Skip to main content

​
After this article

You’ll be able to connect Microsoft SharePoint to Lumos to sync users, groups, site groups, site roles, and SharePoint sites for visibility and Access Reviews.

​
Capabilities

Activity tracking is supported. The integration can track a user’s last site access through Microsoft 365 audit logs when audit logging is enabled. Comprehensive activity tracking needs the separate Microsoft 365 integration alongside SharePoint.

​
Required plan and roles

  • Azure role: you need permission to create an app registration in the Azure Portal and to grant admin consent for the application. This is usually a Global Administrator or a Privileged Role Administrator.
  • Authentication: a single-tenant Microsoft Entra ID app registration with a client secret. The connector authenticates against Microsoft Graph using the https://graph.microsoft.com/.default application scope. Grant the permissions as Application permissions, not Delegated.
  • Microsoft Graph permissions:
  • Permission scoping: you can scope the integration to read-only or write access depending on which of the scopes above you grant. Omit the write and optional scopes for a read-only connection.

​
Read-only access vs provisioning

Is read-only possible? Yes. You can scope the Microsoft Entra ID app registration to read-only or to read/write depending on which Microsoft Graph application permissions you grant. What read-only requires. Application permissions limited to Sites.Read.All, Groups.Read.All, GroupMember.Read.All, User.Read.All, Directory.Read.All, and CrossTenantInformation.ReadBasic.All, with admin consent granted. Omit the ReadWrite, FullControl, Invite, and Delete permissions. Follow the steps below. What full provisioning requires. The read permissions above plus Sites.ReadWrite.All, User.ReadWrite.All, and User.Invite.All (and optionally Sites.FullControl.All, GroupMember.ReadWrite.All, and User.DeleteRestore.All), all granted as Application permissions with admin consent. Watch out for. All permissions live on a single Microsoft Entra ID app registration, so changing between read-only and full access means editing that app’s API permissions and clicking Grant admin consent again, not switching connector tiles. Permissions must be Application permissions, not Delegated, or the connector won’t authenticate correctly.

​
Instructions

Phase 1: Register an application in Azure
  1. In the Azure Portal, go to App registrations → New registration.
  2. Choose a name. Under Supported account types, select Accounts in this organizational directory only (Single tenant), then click Register.
  3. Copy the Application (client) ID.
  4. In the app’s Essentials panel, click Add a certificate or secret → New client secret, fill in a description and expiration, and copy the secret value.
  5. Under API permissions, add the Microsoft Graph Application permissions listed above.
  6. Click Grant admin consent for the application.
  7. Open Tenant properties and copy the Tenant ID.
Phase 2: Connect in Lumos
  1. Click the SharePoint card in your Lumos integrations. Reconnect an existing card or add a new one.
  2. Enter the Client ID, Client Secret, and Tenant ID.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

“Failed to authenticate” or “Invalid client credentials”. Verify the Tenant ID, Client ID, and Client Secret. Check that the client secret hasn’t expired. Confirm the Microsoft Entra ID app is active and admin consent was granted. If the secret expired, create a new one under Certificates & secrets, update it in Lumos, then delete the expired secret. “Insufficient privileges”. Confirm the required Graph permissions are granted as Application permissions, not Delegated, and that admin consent was clicked. Allow time for propagation. An existing connection suddenly requires reconnection. The connector’s authentication method changed in a past release. Reconnect the integration with your app registration credentials. You cannot see SharePoint sites. Verify SharePoint Online is active, the sites aren’t archived or deleted, and Sites.Read.All is granted with admin consent. Test through Graph Explorer if needed. Archived or restricted sites don’t sync. Microsoft 365 Archive locks sites, so Graph permission calls return 423 resourceLocked. The connector pre-filters fully archived sites and skips them. Sites that return 403 or 404 mid-sync are also skipped rather than failing the sync, so inaccessible sites are excluded. Sites under Information Barriers (Explicit mode) return 423 by design. This connector doesn’t support Sites.Selected scoping. Activity tracking isn’t working. Verify Microsoft 365 audit logging is enabled and that AuditLog.Read.All is granted where applicable. For comprehensive activity data, enable the full Microsoft 365 integration. Syncs are slow on very large tenants. A sync across a very large number of sites can take significant time and resources. If syncs repeatedly fail on a large tenant, contact Lumos support.