Permissions & Security - Custom Connector

Updated 2 seconds ago

For security teams and IT admins granting consent.

For data security, encryption, and credential storage information that applies across all connectors, see Data & Security - Enterprise Search Connectors.

Our approach to permissions

The connector requests the minimum set of permissions the Amazon S3 and Microsoft Graph APIs allow for its functionality, and only read-oriented scopes.
The connector never writes to or modifies data in Amazon S3 or SharePoint Online.
Credentials are stored encrypted and are never exposed in logs, search results, or the Simpplr UI after initial entry.
Each Custom Connector instance uses exactly one source type (Amazon S3 or SharePoint Online), chosen at creation. Only the credentials for that source type are requested.

Credential scope

Amazon S3

Auth type: Access key (AWS access key ID + secret access key)

The IAM user or role you create for Simpplr must be granted the following permissions, scoped to the bucket(s) you want indexed:

Permission	Why it's needed
`s3:ListAllMyBuckets`	Used to validate connectivity when testing the connection, and to discover buckets when the connector is configured to read all buckets the credential can list.
`s3:ListBucket`	Lists the objects in each configured bucket so the connector can find `.json` files to sync.
`s3:GetObject`	Reads the content of each `.json` object so it can be parsed and indexed.

There is no separate “admin consent” step in AWS — attach an IAM policy granting exactly these actions to the access key you provide to Simpplr.

SharePoint Online

Auth type: Azure AD app-only authentication (client credentials with a certificate)

The Azure AD app registration you create must be granted the following Sharepoint permissions and Microsoft Graph application permissions:

Microsoft Graph API Permissions

Permission	Why it's needed
`Sites.Read.All`	Read site metadata and content across the tenant
Files.Read.All	Read file content and metadata

SharePoint Permissions

Permission	Why it's needed
`Sites.Read.All`	Read site content via the SharePoint REST API

Admin consent must be granted for this permission by a Global Administrator (or equivalent role) in your Microsoft 365 / Azure AD tenant.

Versions and editions supported

Supported: Amazon S3 (any AWS account/region reachable with the provided access key); SharePoint Online (Microsoft 365 cloud).
Not supported: On-premises SharePoint Server. Other object-storage providers (e.g., Google Cloud Storage) are not yet available as Custom Connector source types.