Set up SharePoint (BYOA) for a document library

What this guide helps you do

This guide walks you through giving Simpplr safe, limited access to one specific SharePoint document library, instead of your entire SharePoint site. This is called BYOA, which stands for Bring Your Own Application.

In simple terms: you will create a small "application" inside Microsoft that acts as a trusted go between. You will then tell that application it is only allowed to read files from one document library, nothing else on your SharePoint site.

Before you start, keep these handy

As you go through the steps, you will collect a few important values. Keep a notepad open and save each one as you get it:

• Client ID (also called Application ID)

• Client Secret

• Tenant ID

• Document Library ID (also called Drive ID)

Step 1: Create an app registration

This step creates the "application" that Simpplr will use to connect to SharePoint.

1. Go to the Azure Portal.

2. Open Microsoft Entra ID.

3. Click App registrations.

   

4. Click New registration.

5. Give your application a name, then complete the registration.

Step 2: Create a client secret

Think of a client secret as a password for your application. Simpplr will use it to prove it is allowed to connect.

1. Open the app registration you just created.

2. In the left hand menu, click Manage, then click Certificates & secrets.

3. On the Certificates & secrets screen, make sure you are on the Client secrets tab.

4. Click New client secret.

   

5. Copy the secret that appears and save it somewhere secure right away.

Step 3: Grant Microsoft Graph permissions

This step tells Microsoft exactly what your new application is allowed to do. Microsoft Graph is simply the system that lets applications like this one talk to services such as SharePoint.

1. In the left hand menu (still under Manage), click API permissions.

2. Click Add a permission.

   

3. Under the Microsoft APIs tab, click the Microsoft Graph card.

   

4. Choose Application permissions.

   

5. In the search bar, type the following permission name exactly:

   Lists.SelectedOperations.Selected

6. Select that permission from the list, then click Add permission.

   

7. Click Grant admin consent for the tenant. This button appears near Add a permission.

   

Step 4: Add your domain in Simpplr

Before setting up SharePoint itself, you need to register your Microsoft domain in Simpplr.

1. In your Simpplr instance, go to Settings, then Applications.

2. Click the Integrations tab.

3. Click Domains.

   

4. Scroll down to the Microsoft section and click Add domain name.

5. In the window that appears, select Microsoft SharePoint, then click Add Domain.

   

6. You will be taken to the Microsoft Entra login page. Log in, and your domain will be added automatically.

Step 5: Configure SharePoint in Simpplr

Now you will connect the application you created earlier to Simpplr.

1. In your Simpplr instance, go to Settings, then Applications.

2. Click the Integrations tab, then click File Management.

3. Scroll to the bottom and select the checkbox next to Microsoft SharePoint.

   

4. Select Use your own app connection for public file links.

5. Fill in the following fields using the values you saved earlier:

   

   • Tenant ID: enter your Microsoft Tenant ID from your Microsoft App that you created

   • Client ID: enter your Application ID from your Microsoft App that you created

   • Client Secret: enter the client secret you copied in Step 2
     

6. Click Save.

Before you continue: what is Graph Explorer?

The next few steps use a free Microsoft tool called Graph Explorer. You will use it to look up two IDs, and to grant your application access. You do not need to write any code, just paste in a web address and click a button.

You can find it here:

https://developer.microsoft.com/en-us/graph/graph-explorer

Before you begin, log in. In the top left corner of the page, click the profile icon and sign in with your Azure Portal account.

Step 6: Get the Site ID

To grant access to a specific document library, you first need to identify the SharePoint site it belongs to using its Site ID.

1. Go to the Azure Portal home page and click the menu icon in the top left corner.

2. Click Microsoft 365 Admin. This will take you to the Microsoft 365 admin center.

   

3. Click the menu icon in the top left corner again.

4. Click SharePoint. This will take you to your SharePoint instance.

   

5. Search for the site you want to grant access to, and note its exact name.
   

6. Copy the hostname from your SharePoint URL. For example, if your SharePoint URL is https://smplrdev.sharepoint.com/sites, the hostname is smplrdev.sharepoint.com.

7. Note the site path, which is the site name with spaces removed. For example, a site called "Document Library Site" becomes DocumentLibrarySite.

8. Open Graph Explorer (https://developer.microsoft.com/en-us/graph/graph-explorer) in a new tab, and make sure you are logged in.

9. Make sure GET is selected, then enter the following in the address box, replacing {hostname} and {site-path} with your own values:

   https://graph.microsoft.com/v1.0/sites/{hostname}:/sites/{site-path}

   For example, using the sample values from earlier:

   https://graph.microsoft.com/v1.0/sites/smplrdev.sharepoint.com:/sites/DocumentLibrarySite

10. Confirm the API version is set to v1.0, then click Run Query.

11. In the response, find the line that starts with "id":. Copy the value after it. This is your Site ID, and it will look something like this:

    smplrdev.sharepoint.com,c8e6ebf5-1cfe-4337-ab54-308ab8b9482d,6088f2b2-0975-4077-8d5c-ae9b557e4242

Step 7: Get the Document Library (Drive) ID

In Microsoft's terminology, a document library is called a "drive." This step helps you find the ID of the specific library you want Simpplr to access.

1. Go back to Graph Explorer. If you were logged out, sign back in using the profile icon in the top left corner.

2. Make sure GET is selected, then enter the following in the address box, replacing {site-id} with the Site ID you copied in Step 6:

   https://graph.microsoft.com/v1.0/sites/{site-id}/drives

3. Confirm the API version is set to v1.0, then click Run Query.

4. The response will show a list of document libraries. Find the entry whose name matches the library you want, then copy its id value.

   For example, in this sample response, the document library named "BYOA Testing" has an id of b!9evmyP4cN0OrVDCKuLlILbLyiGB1CXdAjVyum1V-QkIRaplQTxz9S7SRm1yObgEe.

   

Step 8: Grant the application access to the document library

This is the final step. Here you tell Microsoft that your application is allowed to read files from this one specific library, and nothing else.

1. Stay in Graph Explorer, and change GET to POST.

2. In the address box, enter the following, replacing {drive-id} with the Drive ID you copied in Step 7:

   https://graph.microsoft.com/v1.0/drives/{drive-id}/root/permissions

   For example:

   https://graph.microsoft.com/v1.0/drives/b!9evmyP4cN0OrVDCKuLlILbLyiGB1CXdAjVyum1V-QkIRaplQTxz9S7SRm1yObgEe/root/permissions

3. Click the Request Body tab, and paste in the following, replacing <CLIENT_ID> with your application's Client ID and <APPLICATION_NAME> with your application's name: /

   { "roles": ["read"], "grantedToV2": { "application": { "id": "<CLIENT_ID>", "displayName": "<APPLICATION_NAME>" } } }

   For example:

   { "roles": ["read"], "grantedToV2": { "application": { "id": "ca80fe18-7621-40f1-8894-9a93e4d482b7", "displayName": "Doc Library App" } } }

4. Click Run Query to send the request.

Once this completes successfully, your application has read only access to this one document library. It cannot see or access anything else on your SharePoint site.

You're done! Simpplr can now safely pull files from this document library.

Troubleshooting

I can't find my client secret anymore

• What happened: Client secrets are only shown once, at the moment they are created. Microsoft does not store a copy you can view later.

• What to do: Go back to Certificates & secrets and create a new client secret. Then update the Client Secret field in your Simpplr SharePoint settings with the new value.

The application doesn't seem to have the access it should

• What happened: This usually means the Lists.SelectedOperations.Selected permission was not added, or admin consent was not granted.

• What to do: Go to API permissions and confirm that the permission has been added and that Grant admin consent for the tenant has been completed.

I'm not sure which Document Library (Drive) ID is the right one

• What happened: A SharePoint site can have more than one document library, so the response may list several.

• What to do: Run the request GET https://graph.microsoft.com/v1.0/sites/{site-id}/drives again, and check the name and webUrl fields carefully to identify the correct library before copying its id.

The permission request didn't grant access as expected

• What happened: This is usually caused by a typo in the request, or by leaving a placeholder (like <CLIENT_ID>) unreplaced.

• What to do: Double check that your request is:

POST https://graph.microsoft.com/v1.0/drives/{drive-id}/root/permissions

and that roles is set to ["read"], and that both <CLIENT_ID> and <APPLICATION_NAME> have been replaced with your application's actual values.

Frequently asked questions

Q: What does this setup actually do?

Ans: It gives your registered application read only access to one specific SharePoint document library, instead of your whole SharePoint site.

Q: Will the application be able to see my entire SharePoint site?

Ans: No. It can only read files in the one document library you specifically granted it access to.

Q: What level of access does the application get?

Ans: Read only access. It cannot edit, delete, or add files. This is set by "roles": ["read"] in the request body.

Q: Which Microsoft Graph permission do I need?

Ans: Lists.SelectedOperations.Selected. You add this under API permissions, and it needs admin consent for your tenant.

Q: Can I see my client secret again after I close the page?

Ans: No. It is shown only once. Save it somewhere secure the moment it appears.

Q: What information do I enter into Simpplr?

Ans: Under SharePoint, then File Management, you will enter your Client ID (Application ID), Client Secret, and Microsoft Tenant ID, then save.

Q: How do I find my Document Library (Drive) ID?

Ans: Use Graph Explorer to run GET https://graph.microsoft.com/v1.0/sites/{site-id}/drives, then find your library in the list and copy its id.

Q: Where do I actually run the final permission request?

Ans: In Microsoft Graph Explorer, using the POST request described in Step 8.