Permissions and security

For data security, encryption, and credential storage information that applies across all connectors, see Data & Security - Enterprise Search Connectors.

Our approach to permissions

• The connector requests the minimum set of permissions the SharePoint and Microsoft Graph APIs allow for its functionality, and only read-oriented scopes wherever the source APIs permit it.

• The connector never writes to or modifies data in SharePoint.

• Credentials are stored encrypted and are never exposed in logs, search results, or the Simpplr UI after initial entry.

• One requested permission, Sites.FullControl.All (or its scoped alternative, Sites.Selected), is broader than its name suggests would be needed for a read-only connector. This is called out explicitly in Sensitive permissions — common concerns below, together with the guardrails that apply.

Credential scope

Auth type: Application authentication (OAuth 2.0 client credentials, certificate-based)

The app registration you create in Microsoft Entra must be granted the following permissions. There are two options for the site-access permission , sharing the Complete Access or Scoped Access — see Alternative permission models below.

Microsoft Graph API

SharePoint

Admin consent must be granted for all permissions listed above. This requires a Microsoft Entra admin, or a Global Admin who can grant consent on your behalf. If you are not an admin, coordinate with one before proceeding to setup.

Understanding the credentials scope

Sites.FullControl.All or Sites.Selected (Graph API & SharePoint)

Why it's required: The connector reads permissions using the Microsoft Graph and the SharePoint REST APIs. Both APIs require a full-control-level scope (or heavily restricted Selected scope) to successfully return complex permission hierarchies for site pages and lists — a narrower read scope is rejected by these specific endpoints when querying permissions.

What the connector actually does with it: Read-only calls to retrieve site, page, list, and item permissions so they can be accurately enforced in Simpplr search results. The connector performs no write, update, or delete operations in SharePoint.

Guardrails: Simpplr's sync pipeline only reads data; there is no code path in the connector that writes to or modifies SharePoint. All connector activity is strictly for indexing.

If not granted: The connector cannot read permission hierarchies for site pages and lists. Without this (or its Sites.Selected alternative), the integration cannot function securely, as search results would not accurately reflect native SharePoint permissions.

Sites.Read.All (Graph API & SharePoint)

Why it's required: To make SharePoint sites discoverable, the connector needs to read site configurations, metadata, and underlying content across the tenant via both Microsoft Graph and the SharePoint REST API.

What the connector actually does with it: Makes read-only calls to index site titles, descriptions, and content structures so they can be properly routed and surfaced within Simpplr search results.

Guardrails: This permission inherently restricts the API to read operations. The connector cannot modify site structures, alter metadata, or delete content.

If not granted: The connector will be unable to discover or index SharePoint sites, meaning site content will be entirely excluded from Simpplr.

Files.Read.All (Graph API)

Why it's required: The integration needs access to document libraries to extract file content and properties so users can search for their documents directly from Simpplr.

What the connector actually does with it: Performs read-only scans of file text and metadata (such as titles, authors, and modification dates) to build the search index.

Guardrails: The permission is read-only. Simpplr only extracts text for search indexing; it does not alter source files, change sharing links, or permanently store original files outside the index.

If not granted: Files and documents will not be indexed, severely limiting the usefulness of the search integration for end users.

GroupMember.Read.All (Graph API)

Why it's required: To accurately map SharePoint's security boundaries to Simpplr, the system must understand which users belong to which Microsoft 365 or security groups.

What the connector actually does with it: Retrieves the membership rosters of groups to resolve user access rights, ensuring that Simpplr search results strictly honor your native SharePoint permissions.

Guardrails: The connector only reads group rosters. It has no ability to add or remove members, nor can it create, modify, or delete groups.

If not granted: Simpplr cannot accurately replicate document-level or site-level permissions, which could either expose restricted content in search results or block users from seeing content they are authorized to view.

User.Read.All (Graph API)

Why it's required: The connector must resolve user identities within the Microsoft tenant and match them correctly with their corresponding Simpplr profiles to sync permissions.

What the connector actually does with it: Reads basic user profile information (such as email address, name, and unique ID) to cross-reference identities with the Simpplr user directory.

Guardrails: Activity is strictly limited to reading directory profiles. The connector cannot modify user attributes, reset passwords, change account statuses, or assign licenses.

If not granted: The connector cannot map SharePoint identities to Simpplr users, causing the permission sync to fail and degrading the security of the search experience.

Sites.FullControl.All (Graph API and SharePoint)

Why it's required: The connector reads permissions using the Microsoft Graph /delta endpoint and the SharePoint REST API. Both APIs require a full-control-level scope to successfully return permission hierarchies for site pages and lists — a narrower read scope is rejected by these specific endpoints. See Microsoft's documentation on scanning permission hierarchies.

What the connector actually does with it: Read-only calls to retrieve site, page, list, and item permissions so they can be enforced in Simpplr search results. The connector performs no write, update, or delete operations in SharePoint.

Guardrails: The connector's sync pipeline only reads data; there is no code path that writes to SharePoint. All connector activity is visible in the sync dashboard.

If not granted: The connector cannot read permission hierarchies for site pages and lists, and cannot function without this permission (or its Sites.Selected alternative).

Alternative permission models

If you choose Sites.Selected, additional post-registration steps are required to fetch site IDs and grant the application access to each site individually. These steps are documented on Setup - SharePoint (Additional steps for Sites.Selected).

Supporting your security review

We understand that permissions such as Sites.FullControl.All may raise concerns during your security review, even though the Simpplr connector only performs read operations.

Simpplr uses the narrowest permissions Microsoft currently supports while still allowing SharePoint permissions to be enforced accurately in search. Organizations that need tighter control can use Sites.Selected to limit access to specific sites.

If your team needs a more granular read-only permission model, we encourage you to raise this with your Microsoft representative. Simpplr will continue working with customers and Microsoft to support stronger least-privilege options as they become available.

Versions and editions supported

• Supported: SharePoint Online (Cloud), with the SharePoint Storage Service enabled.

• Not supported: On-premises SharePoint — the connector authenticates via a Microsoft Entra app registration, which applies to SharePoint Online tenants only.

Permission design

How permissions work

Permissions from SharePoint are read and enforced in Simpplr Enterprise Search. Users only see content they already have access to in SharePoint.

• User and group sync: SharePoint user identities and group memberships are read and stored by the permission sync. When a user is added to or removed from a SharePoint group, the change is reflected in Simpplr after the next permission sync.

• Item permission changes: When an item's permissions change in SharePoint, the change is picked up by the next incremental sync.

• Access removal: When a user loses access to an item in SharePoint, that item stops appearing in their Simpplr search results after the next incremental sync completes.