Skip to main content
Community Hub
TL;DR

Connect SharePoint to Atlan through OneLake shortcuts or Microsoft Graph so agents can read your document libraries as context.

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Connect SharePoint as knowledge source Private Preview

You can connect SharePoint so that Atlan agents read your document libraries. Atlan reaches SharePoint through one of two routes, both read-only and both using an app registered in your own Microsoft Entra tenant:

  • OneLake shortcuts: Atlan reads the SharePoint shortcuts you already built in a Microsoft Fabric lakehouse. Your app needs no SharePoint permission. If you already run Atlan's Fabric connector, you can reuse its app.
  • Microsoft Graph: Atlan reads the SharePoint sites you grant to your app, directly through Microsoft Graph.

Agents read files live on each run. Atlan doesn't sync or index your SharePoint content.

Choose route​

OneLake shortcutsMicrosoft Graph
How Atlan readsThrough SharePoint shortcuts in a Fabric lakehouseDirectly from the SharePoint sites you grant
NeedsMicrosoft Fabric, with SharePoint shortcuts in a lakehouseAn Entra app with Sites.Selected, admin consent, and a grant per site
SharePoint permission on your appNoneSites.Selected only
What agents can doList shortcuts, list files, readList sites, list files, search, read
Citations link to the SharePoint fileNoYes
Where reads runOn your Fabric capacity, in its regionMicrosoft Graph
Setup timeAbout 5 minutes reusing the Fabric connector app, about 15 minutes with a new appAbout 20 minutes

Choose OneLake shortcuts when Fabric is already in place and your shortcuts expose the folders you want, especially if you already run the Atlan Fabric connector. Choose Microsoft Graph when you need search and citations back to SharePoint, or you don't use Fabric.

One route per connection

You can switch routes later. Saving the other route replaces the connection, and agents keep reading through the current one until you save.

Prerequisites​

Before you begin, make sure you have:

  • Permission to create integrations in Atlan. If you can't see Settings → Integrations, ask a workspace admin or raise a support request
  • The Microsoft admins for your route:
RouteMicrosoft roles needed
OneLake shortcuts, reusing the Fabric connector appFabric workspace admin
OneLake shortcuts, new appFabric admin, Fabric workspace admin, and someone who can register apps in Entra
Microsoft GraphSomeone who can register apps in Entra, plus a Global Administrator or Privileged Role Administrator for admin consent

For OneLake shortcuts you also need:

  • A Fabric lakehouse that already holds SharePoint shortcuts for the folders you want agents to read
  • To reuse an app: an Atlan Fabric connection that signs in with a service principal, and that you administer. You administer it if you're an Atlan workspace admin, hold the connection's admin role, or are listed, directly or through a group, in its connection admins. Fabric connections that sign in through APIM or a Secure Agent can't be reused; set up a new app instead

For Microsoft Graph you also need the URL of each SharePoint site agents need to read. Microsoft has no API that lists the sites granted to an app, so Atlan keeps the list you add.

Start setup​

  1. In your Atlan workspace, click Settings from the left sidebar.
  2. Under Team, click Integrations.
  3. Click the MCP filter, find SharePoint, and click Connect. On a connected source, click Manage connection. If SharePoint isn't listed, it isn't turned on for your workspace yet; raise a support request to enable it.
  4. On the Route step, choose OneLake shortcuts or Microsoft Graph, then click Next.

The wizard has four steps on either route: Route, Set up in Fabric or Set up in Entra, Your app, and Shortcuts or Sites. Follow the section for your route.

Connect through OneLake shortcuts​

Atlan reads the SharePoint shortcuts already in your lakehouse. The shortcut's own SharePoint connection does the reading, and Atlan's app is checked only against OneLake, so there is no admin consent or per-site grant. The app can read only the shortcuts you select.

On the Set up in Fabric step, choose how Atlan signs in:

  • Set up a new app (default): register a separate app for SharePoint, for example if your security team wants a dedicated identity.
  • Reuse my Fabric connector app: Atlan already holds this app for your Fabric connector. No new app, secret, or Entra consent.

Option 1: Reuse Fabric connector app​

The Fabric connector setup already covered the app registration, its secret, and the Service principals can use Fabric APIs tenant setting. What's left takes about 5 minutes with a workspace admin.

In Fabric:

  1. Give the Fabric connector app read access to the lakehouse. In the workspace that holds your SharePoint shortcuts, open Manage access and add the app as Viewer. Then in the lakehouse, open Manage OneLake security → DefaultReader and add the app. If your Fabric connection already crawls this workspace, the app is probably a Viewer already; the Shortcuts step tells you if a role is missing.
  2. Check that OneLake is open to apps outside Fabric. In the Fabric admin portal → Tenant settings, keep Users can access data stored in OneLake with apps external to Fabric turned on. It's on by default.

In Atlan:

  1. Select Reuse my Fabric connector app, then click I have done this. If the option is disabled, none of your Fabric connections can be reused: they sign in through APIM or a Secure Agent, or you don't administer them.
  2. On Your app, Atlan shows Using the app from your Fabric connection with the connection's name when there is one reusable connection. With several, pick the one whose app you granted in Fabric.
  3. Click Verify app. Atlan reads that connection's credentials itself and checks them with Microsoft.
  4. Continue to Pick your shortcuts.

Atlan reads the Fabric connection's credentials each time it signs in, so rotating the Fabric connector's secret needs no change in SharePoint.

The connection follows whoever saved it

If the person who saved the SharePoint connection loses admin rights on the Fabric connection, agents stop reading SharePoint until another admin of that Fabric connection opens Manage connection and saves again.

Option 2: Set up new app​

This takes about 15 minutes with a Fabric admin and a workspace admin.

In Microsoft Entra and Fabric:

  1. Register an app. In the Entra admin center, go to App registrations → New registration. Single tenant, no redirect URI. Add no API permissions: this route needs none, so there is nothing to consent to.
  2. Create a client secret. Go to Certificates & secrets → New client secret. Copy the Value straight away; Microsoft shows it once.
  3. Let service principals use Fabric. In the Fabric admin portal → Tenant settings, turn on Service principals can use Fabric APIs, and keep Users can access data stored in OneLake with apps external to Fabric on. If either setting is limited to security groups, add the app to one of them.
  4. Give the app read access to the lakehouse. In the workspace that holds your SharePoint shortcuts, open Manage access and add the app as Viewer. Then in the lakehouse, open Manage OneLake security → DefaultReader and add the app. Viewer alone isn't enough; DefaultReader is read-only.

In Atlan:

  1. Click I have done this.
  2. On Your app, keep Set up a new app selected and fill in:
FieldWhere to find it
Directory (tenant) IDEntra → App registrations → your app → Overview
Application (client) IDSame Overview page as the tenant ID
Client secret valueThe secret's Value from step 2, not its Secret ID
  1. Click Verify app. Atlan checks the credentials with Microsoft before it looks at your lakehouse.

Pick your shortcuts​

  1. In Fabric, open the lakehouse that holds your SharePoint shortcuts and copy its address from the browser. Atlan accepts the Fabric portal URL, such as https://app.fabric.microsoft.com/groups/<workspace-id>/lakehouses/<lakehouse-id>, a onelake.dfs.fabric.microsoft.com URL, or an abfss:// URI.
  2. Paste it into Lakehouse address and click List shortcuts. Atlan lists each SharePoint and OneDrive shortcut in the lakehouse with its path, such as Files/<shortcut-name>, and checks which ones your app can read.
  3. Select the shortcuts agents may read. Only shortcuts marked Readable can be selected. For any other status, see Shortcut and site statuses.
  4. Click Save. Atlan checks every selected shortcut again with your app before it stores the connection.
Who sees what

Every user of an agent with this source can read every selected shortcut. The shortcut reads SharePoint as whatever identity its Fabric connection uses, so review that identity before you select a shortcut.

Connect through Microsoft Graph​

Atlan reads SharePoint directly through an app with the Sites.Selected application permission. The app reads with nobody signed in, and only the sites you grant it.

Consent alone grants nothing

Until a site is granted to the app, the app can read nothing, even with admin consent. The Sites step builds the grant request for you.

Set up in Entra​

This takes about 20 minutes.

  1. Register an app. In the Entra admin center, go to App registrations → New registration. Supported account types: this organizational directory only. No redirect URI.
  2. Add the Sites.Selected permission. Go to API permissions → Add a permission → Microsoft Graph → Application permissions → Sites.Selected. Choose Application, not Delegated. Nothing else is needed.
  3. Grant admin consent. Go to API permissions → Grant admin consent. This needs a Global Administrator or Privileged Role Administrator.
  4. Create a client secret. Go to Certificates & secrets → New client secret. Copy the Value straight away; Microsoft shows it once.
  5. Grant the app each site. You do this in the Sites step. Keep the Entra tab open.
Don't add Sites.Read.All

Sites.Read.All gives the app every site in your tenant and overrides the per-site boundary that Sites.Selected sets. Request Sites.Selected only.

Your app​

  1. Click I have done this.
  2. Fill in Directory (tenant) ID and Application (client) ID from Entra → App registrations → your app → Overview, and Client secret value with the secret's Value.
  3. Click Verify app. Atlan checks the credentials with Microsoft before you add any sites.

Add and grant sites​

  1. Add the full URL of each site agents must read, such as https://<your-org>.sharepoint.com/sites/<site-name>. The root site isn't accepted.

  2. For each site, click Grant request. Atlan builds the two calls that grant your app read access to that site. Run them in Graph Explorer, signed in as someone who can open the site, with Sites.FullControl.All consented for Graph Explorer. That consent is for the person running the request, not for your app.

    GET https://graph.microsoft.com/v1.0/sites/<your-org>.sharepoint.com:/sites/<site-name>

    POST https://graph.microsoft.com/v1.0/sites/<site-id>/permissions
    {
      "roles": ["read"],
      "grantedToIdentities": [
        { "application": { "id": "<client-id>", "displayName": "Atlan SharePoint" } }
      ]
    }

    Use the id returned by the GET as <site-id> in the POST. Someone who can't open the site gets a 403.

  3. Click Check sites. Each granted site shows Readable.

  4. Click Save. Atlan checks every site again with your app before it stores the connection.

If sites were granted to the app earlier, Find sites already granted scans every site in your tenant for ones your app can read. It's slow on large tenants, so prefer adding site URLs.

Who sees what

Every user of an agent with this source can read every granted site. The site list is the access boundary, so grant only sites that everyone using the agent may read.

Validate results​

  • The SharePoint card in Settings → Integrations lists the shortcuts or sites agents can read. Atlan checked each one with your app before storing it.
  • SharePoint appears as a selectable source when you create or edit an agent.
  • Run a sample run on an agent that uses SharePoint. Cited results confirm the agent can read your files.

Manage connection​

Open the SharePoint card and click Manage connection. Nothing changes until you save.

  • Add or remove shortcuts or sites: go to the last step, change the selection, and save.
  • Switch route: on the Your app step, click Switch to Microsoft Graph or Switch to OneLake shortcuts. Saving replaces the connection.
  • Rotate your app's secret: create a new secret in Entra, paste its Value into Client secret value, then verify and save. Atlan never shows a saved secret, so paste it again whenever you save this step.
  • Rotate the Fabric connector's secret: nothing to do here. Atlan reads the Fabric connection's credentials each time it signs in.

If Microsoft later refuses the app, the SharePoint card shows a banner. For your own app, the secret has probably expired: open Manage connection and enter a new one. For a reused Fabric app, fix that Fabric connection first, then open Manage connection and save again.

Troubleshooting​

Shortcut and site statuses​

StatusRouteCauseFix
Your app cannot read this yetOneLakeOneLake refused your appAdd the app to the lakehouse's DefaultReader role, then list again
Shortcut is brokenOneLakeThe SharePoint folder behind the shortcut is gone, or the shortcut's connection no longer signs inFix the shortcut in Fabric
Not granted to your app yetGraphThe site hasn't been granted to your appRun the grant request, then check again
No site at this addressGraphThe URL doesn't match a siteCheck the URL, including the /sites/ part
Not a SharePoint site addressGraphThe URL isn't a SharePoint site URLEnter a full site URL such as https://<your-org>.sharepoint.com/sites/<site-name>
Could not checkBothMicrosoft didn't answer cleanly. On OneLake, your Fabric capacity may be pausedTry again in a moment
Not checked yetBothSaved earlier, not checked in this sessionClick List shortcuts or Check sites

A shortcut whose name contains ; or \ can't be stored. Rename it in Fabric.

App verification errors​

These appear when you click Verify app or Save.

What you seeCauseFix
"That secret was rejected"The secret's Secret ID was pasted, or the secret has expiredPaste the secret's Value, or create a new secret
"That secret has expired"The client secret passed its expiry dateCreate a new secret in Entra and paste its Value
"No app with that client ID exists in that tenant"The two IDs come from different apps or tenantsCopy both IDs from the same app's Overview page
"That tenant ID wasn't found" or "Use the Directory (tenant) ID"A domain name or wrong ID was enteredPaste the Directory (tenant) ID
"The app has none of the application permissions this source needs"Graph route: Sites.Selected is missing or not consentedAdd Sites.Selected under Application permissions and grant admin consent
"Fabric refused the app"OneLake route: the app lacks workspace or OneLake accessAdd the app to the workspace as Viewer with the DefaultReader role, and turn on Service principals can use Fabric APIs
"No lakehouse with that ID in that workspace"OneLake route: the lakehouse address is wrongCopy the lakehouse address again from the browser
"You don't manage this Fabric connection"Reuse: you aren't an admin of that Fabric connectionAsk the connection's admin or a tenant admin to connect SharePoint with it, or set up a new app
"This connection signs in through Azure API Management" or "This connection has no stored credential to reuse"Reuse: the Fabric connection uses APIM, a Secure Agent, or no service principalSet up a new app
"That Fabric connection was not found" or "The Fabric connection this uses was removed"Reuse: the Fabric connection was deleted or archivedReconnect SharePoint with another Fabric connection or a new app
"Whoever connected SharePoint no longer manages this Fabric connection"Reuse: the person who saved the connection left or lost the admin roleAn admin of that Fabric connection opens Manage connection and saves again

If saving fails because your app can't read a shortcut or site, it lost access after you checked it. Fix the access, check again, and save.

Limits​

  • File types with text extraction: PDF, DOCX, PPTX, XLSX, TXT, MD, CSV, TSV, JSON, XML, LOG, YAML, HTML, and ASPX. Files of other types are listed but not read.
  • Text per file: agents read up to the first 60,000 characters of each file. Very large files may be cut short.
  • OneLake shortcuts: no search and no SharePoint links in citations. Reads run on your Fabric capacity in its region, and fail while the capacity is paused.

Need help​

If you need assistance after reviewing this page, contact Atlan support.

See also​