SharePoint

Connect SharePoint to collect cloud storage provider evidence automatically.

Connect with an API token

1. In SharePoint:

   1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Cloud Application Administrator.
   2. Browse to Entra ID › App registrations and select New registration. Enter a Name, under Supported account types select Single tenant only - <your tenant>, and select Register.
   3. In the app registration, select Certificates & secrets › Client secrets › New client secret. Add a description, select an expiration (24 months at most; Microsoft recommends less than 12), and select Add.
   4. Copy the client secret Value: it is never displayed again after you leave the page.
   5. In the app registration, select API permissions › Add a permission › Microsoft Graph › Application permissions.
   6. Under Select permissions, select the permission to grant, then select Add permissions.
   7. Select Grant admin consent for <your tenant> and confirm.

   Where to find the other values:

   • Client ID: The app registration's Overview page shows the Application (client) ID.

   SharePoint shows the secret only once, so copy it before you leave the page.

   SharePoint's public documentation does not cover every step.

   SharePointTenantSettings.Read.All is the least-privileged permission for reading SharePoint tenant settings. With delegated access, the signed-in user must be a Global Reader or SharePoint Administrator; the application permission above does not need a signed-in user. Microsoft recommends certificates over client secrets for production. Cloud (optional) is the national cloud: Global, US Government L4/L5 or China (21Vianet), all of which support this API. The Tenant ID label (Directory (tenant) ID) was not quoted on the pages read. Verification: SharePointTenantSettings.Read.All comes from the Graph sharepointsettings-get page, which was not fetched under the three-source limit, so the permission name was removed; the Tenant ID location was not on the pages read and was removed.

   Source: learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.

   The permissions Safeguard needs: SharePointTenantSettings.Read.All, Global Reader or SharePoint Administrator (signed-in user).

2. On Compliance › Connectors, open SharePoint, click Connect, choose API token and fill in:

   Field	What to enter
   Tenant ID	Required.
   Client ID	Required.
   Client secret	Required. Stored encrypted and never shown again.
   Cloud (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read SharePoint and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Storage Provider connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks