Skip to main content
Connect your agent to SharePoint to read, create, edit, and fully manage files and folders across your Microsoft 365 document libraries.

​
What your agent can do

  • Browse — List files and folders in sites and libraries, and list a site’s libraries and lists
  • Read — Fetch file content (including many Office and Apple iWork formats via extraction), and read site pages, news posts, and wiki pages as text
  • Read lists — List items (optionally filtered), inspect column schema, read item comments, and extract text from item attachments. Comments and attachments need app-only mode with a certificate — SharePoint’s REST API rejects client-secret credentials
  • Create and edit text files — Create or update .txt, .md, and .csv files
  • Upload files — Upload any stored file (Excel, Word, PDF, images, and more) from the agent’s documents to a library
  • Organize — Move or rename files and folders, copy items (cross-site capable), create folders, and delete items to the site recycle bin (recoverable)
  • Track changes — List files or list items that changed since a window you choose (25h, 7d, or an ISO timestamp). Change tracking looks at one library or list at a time. SharePoint only retains its change log for a limited period (60 days by default). Overlapping windows can return the same item twice — the agent should record what it has already handled. Document-library changes include deletions; for lists, deletions show up only once the agent passes back the token returned by an earlier call
On the capability card you can limit which parts of SharePoint an agent reaches. Documents, Pages and Lists toggle separately and all three are on by default. Change tracking is off by default. Turning off what an agent doesn’t need keeps it focused on the right tools.
Deleting through Abundly sends items to the SharePoint site recycle bin, not permanent removal. Your Microsoft 365 admins or site owners can restore them from there if needed.

​
How to enable

You can connect SharePoint in two ways. Pick the one that fits the agent. Open the capability card on the agent and use the Personal / App-only picker at the top to switch between them.

​
Personal mode

Personal mode refused? Personal mode needs Microsoft OAuth configured for your deployment. The standard Abundly cloud has this in place, but on a dedicated or self-hosted deployment the picker may refuse Personal and point you to App-only instead — ask your Abundly contact to set up the Microsoft OAuth credentials for SharePoint. App-only mode is unaffected: it uses your own Entra app registration and works either way.
1

Enable the capability

Go to Settings → Capabilities and enable SharePoint, then pick Personal at the top of the card.
2

Connect your Microsoft account

Click Create new to sign in with your Microsoft account and create a personal access token. This token belongs to you and can be managed in your profile settings.If you already have a SharePoint token from setting up another agent, you can select it from the dropdown instead.
In many organizations, a Microsoft admin must approve the Abundly SharePoint app before the connection can be completed. If you see an “Almost There” message after sign-in, ask your admin to grant approval in Microsoft Entra, then try connecting again.

​
App-only mode

App-only mode runs SharePoint as the agent’s own Entra identity using the Microsoft client_credentials flow with Microsoft’s Selected permissions. The agent gets access only to the sites — or the individual folders — an admin explicitly grants it. No broad tenant-wide read, no per-user token expiry.
1

Register an app in Microsoft Entra

In your customer’s tenant, go to Microsoft Entra → App registrations → New registration. Give it a name (e.g. “Abundly agent”). Accounts in this directory only is fine. No redirect URI needed.Copy the Directory (tenant) ID and Application (client) ID — you’ll paste them into Abundly in the last step.
2

Choose the permission scope

On the registration, go to API permissions → Add a permission → Microsoft Graph → Application permissions and add one of:
  • Sites.Selected — the agent can be granted whole sites. Simplest, and the only option that also covers site pages and lists.
  • Files.SelectedOperations.Selected — the agent can be granted individual folders inside a document library, and nothing else on the site. Use this when the agent should only reach part of a site.
Click Grant admin consent. Either way the app starts with no access at all — the grant in the next step is what opens something up.
Permissions add up and the broadest wins: a whole-site grant covers everything on that site regardless of any folder grants. Decide per site whether the agent gets the whole site or one folder.
3

Create a client secret or upload a certificate

Under Certificates & secrets, create either:
  • A client secret — copy the Value immediately (it’s only shown once). Store it in Abundly as a workspace secret of type SharePoint app-only — Client secret.
  • A certificate — upload the public X.509 cert; you’ll need the SHA-1 thumbprint and the matching PKCS#8 PEM private key in Abundly. Store the PEM as a workspace secret of type SharePoint app-only — Certificate (separate type with a textarea so the multiline PEM is preserved exactly — pasting a PEM into a single-line input strips the newlines and Microsoft rejects it with a decoder error).
Prefer the certificate if you want attachments and comments on list items. Those are only reachable through SharePoint’s older API, which rejects client-secret credentials — a Microsoft restriction, not an Abundly one. Everything else works the same either way, and no extra permissions are needed.Note the expiry date — you’ll want to renew before it hits.
4

Grant the app its sites or folders

A SharePoint or Global Administrator now grants the app the specific sites or folders the agent may reach. Microsoft has no UI for this — it’s a PowerShell cmdlet or a Graph API call.Whole site (Sites.Selected): use PnP.PowerShell (Grant-PnPAzureADAppSitePermission) or Microsoft Graph PowerShell (New-MgSitePermission). You’ll need the app’s Client ID, the site URL, and a permission level — Read, Write, or FullControl. The level applies to the entire site collection, so grant Read unless the agent genuinely needs to create or change things. Repeat for every site.Single folder (Files.SelectedOperations.Selected): follow Granting a single folder below.
5

Configure Abundly

In the SharePoint capability card, switch to App-only. Paste the tenant ID, client ID, and the secret (or certificate + thumbprint). Save, then click Test connection to confirm Microsoft accepts the credential.Optionally:
  • Default site URL — used by tools when no siteUrl is supplied per call.
  • Granted sites — one SharePoint site URL per line, listing the sites you granted the app in the previous step. Microsoft doesn’t expose an API for the app to discover which sites it has been granted, so paste the list here. The agent sees it in its prompt as the authoritative starting set, and Test connection verifies each entry by calling Microsoft Graph for it. This works for folder grants too — list the site, and name the library and folder in the agent’s instructions.
Behaviour differences in app-only modeTenant-wide site enumeration isn’t supported with Selected permissions — every tool call has to target a specific site (siteUrl), drive (driveId), or full SharePoint URL (webUrl). The agent can still work across multiple sites in a single task; tell it which ones (via Granted sites, the agent’s instructions, the user’s prompt, or Default site URL) and it will iterate, calling tools once per site. If the agent tries a site you haven’t granted, Microsoft refuses and the tool surfaces that. Under a folder grant the rest of the site is invisible rather than refused: listings show only the granted folder, and anything else reads as not found.If the secret expires or Microsoft rejects the credential, Abundly marks the integration as failing and shows a Reconnect banner on the capability card. The next successful Test connection or token acquisition clears it.
App-only access is per-agent and independent of any user. Anyone with permission to use the agent can use the agent’s SharePoint access — apply the principle of least privilege at site-grant time and via the agent’s access controls.

​
Access scope

How you limit what an agent can reach depends on which mode you’re in.

​
Personal mode

After you connect a new SharePoint token, Abundly takes you to a settings page where you can choose which sites to allow and optionally narrow access to specific folders. You can keep broad access by choosing Allow All & Continue, or save a restricted scope and apply least privilege from the start.
You can update these SharePoint access settings later from Profile settings → Personal Tokens.

​
App-only mode

Scope comes from the grants in Microsoft, not from settings in Abundly, and Microsoft enforces it. You choose the level per site: With a whole-site grant, Read is the strongest limit: it’s one parameter at grant time and it’s enforced by Microsoft, not by Abundly. With a folder grant, the agent can browse, read, create, edit, move, copy and delete inside that folder and sees nothing else on the site — the rest isn’t refused so much as invisible. Turn Pages and Lists off on the capability card so the agent isn’t offered tools that can’t work there. The Granted sites field on the capability card is not a restriction. It tells the agent which sites exist, because Microsoft exposes no way for an app to discover its own grants — removing a site from that list doesn’t revoke anything. With a folder grant, also name the library and folder in the agent’s instructions.

​
Granting a single folder

A SharePoint or Global Administrator makes one Graph API call against the folder. The easiest way is Graph Explorer, signed in as that admin, with Sites.FullControl.All consented under Modify permissions.
  1. Find the folder. The first call lists the site’s libraries with their drive IDs; the second lists a library’s top-level items, and the folder’s id is what you need:
  2. Grant the app the folder. Use "write" instead of "read" if the agent should create, edit, move or delete files there. A 201 Created response means the grant is in place.
    In Microsoft Graph PowerShell the same call is New-MgDriveItemPermission.
  3. Verify. GET the same /permissions URL and check that your app is listed with the role you gave it. To change the role later, PATCH that permission by its id with { "roles": ["write"] } — posting it again does not update it.
If the registration also has Sites.Selected consented and a grant on the same site, the site grant wins and the folder grant narrows nothing. Revoke the site grant (Revoke-PnPAzureADAppSitePermission, or DELETE /sites/{site-id}/permissions/{id}) to hold the agent to the folder.
A folder grant breaks permission inheritance on that folder, and SharePoint caps how many uniquely permissioned items a library can hold. A handful of agent folders is fine; hundreds is not.
In both modes you can also limit what kind of SharePoint the agent uses — Documents, Pages, Lists and Change tracking each toggle separately on the capability card. That’s a narrower blast radius than access alone: an agent with Documents turned off can’t read files even on a site it’s been granted.
Text-based files (txt, md, csv) can be created and edited in place. Other file types — including Office documents — can be read, uploaded from the agent’s documents, and organized (moved, copied, renamed, deleted), but their contents cannot be edited directly in SharePoint. To update an Office document, have the agent generate a new version (for example with its code execution capability) and upload it with overwrite enabled.

​
Example use cases

  • Document Search — “Find all documents in our Legal site that were modified this week”
  • Content Retrieval — “Get the contents of the employee handbook and summarize it”
  • Intranet Digest — “Summarize the news posts published on our Intranet site this month”
  • List Tracking — “List the open items in the Projects site’s Risks list and flag anything overdue”
  • Report Generation — “Every Friday, create a weekly summary report in the Team site based on our Slack activity”
  • Spreadsheet Delivery — “Generate the monthly estimate as an Excel file and upload it to the Projects library”
  • Cross-platform Sync — “Check my Outlook inbox every morning — if you see any invoice emails, save them to the Finance folder in SharePoint”

​
FAQ

Yes. Each folder is its own grant, so repeat the folder grant for every folder, in the same library or different ones. Each grant breaks permission inheritance on that folder, and SharePoint caps the number of uniquely permissioned items per library, so keep it to a handful of folders per library. If the agent needs most of a library, grant the whole site with Read instead.
With a folder grant, SharePoint hides everything outside the granted folder from the agent rather than refusing it: listings show only what the agent may see, and anything else comes back as not found. Check that the item is inside a granted folder, and remember that a folder grant covers documents only — pages and lists are never visible to a folder-scoped agent.
Yes, on the Microsoft side only — nothing changes in Abundly. Consent Files.SelectedOperations.Selected on the app registration, grant the folder, then revoke the site grant and remove Sites.Selected. The order matters: as long as the site grant exists, it covers the whole site and the folder grant narrows nothing.