---
title: SharePoint Online connector
description: Use the SharePoint Online connector to search across SharePoint sites, pages, drives, and lists using the Microsoft Graph API.
url: https://docs-v3-preview.elastic.dev/elastic/kibana/pull/280898/reference/connectors-kibana/sharepoint-online-action-type
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.4
---

# SharePoint Online connector
The SharePoint Online connector enables federated search across SharePoint sites, pages, and content using the Microsoft Graph API.

## Create connectors in Kibana

You can create connectors in **Stack Management > Connectors**.

### Connector configuration

SharePoint Online connectors support three Microsoft Entra ID authentication types:

#### OAuth client credentials (app-only auth)

<definitions>
  <definition term="Token URL">
    The OAuth 2.0 token endpoint URL. Use the format: `https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token`.
  </definition>
  <definition term="Client ID">
    The application (client) ID from your Microsoft Entra app registration.
  </definition>
  <definition term="Client Secret">
    The client secret generated for your Microsoft Entra application.
  </definition>
</definitions>


#### OAuth Client Certificate (Microsoft Entra) — app-only auth

<definitions>
  <definition term="Token URL">
    The OAuth 2.0 token endpoint URL. Use the format: `https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token`.
  </definition>
  <definition term="Client ID">
    The application (client) ID from your Microsoft Entra app registration.
  </definition>
  <definition term="Certificate">
    The PEM-encoded public X.509 certificate uploaded to the app registration. Must begin with `-----BEGIN CERTIFICATE-----`.
  </definition>
  <definition term="Private Key">
    The PEM-encoded RSA private key matching the uploaded certificate. Must begin with `-----BEGIN PRIVATE KEY-----` (PKCS#8), `-----BEGIN RSA PRIVATE KEY-----` (PKCS#1), or `-----BEGIN ENCRYPTED PRIVATE KEY-----` (encrypted PKCS#8). Stored encrypted at rest.
  </definition>
  <definition term="Passphrase">
    (Optional) Only required if the private key is encrypted.
  </definition>
</definitions>


#### OAuth authorization code (delegated auth)

<definitions>
  <definition term="Authorization URL">
    The Microsoft Entra ID authorization endpoint. Use the format: `https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize`. Replace `{tenant-id}` with your Azure AD tenant ID.
  </definition>
  <definition term="Token URL">
    The Microsoft Entra ID token endpoint. Use the format: `https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token`. Replace `{tenant-id}` with your Azure AD tenant ID.
  </definition>
</definitions>


## Test connectors

You can test connectors when you create or edit the connector in Kibana. The test verifies connectivity by accessing the root SharePoint site.
The SharePoint Online connector has the following actions:
<definitions>
  <definition term="Search">
    Search for content across SharePoint sites, lists, and drives using the Microsoft Graph Search API.
    - `query` (required): The search query string.
    - `entityTypes` (optional): Array of entity types to search. Valid values: `site`, `list`, `listItem`, `drive`, `driveItem`. Defaults to `site`.
    - `region` (optional): Search region (`NAM`, `EUR`, `APC`, `LAM`, `MEA`). Only used with app-only (client credentials or certificate) auth; omit when using delegated (authorization code) auth to avoid errors.
    - `from` (optional): Offset for pagination.
    - `size` (optional): Number of results to return.
  </definition>
  <definition term="Get all sites">
    List all SharePoint sites. With app-only (client credentials or certificate) auth, returns all sites the app can access. With delegated (authorization code) auth, searches accessible sites — pass a keyword or omit for a wildcard search.
    - `search` (optional): Keyword to filter sites by name. Only used with delegated auth; ignored with app-only auth.
  </definition>
  <definition term="Get site">
    Get a single site by ID or relative URL.
    - `siteId` (optional): Site ID.
    - `relativeUrl` (optional): Relative URL path (for example, `contoso.sharepoint.com:/sites/site-name`).
  </definition>
  <definition term="Get site pages">
    List pages for a site.
    - `siteId` (required): The site ID.
  </definition>
  <definition term="Get site page contents">
    Get page content (including `canvasLayout`) for a site page.
    - `siteId` (required): The site ID.
    - `pageId` (required): The page ID.
  </definition>
  <definition term="Get site drives">
    List drives for a site.
    - `siteId` (required): The site ID.
  </definition>
  <definition term="Get site lists">
    List lists for a site.
    - `siteId` (required): The site ID.
  </definition>
  <definition term="Get site list items">
    List items for a site list.
    - `siteId` (required): The site ID.
    - `listId` (required): The list ID.
  </definition>
  <definition term="Get drive items">
    List items in a drive by `driveId` (optionally by path). Returns metadata including `@microsoft.graph.downloadUrl`.
    - `driveId` (required): The drive ID.
    - `path` (optional): Path relative to drive root.
  </definition>
  <definition term="Download drive item (text)">
    Download a drive item by `driveId` and `itemId`, returning text content only.
    - `driveId` (required): The drive ID.
    - `itemId` (required): The drive item ID.
  </definition>
  <definition term="Download item from URL">
    Download item content from a pre-authenticated `downloadUrl`, returning base64.
    - `downloadUrl` (required): A pre-authenticated download URL.
  </definition>
  <definition term="Call Graph API">
    Call a Microsoft Graph v1.0 endpoint by path only.
    - `method` (required): HTTP method, `GET` or `POST`.
    - `path` (required): Graph path starting with `/v1.0/` (for example, `/v1.0/me`).
    - `query` (optional): Query parameters (for example, `$top`, `$filter`).
    - `body` (optional): Request body (for `POST`).
  </definition>
</definitions>

<tip>
  Use `getDriveItems` to fetch metadata and `downloadUrl`, decide which items are worth retrieving, then call `downloadItemFromURL` for the selected items. This avoids extra round trips to fetch download metadata.
</tip>


## Connector networking configuration

Use the [Action configuration settings](/elastic/kibana/pull/280898/reference/configuration-reference/alerting-settings#action-settings) to customize connector networking, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.

## Get API credentials


### OAuth client credentials (app-only auth)

To use app-only authentication, register an application in Microsoft Entra (formerly Azure Active Directory):
1. Go to the [Azure Portal](https://portal.azure.com/).
2. Go to **Microsoft Entra ID** > **App registrations**.
3. Select **New registration**.
4. Enter a name for your application.
5. Select **Accounts in this organizational directory only**.
6. Select **Register**.
7. In your app registration, go to **API permissions**.
8. Select **Add a permission** > **Microsoft Graph** > **Application permissions**.
9. Add the following permissions:
   - `Sites.Read.All` — Read items in all site collections.
- `Files.Read.All` — Read all files the user can access.
10. Select **Grant admin consent** for your organization.
11. In your app registration, go to **Certificates & secrets**.
12. Select **New client secret**.
13. Enter a description and select an expiration period.
14. Select **Add**.
15. Copy the secret value immediately (you cannot view it again after you leave the page).
16. Enter the following values when configuring the connector in Kibana:
   - **Token URL**: `https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/token` (find your tenant ID in the **Overview** section of your app registration).
- **Client ID**: Found in the **Overview** section (also called Application ID).
- **Client Secret**: The value you copied in step 15.


### OAuth Client Certificate (Microsoft Entra) — recommended for production

To use certificate-based app-only authentication, register an application in Microsoft Entra:
1. Go to the [Azure Portal](https://portal.azure.com/).
2. Go to **Microsoft Entra ID** > **App registrations**.
3. Select **New registration**.
4. Enter a name for your application.
5. Select **Accounts in this organizational directory only**.
6. Select **Register**.
7. In your app registration, go to **API permissions**.
8. Select **Add a permission** > **Microsoft Graph** > **Application permissions**.
9. Add the following permissions:
   - `Sites.Selected` — Read items in selected site collections.
- `Files.Read.All` — Read files in all site collections.
10. Select **Grant admin consent** for your organization.
11. Generate a certificate and matching private key. For example, with OpenSSL:
   ```bash
   openssl req -x509 -newkey rsa:2048 -nodes \
     -keyout private_key.pem \
     -out certificate.pem \
     -days 365 \
     -subj "/CN=kibana-sharepoint-connector"
   ```
12. In your app registration, go to **Certificates & secrets** > **Certificates** > **Upload certificate**.
13. Upload the `.pem` public certificate from the previous step.
14. Enter the following values when configuring the connector in Kibana:
   - **Token URL**: `https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/token`
- **Client ID**: Found in the **Overview** section (also called Application ID).
- **Certificate**: paste the full contents of `certificate.pem` (including the `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` markers).
- **Private Key**: paste the full contents of `private_key.pem` (including the BEGIN/END markers).
- **Passphrase**: only if you generated an encrypted private key.


### OAuth authorization code (delegated auth)

To use delegated (per-user) authentication, register an application and configure the Authorization Code flow:
1. Go to the [Azure Portal](https://portal.azure.com/).
2. Go to **Microsoft Entra ID** > **App registrations**.
3. Select **New registration**.
4. Enter a name for your application.
5. Select **Accounts in this organizational directory only**.
6. Under **Redirect URI**, select **Web** and enter your Kibana redirect URI (for example, `https://your-kibana-url/api/actions/connector/_oauth_callback`).
7. Select **Register**.
8. In your app registration, go to **API permissions**.
9. Select **Add a permission** > **Microsoft Graph** > **Delegated permissions**.
10. Add the following permissions:
   - `Sites.Selected` — Read items in selected site collections.
- `Files.Read.All` — Read all files the user can access.
- `offline_access` — Maintain access through refresh tokens.
11. In your app registration, go to **Certificates & secrets**.
12. Select **New client secret**.
13. Enter a description and select an expiration period.
14. Select **Add**.
15. Copy the secret value immediately.
16. Enter the following values when configuring the connector in Kibana:
   - **Authorization URL**: `https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/authorize`
- **Token URL**: `https://login.microsoftonline.com/{your-tenant-id}/oauth2/v2.0/token`
- **Client ID**: Found in the **Overview** section (also called Application ID).
- **Client Secret**: The value you copied in step 15.

<note>
  With delegated auth, the connector operates on behalf of the user who completes the authorization flow. The `getAllSites` action uses a search-based fallback (instead of `/sites/getAllSites`) and the `search` action does not support the `region` parameter.
</note>