Providers

Microsoft SharePoint and OneDrive

Connect Microsoft SharePoint and OneDrive: delegated Graph scopes, the site and library you choose, the file metadata Noru reads, and the reach of Files.Read.All.

Authentication
OAuth
Categories
Productivity, Security
Sync cadence
Daily by default (hourly, weekly, or monthly on request)
Requested access
https://graph.microsoft.com/User.Readhttps://graph.microsoft.com/Files.Read.Allhttps://graph.microsoft.com/Sites.Read.Alloffline_accessopenidprofile

SharePoint and OneDrive supply document-management evidence. You pick one site and one document library or folder; Noru walks that location and records item metadata, library configuration, and tenant sharing settings. It never opens a file.

What Noru collects

ObjectSource callWhat it feeds
SitesFollowed sites, falling back to the first 50 from /sitesSite selection and site evidence
Files and folders under the selected locationDrive item listing, recursively: name, size, type, created and modified, web URL, created by, last modified byDocument-control evidence (up to 1000 items)
Document librariesPer siteLibrary configuration evidence
Tenant sharing settings/admin/sharepoint/settings; a 403 stores nothing rather than a guessSharing-policy evidence

Defaults: sites, OneDrive files, document libraries, and security settings on; audit logs off; maximum 1000 files.

What Noru does not collect

  • File contents. Noru never requests file content.
  • Per-file permission lists. The Include File Permissions option currently has no effect; permission lists are not collected.
  • Audit logs. The Include Audit Logs option is off by default, and this connector does not hold the AuditLog.Read.All scope, so turning it on collects nothing. Treat audit logs as not collected.
  • Anything outside the selected site, library, or folder.
  • Noru never writes to SharePoint or OneDrive.

Before you connect

  • A Microsoft account with access to the site you want. Visibility is the connecting user's, so pick an account that can see the target library.
  • Admin consent for the .All scopes. A Global Administrator or Cloud Application Administrator must consent for the tenant on first connection.
  • A decision on scope: one connection covers one site and one library or folder. Connect again for another location.

Files.Read.All lets the token read every file the consenting user can reach, across all sites and OneDrives, not just the selected library. Noru only reads the location you pick, and metadata only, but the grant itself is tenant-wide for that user. Connect with an account whose own access matches what you are comfortable delegating.

Connect

Open /data-sources and click Connect Data Source.
Pick Microsoft SharePoint & OneDrive under Productivity. The Connect Microsoft SharePoint dialog opens with the caption "Connect to SharePoint and OneDrive to collect document management evidence."
Enter a Connection name (placeholder "My Microsoft SharePoint Integration"). "What we collect" lists document access evidence, site and library configuration metadata, and file-level sharing and security metadata.
Click Connect to Microsoft and complete consent in the popup.
On Select sync location, choose a SharePoint site (placeholder "Select a SharePoint site"), then expand the library tree and pick a document library or a folder inside it. The dialog shows "Selected: name (folder)" or "(entire library)".
Click Complete setup.
Connect Microsoft SharePoint dialog before consentConnect Microsoft SharePoint dialog before consent
Name the connection, then consent.

Noru stores the selected site, library, and folder with the connection.

After connecting

Each sync re-walks the selected location, refreshes library and sharing evidence, and maps it to document-control and sharing controls. Tokens refresh with offline_access; reconnect only when consent is revoked or scopes change.

Permissions in detail

ScopeWhy Noru asksWhat it could technically allow
User.ReadIdentify the connecting userRead that user's profile
Files.Read.AllList items in the selected libraryRead all files the user can access, including content, in every site and OneDrive
Sites.Read.AllList sites and document libraries, read sharing settingsRead all site collections the user can access
offline_access, openid, profileToken refresh and sign-in identityStandard OpenID Connect

Every scope is delegated and read-only. There is no Graph scope that limits file reads to a single library, which is why the callout above exists.

Troubleshooting

SymptomCause and fix
"Microsoft SharePoint permissions are insufficient or expired. Reauthenticate and grant the required read-only permissions."Consent lapsed or was partial. Reconnect and accept every scope
No sites in the selectThe user follows no sites and has no site access, or the /sites fallback returned nothing. Follow the site in SharePoint or connect with a user who can see it
Consent screen says admin approval is requiredThe .All scopes need tenant admin consent. Ask an admin to connect or to grant consent for Noru first
"No Microsoft SharePoint data collected…"Every collection call failed, usually a 403 on the selected site. Check the sync log
Sharing settings evidence is emptyThe user is not a SharePoint admin; /admin/sharepoint/settings returned 403 and Noru stored nothing
Item count stops at 1000The maximum-files cap. Pick a narrower folder

Last updated on

Microsoft Entra ID

Connect Microsoft Entra ID: delegated Graph scopes with admin consent, the user, group, policy, and sign-in data Noru reads, and what the People directory gets from it.

Neo4j Aura

Connect Neo4j Aura: Aura API client credentials, the two tenant and instance reads Noru makes, and why it never touches graph data.

On this page

What Noru collectsWhat Noru does not collectBefore you connectConnectAfter connectingPermissions in detailTroubleshootingRelated