SharePoint

Sync SharePoint document libraries into a knowledge base, with optional permission syncing through a Microsoft Entra App.

SharePoint supports two types of Connection — Microsoft (OAuth 2.0) and Microsoft Entra App. Pick one based on whether the knowledge base must respect SharePoint permissions, and create it before adding the integration. The full walkthrough for adding and syncing sources is in Data Sources.

	Microsoft (OAuth 2.0)	Microsoft Entra App
Permission syncing	Not available	Available
Who sets it up	Anyone who can sign in to Microsoft 365	A Microsoft Entra admin
Reads SharePoint as	The user who authorized the Connection	The app itself, across the whole tenant
Content you can sync	Sites and files that user can open	Any site in the tenant

Microsoft OAuth 2.0

Use this Connection when everyone who can query the knowledge base may see every synced file.

On Connections, click Add new connection, choose Microsoft as the Type, then click Create and Authorize to complete the Microsoft consent flow. The Connection requests the User.Read, Files.Read.All, and Sites.Read.All scopes. See OAuth Connections for the authorize step and token refresh behavior.

The integration can only see the sites and files the authorizing user can open. Use a dedicated account that is a member of every site you want to index, so the Connection is not tied to a person.

Permission syncing does not work with a Microsoft Connection. Microsoft only shows a signed-in user the sharing permissions that apply to them on files they do not own, so Dynamiq cannot learn who else has access. Use a Microsoft Entra App Connection instead.

Microsoft Entra App

Use this Connection when the knowledge base must respect SharePoint permissions. An admin registers an app in your organization's Microsoft Entra ID tenant. Dynamiq signs in as that app with a certificate and reads SharePoint with the app's own read-only permissions.

You need someone who can grant tenant-wide admin consent for Microsoft Graph application permissions: a Global Administrator or Privileged Role Administrator.

Register the app

Create the app registration

Name — for example, Dynamiq SharePoint.
Supported account types — Single tenant only.
Redirect URI — leave empty.

Click Register. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You need both for the Dynamiq Connection.

Create a certificate

The app authenticates with a certificate, not a client secret. SharePoint rejects app-only access for apps that sign in with a secret.

Create a self-signed certificate and an unencrypted private key:

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 730 -subj "/CN=Dynamiq SharePoint"

This writes two files:

cert.pem — the public certificate. Upload it to the app registration and to Dynamiq.
key.pem — the private key. Upload it to Dynamiq only, and keep it out of shared drives and chat.

The certificate is valid for two years. Note the expiry date: syncing stops when it expires (see Rotate the certificate).

Upload the certificate

On the app registration, open Certificates & secrets → Certificates, click Upload certificate, select cert.pem, and click Add.

Add API permissions

Open API permissions and click Add a permission. Add these Application permissions (not delegated permissions):

API	Permission	Required	Used for
Microsoft Graph	`Sites.Read.All`	Yes	Listing sites, libraries, and files; reading each file's permissions; downloading files
Microsoft Graph	`GroupMember.Read.All`	Yes	Reading the members of Entra security and Microsoft 365 groups, including nested groups
Microsoft Graph	`User.Read.All`	Yes	Matching people by their Entra object ID, email address, and sign-in name
SharePoint	`Sites.Read.All`	Yes	Reading SharePoint group membership, which Microsoft Graph does not provide
Microsoft Graph	`Member.Read.Hidden`	Optional	Reading the members of groups with hidden membership, such as Teams class teams
SharePoint	`Sites.FullControl.All`	Optional	Reading site collection admins of classic sites, and SharePoint groups that show their membership only to their own members

SharePoint is under Microsoft APIs in the Request API permissions panel.

Then click Grant admin consent for <your organization> and confirm. Every permission's Status should show Granted for <your organization>.

Dynamiq only reads from SharePoint, including with Sites.FullControl.All. SharePoint hides some membership data from apps that only have read access. That is the only reason the optional permission exists. Without the optional permissions, the members SharePoint hides get no access through those groups. See When access fails closed.

See Microsoft's guides to registering an app and granting tenant-wide admin consent for details.

Create the Connection

On Connections, click Add new connection, choose Microsoft Entra App as the Type, and fill in:

Directory (tenant) ID — from the app's Overview page.
Application (client) ID — from the app's Overview page.
Certificate — click Choose file and select cert.pem.
Private key — click Choose file and select key.pem.

Click Create. Dynamiq checks that both IDs are lowercase GUIDs as Entra shows them, that the private key is unencrypted, and that it belongs to the certificate. A saved certificate and key show as Saved; the form doesn't display them.

Rotate the certificate

Before the certificate expires, create a new one with the same openssl command, upload the new cert.pem to the app registration, and on the Dynamiq Connection use Replace file for both Certificate and Private key. Then remove the old certificate from the app registration.

Add the integration

On the knowledge base's Integrations tab, add an integration and pick Microsoft SharePoint:

Enter a Name.
Under Access, turn on Sync permissions from source if users should only find files they can open in SharePoint.
Pick the Connection. With Sync permissions from source on, only Microsoft Entra App Connections are offered.
Click + Add objects and select whole document libraries, folders, or individual files from any site.
Save the integration and click Sync.

Sync permissions from source can only be set when you create the integration. To switch an existing integration, create a new one with the setting you need and delete the old one.

Permission syncing

Sync permissions from source decides who can retrieve the synced files:

Off — everyone who can query the knowledge base gets chunks from every synced file.
On — Dynamiq reads each file's SharePoint permissions and the members of every group they grant access to, and enforces them at retrieval time. A user only gets chunks from files they can open in SharePoint.

Who can access a file

A user can access a synced file when any of these applies:

The file is shared with them directly, or through a Specific people link.
They belong to a SharePoint group with access to the file, such as the site's Owners, Members, or Visitors, or a custom group. Entra groups inside a SharePoint group count too.
They belong to a Microsoft Entra security group or Microsoft 365 group with access to the file, directly or through nested groups.
They are a site collection admin of the file's site. Site collection admins can open every file in their site, whatever its permissions.

These files are available to everyone who can query the knowledge base:

Files shared with Everyone or Everyone except external users.
Files with an Anyone link or a People in <your organization> link.

A People in <your organization> link makes the file available to everyone who can query the knowledge base. In SharePoint, only people who open the link get access. To keep such a file restricted, remove the link in SharePoint before the next sync.

How people are matched

A Dynamiq user matches a Microsoft 365 user when their Dynamiq email address equals that user's email address or sign-in name, ignoring case.

If someone's Dynamiq email differs from their Microsoft 365 account, they can link the account themselves: in Dynamiq, open Settings → Profile → Connected accounts, click Connect next to Microsoft, and sign in with their work account. Matching then uses their Entra object ID.

When changes apply

Changes to a file's sharing, such as a new link, a removed person, or a folder with its own permissions, apply at the source's next sync. Sources sync every 6 hours, or immediately when you click Sync.
Changes to group membership, including site collection admins, apply at the next group sync, which runs every 6 hours.

When access fails closed

When Dynamiq cannot read who has access, it grants nothing rather than too much:

A file whose permissions can't be read is not available to anyone until a later sync reads them.
Members of a group with hidden membership get no access through that group unless the app has Member.Read.Hidden.
Members of a SharePoint group that shows its membership only to its own members get no access through that group unless the app has SharePoint Sites.FullControl.All. Root sites often have such system groups, named SharePointHome OrgLinks, which aren't used to share files.
Site collection admins of classic sites (sites not connected to a Microsoft 365 group) are only found with SharePoint Sites.FullControl.All. On group-connected sites, the Microsoft 365 group's owners are found without it; admins added to those sites by hand still need it.

If a group or site can't be read for another reason, its last synced members stay in place, the group sync is marked failed, and every other group and site still syncs.