Skip to main content
Connect your agent to SharePoint to read, create, edit, and fully manage files and folders across your Microsoft 365 document libraries.

​
What your agent can do

  • Browse — List files and folders in sites and libraries, and list a site’s libraries and lists
  • Read — Fetch file content (including many Office and Apple iWork formats via extraction), and read site pages, news posts, and wiki pages as text
  • Read lists — List items (optionally filtered), inspect column schema, read item comments, and extract text from item attachments. Comments and attachments need app-only mode with a certificate — SharePoint’s REST API rejects client-secret credentials
  • Create and edit text files — Create or update .txt, .md, and .csv files
  • Upload files — Upload any stored file (Excel, Word, PDF, images, and more) from the agent’s documents to a library
  • Organize — Move or rename files and folders, copy items (cross-site capable), create folders, and delete items to the site recycle bin (recoverable)
  • Track changes — List files or list items that changed since a window you choose (25h, 7d, or an ISO timestamp). Change tracking looks at one library or list at a time. SharePoint only retains its change log for a limited period (60 days by default). Overlapping windows can return the same item twice — the agent should record what it has already handled. Document-library changes include deletions; for lists, deletions show up only once the agent passes back the token returned by an earlier call
On the capability card you can limit which parts of SharePoint an agent reaches. Documents, Pages and Lists toggle separately and all three are on by default. Change tracking is off by default. Turning off what an agent doesn’t need keeps it focused on the right tools.
Deleting through Abundly sends items to the SharePoint site recycle bin, not permanent removal. Your Microsoft 365 admins or site owners can restore them from there if needed.

​
How to enable

You can connect SharePoint in two ways. Pick the one that fits the agent. Open the capability card on the agent and use the Personal / App-only picker at the top to switch between them.

​
Personal mode

Personal mode refused? Personal mode needs Microsoft OAuth configured for your deployment. The standard Abundly cloud has this in place, but on a dedicated or self-hosted deployment the picker may refuse Personal and point you to App-only instead — ask your Abundly contact to set up the Microsoft OAuth credentials for SharePoint. App-only mode is unaffected: it uses your own Entra app registration and works either way.
1

Enable the capability

Go to Settings → Capabilities and enable SharePoint, then pick Personal at the top of the card.
2

Connect your Microsoft account

Click Create new to sign in with your Microsoft account and create a personal access token. This token belongs to you and can be managed in your profile settings.If you already have a SharePoint token from setting up another agent, you can select it from the dropdown instead.
In many organizations, a Microsoft admin must approve the Abundly SharePoint app before the connection can be completed. If you see an “Almost There” message after sign-in, ask your admin to grant approval in Microsoft Entra, then try connecting again.

​
App-only mode

App-only mode runs SharePoint as the agent’s own Entra identity using the Microsoft client_credentials flow with Sites.Selected permission. The agent gets access only to the sites an admin explicitly grants it — no broad tenant-wide read, no per-user token expiry.
1

Register an app in Microsoft Entra

In your customer’s tenant, go to Microsoft Entra → App registrations → New registration. Give it a name (e.g. “Abundly agent”). Accounts in this directory only is fine. No redirect URI needed.Copy the Directory (tenant) ID and Application (client) ID — you’ll paste them into Abundly in the last step.
2

Grant Sites.Selected

On the registration, go to API permissions → Add a permission → Microsoft Graph → Application permissions → Sites.Selected. Click Grant admin consent.
3

Create a client secret or upload a certificate

Under Certificates & secrets, create either:
  • A client secret — copy the Value immediately (it’s only shown once). Store it in Abundly as a workspace secret of type SharePoint app-only — Client secret.
  • A certificate — upload the public X.509 cert; you’ll need the SHA-1 thumbprint and the matching PKCS#8 PEM private key in Abundly. Store the PEM as a workspace secret of type SharePoint app-only — Certificate (separate type with a textarea so the multiline PEM is preserved exactly — pasting a PEM into a single-line input strips the newlines and Microsoft rejects it with a decoder error).
Prefer the certificate if you want attachments and comments on list items. Those are only reachable through SharePoint’s older API, which rejects client-secret credentials — a Microsoft restriction, not an Abundly one. Everything else works the same either way, and no extra permissions are needed.Note the expiry date — you’ll want to renew before it hits.
4

Grant per-site access

Sites.Selected starts the app with zero site access. A SharePoint or Global Administrator must grant the app access to each specific site you want the agent to reach.This is done via PowerShell — either PnP.PowerShell (Grant-PnPAzureADAppSitePermission) or Microsoft Graph PowerShell (POST /sites/{site-id}/permissions). Use whichever tool fits your environment.You’ll need:
  • The app’s Client ID
  • The target site URL
  • The desired permission level (Read, Write, or FullControl)
The level applies to the entire site collection, so grant Read unless the agent genuinely needs to create or change things. See Access scope for what can and cannot be narrowed.Repeat for every site the agent should reach.
5

Configure Abundly

In the SharePoint capability card, switch to App-only. Paste the tenant ID, client ID, and the secret (or certificate + thumbprint). Save, then click Test connection to confirm Microsoft accepts the credential.Optionally:
  • Default site URL — used by tools when no siteUrl is supplied per call.
  • Granted sites — one SharePoint site URL per line, listing the sites you granted the app in the previous step. Microsoft doesn’t expose an API for the app to discover which sites it has been granted, so paste the list here. The agent sees it in its prompt as the authoritative starting set, and Test connection verifies each entry by calling Microsoft Graph for it.
Behaviour differences in app-only modeTenant-wide site enumeration isn’t supported with Sites.Selected — every tool call has to target a specific site (siteUrl), drive (driveId), or full SharePoint URL (webUrl). The agent can still work across multiple sites in a single task; tell it which ones (via Granted sites, the agent’s instructions, the user’s prompt, or Default site URL) and it will iterate, calling tools once per site. If the agent tries a site you haven’t granted, Microsoft returns 403 and the tool surfaces that.If the secret expires or Microsoft rejects the credential, Abundly marks the integration as failing and shows a Reconnect banner on the capability card. The next successful Test connection or token acquisition clears it.
App-only access is per-agent and independent of any user. Anyone with permission to use the agent can use the agent’s SharePoint access — apply the principle of least privilege at site-grant time and via the agent’s access controls.

​
Access scope

How you limit what an agent can reach depends on which mode you’re in.

​
Personal mode

After you connect a new SharePoint token, Abundly takes you to a settings page where you can choose which sites to allow and optionally narrow access to specific folders. You can keep broad access by choosing Allow All & Continue, or save a restricted scope and apply least privilege from the start.
You can update these SharePoint access settings later from Profile settings → Personal Tokens.

​
App-only mode

Scope comes from the site grants in Microsoft, not from settings in Abundly. Two things control it:
  • Which sites — the app reaches only the sites an admin has granted it. Microsoft enforces this: a site you haven’t granted returns 403, and tenant-wide enumeration isn’t possible at all.
  • What it can do there — the permission level on each grant (Read, Write, FullControl) applies to the whole site collection. If the agent only needs to read, grant Read. That is the strongest limit available in app-only mode, it’s enforced by Microsoft rather than by Abundly, and it costs one PowerShell parameter at grant time.
The Granted sites field on the capability card is not a restriction. It tells the agent which sites exist, because Microsoft exposes no way for an app to discover its own grants — removing a site from that list doesn’t revoke anything.
The site-level folder restrictions described under Personal mode above do not apply in app-only mode. There is currently no way to limit an app-only agent to part of a site: a grant covers the whole site collection.If an agent should only reach some content, put that content in its own site and grant only that site, or use Personal mode where folder restrictions apply.
In both modes you can also limit what kind of SharePoint the agent uses — Documents, Pages, Lists and Change tracking each toggle separately on the capability card. That’s a narrower blast radius than access alone: an agent with Documents turned off can’t read files even on a site it’s been granted.
Text-based files (txt, md, csv) can be created and edited in place. Other file types — including Office documents — can be read, uploaded from the agent’s documents, and organized (moved, copied, renamed, deleted), but their contents cannot be edited directly in SharePoint. To update an Office document, have the agent generate a new version (for example with its code execution capability) and upload it with overwrite enabled.

​
Example use cases

  • Document Search — “Find all documents in our Legal site that were modified this week”
  • Content Retrieval — “Get the contents of the employee handbook and summarize it”
  • Intranet Digest — “Summarize the news posts published on our Intranet site this month”
  • List Tracking — “List the open items in the Projects site’s Risks list and flag anything overdue”
  • Report Generation — “Every Friday, create a weekly summary report in the Team site based on our Slack activity”
  • Spreadsheet Delivery — “Generate the monthly estimate as an Excel file and upload it to the Projects library”
  • Cross-platform Sync — “Check my Outlook inbox every morning — if you see any invoice emails, save them to the Finance folder in SharePoint”