SharePoint Connector

The SharePoint connector syncs documents from Microsoft SharePoint Online into a Knowledge base, so an AI Employee can search and cite that content in its answers. It reaches SharePoint through the Microsoft Graph API and offers three authentication modes, chosen with the Authentication Mode selector:

• App Credentials — an Azure AD app registration with a client secret. This is the default and the usual choice.
• App Certificate — the same app registration proving itself with an uploaded X.509 certificate instead of a secret. Use it when your Azure AD app is configured to reject client secrets.
• Sign in with Microsoft — delegated OAuth2, where an individual signs in with their own Microsoft account.

A connection stores only credentials — it is not tied to any one site. You choose which sites, libraries, and folders to ingest on each Knowledge base built from the connection.

You set up a SharePoint connection from the Data sources tab of the Integrations page. Creating a connection is admin-only, and the creator chooses whether it is a Shared or User connection (see Authentication and connections); builders never see credentials — they reference the resulting Knowledge base when configuring a workflow.

What it ingests

For each Knowledge base you point the connector at one or more SharePoint URLs — a site, a document library, or a folder. The connector resolves each URL to its site and library, walks every subfolder under it recursively, and ingests each file it finds. Because scope is set per URL, one connection can span multiple sites and more than one document library. Files are downloaded and sent through the shared ingestion pipeline (extract → chunk → embed → store) described in Data Connectors.

For each file the connector captures its name, folder path, MIME type, size, and a source version tag used for incremental sync. Only file types the pipeline can extract are processed — see Limits. Access problems never fail the whole sync: a subfolder the identity can't read is skipped with a warning, and any URL that can't be reached — no access, wrong tenant, a deleted site, or a temporary error — is recorded as a skipped target while the remaining URLs still sync. Each URL shows a Synced or Skipped badge in the Folder scope card after a run.

How to connect

Open the Data sources tab, select the SharePoint tile, and choose an Authentication Mode. All modes ask for a connection name; App Credentials and App Certificate also take an optional description plus your Azure AD app details.

App Credentials mode

App Credentials mode authenticates as an Azure AD app registration using the client-credentials flow — no interactive sign-in. The setup form collects:

To produce those credentials, the in-product setup guide walks you through Azure:

1. In the Azure portal, go to Microsoft Entra ID → App registrations → New registration. Name it (for example, "Ema SharePoint Connector") and choose single-tenant.
2. On the app Overview page, copy the Directory (tenant) ID and Application (client) ID.
3. Under API permissions, add Microsoft Graph → Application permissions for Sites.Read.All and Files.Read.All, then Grant admin consent (requires admin rights).
4. Under Certificates & secrets, create a new client secret and copy its Value immediately — it is shown only once.

Paste the three values into the form and select Create connection. Ema validates the credentials by acquiring a token from Azure AD before storing the connection; the specific sites and folders are checked later, when you scope a Knowledge base.

App Certificate mode

Use App Certificate mode when your Azure AD app registration is set to reject client secrets and require a certificate. It authenticates as the same app registration but proves possession of an uploaded X.509 certificate instead of sending a secret — still no interactive sign-in.

Setup matches App Credentials through the Azure app-registration steps; the difference is in Certificates & secrets: instead of creating a client secret, open the Certificates tab, select Upload certificate, and upload the public certificate (.cer/.pem). Note its expiry — syncs fail once the certificate lapses. Never upload the private key to Azure.

The form collects the same Connection name, Description, Azure Tenant ID, and Client ID, plus one field:

Select Create connection to validate and store.

Sign in with Microsoft (delegated)

This mode uses the OAuth2 authorization-code flow: you sign in with your Microsoft account and consent to read access — no service principal or admin consent step is required up front. It is available only when SharePoint OAuth2 is configured on your Ema platform; the form disables it and shows a notice when it isn't.

To connect:

1. Select Sign in with Microsoft mode and enter a connection name.
2. Select Connect with Microsoft. Ema redirects you to login.microsoftonline.com with a signed state parameter for CSRF protection.
3. Approve the requested scopes: Files.Read.All, Sites.Read.All, and offline_access.
4. Microsoft redirects back to Ema's callback, which exchanges the one-time code for an access and refresh token, runs a live test against the site, and stores the tokens encrypted.
5. The Data sources tab shows a success banner and the new connection appears in the list.

Sync configuration

Scope and schedule are set on the Knowledge base built from the connection, not on the connection itself. One connection can feed several Knowledge bases, each scoped to different folders.

Folder scope

A SharePoint source syncs nothing until you give it at least one URL — there is no whole-site or whole-tenant default. In the Knowledge base's Folder scope card, add one or more Folder URLs: a site URL (e.g. https://contoso.sharepoint.com/sites/engineering), a document-library URL, or a folder URL as it appears in your browser's address bar. Ema normalizes each one, handling URL-encoding and SharePoint view URLs (the .../Forms/AllItems.aspx form, including id/RootFolder parameters) automatically. Only files under the URLs you supply are ingested.

Schedule

In the Knowledge base's Sync configuration, set:

• Sync enabled — turn syncing on or off.
• Schedule — Interval (sync automatically) or Manual (only on demand). For interval, set the interval in minutes.
• Sync now — trigger a one-off sync at any time.

Syncs are incremental: the connector compares each file's eTag against the stored content hash and skips unchanged files, so re-syncs only process what changed. The page shows the last and next sync times.

Limits and behavior

• Scope is set per URL, not per connection. One connection can ingest from multiple sites and from more than one document library; it only crawls the URLs you add to a Knowledge base, never a whole tenant automatically.
• Supported file types only. Extractable types are PDF; Word, Excel, and PowerPoint (.docx, .xlsx, .pptx); plain text, Markdown, CSV, HTML, and JSON; and images (.png, .jpg, .webp, .gif) read via a vision model. Other types are counted as unsupported and skipped.
• Read-only. Both modes request read scopes only — the connector never writes back to SharePoint.
• Partial access is tolerated. Subfolders the identity can't read are skipped with a warning; the sync continues for everything else.
• Rate limits from Graph (HTTP 429/503) are retried with Retry-After back-off, capped at five minutes per wait, up to three attempts.

What's next

• Data Connectors — the connection model, the ingestion pipeline, and how connectors compare to Tools.
• Google Drive Connector, Confluence Connector, Box Connector — the other source connectors.