Sharepoint.searchSites:
    search: 'Marketing'
    top: 5
  output: sites
- Sharepoint.listSiteDrives:
    siteId: '{{sites.value[0].id}}'
  output: drives

- Sharepoint.listRootChildren:
    driveId: '{{drives.value[0].id}}'
    top: 50
    orderby: lastModifiedDateTime desc
  output: items

- Sharepoint.createFolder:
    driveId: '{{drives.value[0].id}}'
    parentItemId: root
    body:
      name: 'Reports 2026'
      folder: {}
      '@microsoft.graph.conflictBehavior': rename
  output: folder

- Sharepoint.searchQuery:
    body:
      requests:
        - entityTypes:
            - driveItem
          query:
            queryString: 'quarterly report'
          from: 0
          size: 25
  output: results

- Sharepoint.createListItem:
    siteId: '{{sites.value[0].id}}'
    listId: '{{listId}}'
    body:
      fields:
        Title: 'New entry'
        Status: 'Open'
  output: created

​

Error Handling

​

Common Issues

​

External Resources