> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # SharePoint ## After this article You'll be able to connect Microsoft SharePoint to Lumos to sync users, groups, site groups, site roles, and SharePoint sites for visibility and Access Reviews. ## Capabilities | Functionality | Type | Sync | Provision | Description | | - | - | - | - | - | | Users | Account | Yes | Yes | User account records | | Groups | Permission | Yes | Yes | Microsoft 365 groups | | Site Groups | Permission | Yes | No | Site group membership in SharePoint (sync only) | | Roles | Permission | Yes | Yes | Site roles that control access to sites | | Sites | Resource | Yes | Yes | SharePoint sites | Activity tracking is supported. The integration can track a user's last site access through Microsoft 365 audit logs when audit logging is enabled. Comprehensive activity tracking needs the separate Microsoft 365 integration alongside SharePoint. ## Required plan and roles * **Azure role:** you need permission to create an app registration in the Azure Portal and to grant admin consent for the application. This is usually a Global Administrator or a Privileged Role Administrator. * **Authentication:** a single-tenant Microsoft Entra ID app registration with a client secret. The connector authenticates against Microsoft Graph using the `https://graph.microsoft.com/.default` application scope. Grant the permissions as **Application permissions**, not Delegated. * **Microsoft Graph permissions:** | Permission | Required | Purpose | | - | - | - | | `Sites.Read.All` | Yes | Read site and user information | | `Sites.ReadWrite.All` | Yes | Read and write site information | | `Sites.FullControl.All` | Optional | Manage site access | | `Groups.Read.All` | Yes | Sync group information | | `GroupMember.Read.All` | Yes | Sync additional group information | | `GroupMember.ReadWrite.All` | Optional | Manage access to groups | | `User.Read.All` | Yes | Sync user information | | `User.ReadWrite.All` | Yes | Manage access for users | | `User.Invite.All` | Yes | Send invites to users | | `User.DeleteRestore.All` | Optional | Delete users | | `Directory.Read.All` | Yes | Sync directory and identity information | | `CrossTenantInformation.ReadBasic.All` | Yes | Sync tenant information | * **Permission scoping:** you can scope the integration to read-only or write access depending on which of the scopes above you grant. Omit the write and optional scopes for a read-only connection. ## Read-only access vs provisioning **Is read-only possible?** Yes. You can scope the Microsoft Entra ID app registration to read-only or to read/write depending on which Microsoft Graph application permissions you grant. **What read-only requires.** Application permissions limited to `Sites.Read.All`, `Groups.Read.All`, `GroupMember.Read.All`, `User.Read.All`, `Directory.Read.All`, and `CrossTenantInformation.ReadBasic.All`, with admin consent granted. Omit the ReadWrite, FullControl, Invite, and Delete permissions. Follow the steps below. **What full provisioning requires.** The read permissions above plus `Sites.ReadWrite.All`, `User.ReadWrite.All`, and `User.Invite.All` (and optionally `Sites.FullControl.All`, `GroupMember.ReadWrite.All`, and `User.DeleteRestore.All`), all granted as Application permissions with admin consent. **Watch out for.** All permissions live on a single Microsoft Entra ID app registration, so changing between read-only and full access means editing that app's API permissions and clicking **Grant admin consent** again, not switching connector tiles. Permissions must be Application permissions, not Delegated, or the connector won't authenticate correctly. ## Instructions **Phase 1: Register an application in Azure** 1. In the Azure Portal, go to **App registrations** → **New registration**. 2. Choose a name. Under **Supported account types**, select **Accounts in this organizational directory only (Single tenant)**, then click **Register**. 3. Copy the **Application (client) ID**. 4. In the app's **Essentials** panel, click **Add a certificate or secret** → **New client secret**, fill in a description and expiration, and copy the secret **value**. 5. Under **API permissions**, add the Microsoft Graph **Application permissions** listed above. 6. Click **Grant admin consent** for the application. 7. Open **Tenant properties** and copy the **Tenant ID**. **Phase 2: Connect in Lumos** 1. Click the SharePoint card in your Lumos integrations. Reconnect an existing card or add a new one. 2. Enter the **Client ID**, **Client Secret**, and **Tenant ID**. 3. Click **Connect**. ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Troubleshooting **"Failed to authenticate" or "Invalid client credentials".** Verify the Tenant ID, Client ID, and Client Secret. Check that the client secret hasn't expired. Confirm the Microsoft Entra ID app is active and admin consent was granted. If the secret expired, create a new one under **Certificates & secrets**, update it in Lumos, then delete the expired secret. **"Insufficient privileges".** Confirm the required Graph permissions are granted as **Application permissions**, not Delegated, and that admin consent was clicked. Allow time for propagation. **An existing connection suddenly requires reconnection.** The connector's authentication method changed in a past release. Reconnect the integration with your app registration credentials. **You cannot see SharePoint sites.** Verify SharePoint Online is active, the sites aren't archived or deleted, and `Sites.Read.All` is granted with admin consent. Test through Graph Explorer if needed. **Archived or restricted sites don't sync.** Microsoft 365 Archive locks sites, so Graph permission calls return `423 resourceLocked`. The connector pre-filters fully archived sites and skips them. Sites that return 403 or 404 mid-sync are also skipped rather than failing the sync, so inaccessible sites are excluded. Sites under Information Barriers (Explicit mode) return 423 by design. This connector doesn't support `Sites.Selected` scoping. **Activity tracking isn't working.** Verify Microsoft 365 audit logging is enabled and that `AuditLog.Read.All` is granted where applicable. For comprehensive activity data, enable the full Microsoft 365 integration. **Syncs are slow on very large tenants.** A sync across a very large number of sites can take significant time and resources. If syncs repeatedly fail on a large tenant, contact Lumos support.