SharePoint App-Based authentication

App-Based (Service Principal) authentication uses an Azure AD app registration scoped to specific SharePoint sites, instead of a personal admin login. Use this method for enterprise environments where a personal admin login isn't acceptable, or where access must be strictly limited to specific SharePoint sites. It's recommended for production integrations.

For the OAuth (Delegated) method instead, see SharePoint connection.

Prerequisites

• A Microsoft 365 account with SharePoint Online enabled.
• Global Administrator or SharePoint Administrator permissions in Microsoft Entra ID.

Step 1: Registering the Azure AD app

1. Sign in to the Azure portal and go to Microsoft Entra ID > App registrations > New registration.
2. Enter a name for the app, for example, Boomi SharePoint Integration, set Supported account types to Single tenant, and click Register.
3. On the Overview page, copy the Application (client) ID and Directory (tenant) ID. You need both values when you create the connection.

Step 2: Adding the Sites.Selected permission

1. Go to API permissions > Add a permission > Microsoft Graph > Application permissions.

2. Search for Sites.Selected, select it, and click Add permissions.

3. Confirm the permissions list shows only Sites.Selected. If Files.Read.All or Sites.Read.All are present, remove them. These grant tenant-wide access and break per-site isolation.

4. Click Grant admin consent. The status must turn green.

   Permission	Type	Purpose
   Sites.Selected	Application	Scopes the app to specific sites only. Grants zero access on its own — a per-site grant (Step 4) is required.

note

Do not add Files.Read.All, Sites.Read.All, Files.ReadWrite.All, Sites.ReadWrite.All, or offline_access. These either break site isolation or don't apply to this authentication flow.

Step 3: Creating a client secret

1. Go to Certificates & secrets > New client secret.
2. Set an expiry period and click Add.
3. Copy the Value immediately. It's shown only once.

Step 4: Granting the app access to specific sites

note

This is the most commonly missed step. Granting admin consent in Step 2 doesn't give the app access to any site — it only declares that access will be scoped. A SharePoint admin must explicitly grant the app read access to each site the integration needs. Repeat for every site.

Option A: Graph Explorer (no install required)

1. Open Graph Explorer and sign in as a tenant admin.

2. Get the site ID:

   GET https://graph.microsoft.com/v1.0/sites/[tenant].sharepoint.com:/sites/[SiteName]

   Copy the id value from the response.

3. Grant read access to the app:

   POST https://graph.microsoft.com/v1.0/sites/{siteId}/permissions
   
   {
     "roles": ["read"],
     "grantedToIdentities": [{
       "application": {
         "id": "[client-id]",
         "displayName": "Boomi SharePoint Integration"
       }
     }]
   }

   Success returns 201 Created.

Option B: PowerShell

Connect-PnPOnline -Url "https://[tenant]-admin.sharepoint.com" -Interactive

Grant-PnPAzureADAppSitePermission `
  -AppId "[client-id]" `
  -DisplayName "Boomi SharePoint Integration" `
  -Site "https://[tenant].sharepoint.com/sites/[SiteName]" `
  -Permissions Read

Step 5: Configuring the connection in Data Integration

1. Open the SharePoint connection form in Data Integration.

2. Assign a name to your connection.

3. Under Authentication Method, select App-Based (Service Principal).

4. Fill in the following fields:

   Field	Value
   Tenant ID	Directory (tenant) ID from Step 1.
   Client ID	Application (client) ID from Step 1.
   Client Secret	Secret value from Step 3.
   Folder link	SharePoint copy link to the folder. Must be from a site granted in Step 4.

5. Click Test Connection.

6. Click Save.

Common pitfalls

Symptom	Cause	Fix
Permission denied on every run	The per-site grant (Step 4) was skipped.	Run the Graph Explorer or PowerShell steps for each site.
App can read sites it shouldn't	Files.Read.All or Sites.Read.All is on the app.	Remove those permissions from the app registration.
Still getting access after removing a broad permission	An old token is cached (valid up to ~1 hour).	Create a new connection in Data Integration to force a fresh token.
Folder link fails with a permission error	The link points to a site not in the per-site grant list.	Grant the app access to that site (Step 4), or use a link from an already-granted site.