Connect SharePoint
This guide connects ConfidentialMind to Microsoft's
SharePoint MCP server
(mcp_SharePointRemoteServer) with per-user Microsoft Entra OAuth. Users can access only the SharePoint content
available to their Microsoft 365 account.
Prerequisites
- A Microsoft 365 commercial tenant with SharePoint Online
- SharePoint MCP preview access for the tenant
- The Microsoft Entra tenant ID
- A test user with access to the SharePoint sites to search
- One ConfidentialMind MCP registration per Entra tenant
Work IQ API use
by custom and third-party agents requires usage-based billing, including for Microsoft 365 Copilot users. Without
billing, OAuth can succeed while tool calls return 403.
1. Get the tenant ID
az login --allow-no-subscriptions
az account show --query tenantId -o tsv
Use the Entra directory tenant ID — not a ConfidentialMind tenant ID, Azure subscription ID, or SharePoint site ID.
2. Create the Entra application
In the Microsoft Entra admin center under Entra ID -> App registrations -> New registration:
Name: ConfidentialMind SharePoint MCP
Supported account types: Accounts in this organizational directory only
Platform: Web
Redirect URI: https://<CHAT_DOMAIN>/oauth/mcp/callback
The redirect URI must exactly match the OAuth callback URL the ConfidentialMind form displays — scheme, host, port, path, and trailing slash.
Copy the Application (client) ID. Under Certificates & secrets, create a client secret and copy its Value immediately (not the Secret ID).
3. Add the API permission
Under API permissions -> Add a permission -> APIs my organization uses, search for SharePoint MCP (application ID 292cff14-c0e8-4116-9e3b-99934ae05766) and add the delegated permission:
Tools.ListInvoke.All
If the service principal is missing, create it first:
az ad sp create --id 292cff14-c0e8-4116-9e3b-99934ae05766
Grant admin consent if tenant policy requires it.
4. Connect in ConfidentialMind
Open Tenant -> MCP servers -> Connect external MCP and enter:
Name: sharepoint
Display name: SharePoint
Server URL: https://agent365.svc.cloud.microsoft/agents/tenants/<ENTRA_TENANT_ID>/servers/mcp_SharePointRemoteServer
Configure OAuth manually because Microsoft advertises a generic authorization server whose issuer does not match the tenant-specific issuer required by the platform.
| Field | Value |
|---|---|
| Authentication | OAuth |
| Authorization URL | Leave blank |
| Token URL | Leave blank |
| Issuer / discovery URL | https://login.microsoftonline.com/<ENTRA_TENANT_ID>/v2.0 |
| Client ID | Entra application client ID |
| Client authentication | Client secret (request body) |
| Client secret | Entra client secret Value |
| Scopes | Leave blank (discovered) |
| Resource / audience | Leave blank |
5. Authorize from Chat
Open Chat and select Tools. Find SharePoint under Not connected and select Connect. Sign in with your Microsoft 365 account in the tab that opens. Each user does this for themselves, in every browser they use. See OAuth for external MCP servers for the full flow.
6. Verify
Start read-only, for example:
Find the SharePoint site named Marketing
List the document libraries in the Marketing SharePoint site
Verify that SharePoint tools appear and that a read-only call returns content the signed-in user can access.
Write operations are disabled by default. An administrator can enable them in the Microsoft 365 admin center. Uploads and downloads are limited to files of 5 MB or less.
Troubleshooting
| Failure | Check |
|---|---|
TenantIdInvalid | Use the Entra directory tenant ID |
Endpoint 404 | URL and SharePoint MCP preview availability |
Endpoint 403 | Licensing, billing, tenant policy, admin consent |
The caller is not entitled to use this tool | Check Work IQ API access and billing. OAuth can still succeed |
AADSTS50011 | The Entra Web redirect URI must exactly match the platform's callback URL |
AADSTS65001 | Grant user or admin consent |
AADSTS650057 | Explicit scopes configured with a resource — leave Resource blank |
invalid_scope | The scope does not match the selected API permission model |
invalid_client | Use the application client ID and the secret's Value, not the object or secret IDs |
| Issuer mismatch during discovery | Use manual configuration with the tenant-specific issuer URL |
Login succeeds but MCP returns 401 | The MCP API permission and token audience |
| No sites returned | The signed-in user's SharePoint access |
Writes return 403 | Work IQ write operations are disabled |
| Works for only one user | Other users must authorize separately |
| Works for only one Entra tenant | Create one tenant-scoped registration per Entra tenant |
Probe the MCP endpoint
If the endpoint fails before sign-in, probe it directly:
curl -i -X POST \
"https://agent365.svc.cloud.microsoft/agents/tenants/<ENTRA_TENANT_ID>/servers/mcp_SharePointRemoteServer" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
--data '{"jsonrpc":"2.0","id":"probe","method":"initialize","params":{}}'
| Response | Meaning |
|---|---|
401 with WWW-Authenticate: Bearer resource_metadata=... | Endpoint is available and OAuth-protected |
TenantIdInvalid | The tenant ID is wrong |
404 | The URL is wrong or the SharePoint MCP preview is unavailable to the tenant |
403 | Licensing, billing, tenant policy, or preview access is blocking the request |