> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft SharePoint & OneDrive

> Let an agent search and read content across SharePoint sites and OneDrive, and (when enabled) upload and share files and create list items — all as the asking user.

# Microsoft SharePoint & OneDrive

The SharePoint & OneDrive integration lets an agent find and read content across
your **SharePoint** sites and each person's **OneDrive** during a conversation —
search sites and files, read pages and list items, and pull a file's contents to
answer from. When you enable it, the agent can also **upload and share files,
create a OneDrive folder, and add a SharePoint list item**. It always acts **as the
asking user** and sees only what that person can already see.

<Note>
  **This is the SharePoint/OneDrive *integration* — a tool the agent uses inside a
  conversation** (on the web widget, Slack, Teams, voice, and so on). It is **not**
  the same as putting your agent **on** a SharePoint intranet page — that's the
  [SharePoint Online channel](/channels/sharepoint), a separate setup. You can use
  either or both.
</Note>

## Modules

Reads in each enabled module are on by default. **Write tools are off until you
turn them on**, one at a time.

| Module         | What the agent can do                                                                                                                                                                                                                    |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SharePoint** | Search sites, list items, and document-library files; read a site page; read a list item with its fields; read site metadata; fetch an attached image or file. **(opt-in)** create a list item, and upload a file to a document library. |
| **OneDrive**   | Search the user's OneDrive (and files shared with them); read file metadata and contents. **(opt-in)** upload a file, create a folder, and create a shareable link.                                                                      |

Everything runs as the asking user, bounded by **what that person can already
access** in Microsoft 365. There are **no deletes** in this version, and **no
organization-wide admin tools** — every action is a per-user action.

## Set it up

<Steps>
  <Step title="Add the integration">
    From your agent, open **Integrations**, choose **Microsoft SharePoint &
    OneDrive**, and pick the modules you want — **SharePoint**, **OneDrive**, or
    both.
  </Step>

  <Step title="Restrict the SharePoint reach (optional)">
    Add a **SharePoint site allowlist** (one site URL per line, e.g.
    `https://acme.sharepoint.com/sites/it`) to limit which sites the agent can
    search and read. Leave it empty to cover every site the asking person is a
    member of. (The allowlist applies to SharePoint only — OneDrive is per-user by
    design.)
  </Step>

  <Step title="Turn on any write tools you want (optional)">
    Reads are on by default. To let the agent upload or share files, create a
    folder, or add a list item, switch those tools on individually. Leaving them off
    keeps the integration read-only.
  </Step>

  <Step title="Grant tenant admin consent for SharePoint">
    SharePoint's read/write permissions (`Sites.*`) are organization-wide and need a
    **Microsoft 365 tenant admin** to grant consent **once**. OneDrive needs no
    admin consent — its permissions are ones each user can grant for themselves. If
    you enable SharePoint without admin consent, the SharePoint tools stay
    unavailable until consent is granted.
  </Step>

  <Step title="Attest and let users authorize themselves">
    Review the access requested (higher-impact scopes are flagged), name the
    integration, and save. The first time the agent uses a tool for someone, that
    person signs in with Microsoft and approves. If your tenant also uses the
    **Outlook** or **Microsoft Teams** integration, this is the **same Microsoft
    sign-in** — people see one combined prompt, not three.
  </Step>
</Steps>

## How writes stay safe

Write tools run under the guardrails every Cobalt integration gets:

* **Writes are off by default** and enabled one tool at a time.
* **The agent acts as the user**, so an upload or share can only reach what that
  person could already reach in SharePoint or OneDrive.
* **It reports what actually happened**, with a link to the uploaded file, the new
  folder, the shared link, or the created list item.

## Troubleshooting

<Warning>
  **SharePoint tools say they're unavailable.** The most common cause is missing
  **tenant admin consent** — SharePoint's `Sites.*` permissions can't be granted by
  an individual user. Have a Microsoft 365 admin grant consent once. OneDrive is
  unaffected.
</Warning>

* **"Please authorize Microsoft."** Each person authorizes once, and again if you
  later enable a tool that needs a new permission (for example turning on uploads
  after launching read-only). Approve the prompt and the agent continues.
* **A site isn't searchable.** If you set a **site allowlist**, only the listed
  sites are in reach. Either add the site, or clear the allowlist to cover every
  site the person belongs to.
* **"I couldn't find any you can access."** The agent only sees what the asking
  person can — files in a site they don't belong to, or someone else's OneDrive,
  are intentionally out of reach.

## FAQ

<AccordionGroup>
  <Accordion title="How is this different from the SharePoint channel?">
    This **integration** is a set of tools an agent uses *inside* a conversation
    happening on another channel. The [SharePoint Online channel](/channels/sharepoint)
    is about hosting the agent **on** a SharePoint intranet page. They're
    independent and can both be on.
  </Accordion>

  <Accordion title="Do I need a Microsoft admin to set this up?">
    For **OneDrive**, no — each user grants their own access. For **SharePoint**,
    yes — a tenant admin grants organization-wide consent once, because
    SharePoint's site permissions can't be granted per user.
  </Accordion>

  <Accordion title="Whose files can the agent see?">
    Only the asking person's. Reads and writes run with that user's own Microsoft
    365 permissions, optionally narrowed further by your SharePoint site allowlist.
  </Accordion>

  <Accordion title="Can it delete files?">
    No. This version reads, uploads, shares, creates folders, and adds list items —
    it doesn't delete files, folders, or list items.
  </Accordion>

  <Accordion title="Is the Microsoft sign-in shared with Outlook and Teams?">
    Yes. SharePoint/OneDrive, Outlook, and Microsoft Teams all use one Microsoft 365
    sign-in, so people approve a single combined prompt rather than one per
    integration.
  </Accordion>
</AccordionGroup>

## Related

* [Integrations overview](/integrations/overview) — how integrations work in
  general.
* [Microsoft Outlook](/integrations/outlook) and
  [Microsoft Teams](/integrations/microsoft-teams) — the other Microsoft 365
  integrations that share the same sign-in.
* [SharePoint Online channel](/channels/sharepoint) — host the agent *on* a
  SharePoint intranet (a different feature).
* [How Cobalt works](/concepts/how-cobalt-works) — where integrations fit.