Microsoft SharePoint connection

The SharePoint connection is authenticated using OAuth 2.0 against Microsoft Entra ID (AzureAD). The connector supports three distin ct authentication patterns, selected via Grant Type and Credentials Type on the OAuth 2.0 field:

• Client Credentials (Client Secret) — application-only access with no user sign-in. Best for unattended, service-to-service integrations.
• Certificate-Based Authentication (CBA) — application-only access using a JWT assertion signed by a private certificate instead of a shared secret. Eliminates the risk of a leaked client secret.
• Authorization Code (Delegated) — the connector acts as a signed-in user. Required when actions must be attributed to, or scoped to the permissions of, a specific user.

tip

• Prefer Client Credentials or Certificate-Based Authentication for scheduled/unattended integration processes.
• Use Certificate-Based Authentication when your organization's security policy disallows storing shared secrets.
• Only use Authorization Code when the process must operate with a specific user's delegated permissions.
• Grant the narrowest Graph API permission scope that satisfies your use case (for example, Sites.Read.All instead of Sites.ReadWrite.All for read-only integrations).

SharePoint connection tab

The following are the fields when authenticating with OAuth 2.0 (Microsoft Entra):

Field	Required	Type	Description	Example
Graph API Base URL	Required	String	The Microsoft Graph API base URL. Leave as the default unless connecting to a sovereign/government cloud.	https://graph.microsoft.com/v1.0
Grant Type	Required	Dropdown	Client Credentials or Authorization Code.	Client Credentials
Credentials Type	Required for Client Credentials	Dropdown	Client Secret or JWT Assertion (Certificate). Default: Client Secret.	Client Secret
Authorization URL	Required for Authorization Code	String	OAuth authorization endpoint.	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize
Token URL	Required	String	OAuth token endpoint.	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
Scope	Required	String	For Client Credentials/CBA: https://graph.microsoft.com/.default. For Authorization Code: Sites.ReadWrite.All Files.ReadWrite.All User.ReadWrite.	https://graph.microsoft.com/.default
Client ID	Required	String	Application (Client) ID from the Azure App Registration.	4b2f1a9e-...
Client Secret	Required for Client Secret / Authorization Code	String	Client secret from the Azure App Registration.	(secure field)
Signature Algorithm	Required for JWT Assertion/CBA	Dropdown	PS256 (recommended by Microsoft) or RS256.	PS256
Issuer / Subject	Required for JWT Assertion/CBA	String	The Application (Client) ID from Azure.	4b2f1a9e-...
Audience	Required for JWT Assertion/CBA	String	https://login.microsoftonline.com/{tenant-id}/v2.0	—
Expiration	Optional	Integer	JWT assertion lifetime in seconds. Default 3600.	3600
Signature Key	Required for JWT Assertion/CBA	Boomi Private Certificate	Holds the RSA private key whose matching public certificate is uploaded to the Azure App Registration.	—
X.509 Certificate SHA-256 Thumbprint	Required for JWT Assertion/CBA	String	Identifies which registered certificate signed the assertion.	Computed with openssl x509 -in cert.crt -outform DER | openssl dgst -sha256 -binary | base64 | tr '+/' '-_' | tr -d '='
SharePoint Site URL	Required	String	The full URL of your SharePoint site.	https://contoso.sharepoint.com/sites/finance
Connect Timeout (ms)	Optional	Integer	Time to wait for a connection to establish before timing out. Default 30000.	30000
Read Timeout (ms)	Optional	Integer	Time to wait for a response after a connection is established. Default 60000.	60000
Max Retries	Optional	Integer	Maximum retry attempts for throttled (429) and transient server (5xx) errors. Default 3.	3

Test connection

You can test your connection settings before using or saving them in a process. Test Connection validates the SharePoint Site URL and your OAuth credentials by requesting the site's metadata from Microsoft Graph (GET /sites/{hostname}:{site-path}?$select=id,displayName).

If successful, you can save and use the connection. If unsuccessful, the connector returns a specific, actionable message:

note

• 401 Authentication failed — Check the Token URL and Client ID. For Client Credentials/Authorization Code, verify the Client Secret; for JWT Bearer, verify the certificate is uploaded to the Azure AD app registration and that Issuer, Subject, and Audience are correct.
• 403 Permission denied — The configured site is not accessible. Ensure the service principal has Sites.Read.All or site-specific read permission.
• 404 Site not found — Verify the SharePoint Site URL is correct.
• Timeout errors – Network issues or a slow tenant – Check firewall rules; increase Connect/Read Timeout values

For more information, refer to Microsoft identity platform authentication.