> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asteragents.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft SharePoint
> Give agents delegated access to search, read, upload, and organize Microsoft 365 SharePoint files
## Overview
The Microsoft SharePoint integration lets agents search sites, browse document libraries, read files, upload files, create folders, and organize content through Microsoft Graph. Aster supports two authentication modes so each organization can match its Microsoft 365 access model.
* **Each member connects (recommended):** every Aster member authorizes their own Microsoft account. SharePoint tools inherit that person's delegated permissions and cannot use another member's credential.
* **Shared Microsoft account:** one Aster admin authorizes a Microsoft account for the organization. Every member using a SharePoint-enabled agent accesses SharePoint as that shared account.
New connections default to per-user authentication. Existing organization-shared connections continue working as shared connections until an admin intentionally changes the mode.
## Setup Guide
An Aster admin opens **Control Hub > Integrations**, selects **Microsoft SharePoint**, and chooses **Each member connects** or **Shared Microsoft account**.
Sign in with a Microsoft 365 work or school account and approve delegated access to sites and files. Some Microsoft tenants require an Entra administrator to grant tenant-wide consent before members can connect.
Edit an agent and select the individual SharePoint tools it needs. Tools are configured per agent: assigning read tools does not automatically assign upload or organization tools.
The admin's successful authorization enables SharePoint for the organization and connects that admin. Other members are prompted to authorize their own Microsoft account when they use a SharePoint-enabled agent.
## Available Tools
* `sharepoint_list_sites` — List SharePoint sites visible to the acting or shared Microsoft account.
* `sharepoint_search` — Search SharePoint and OneDrive content available through Microsoft Graph.
* `sharepoint_list_drive_items` — Browse folders and document-library items.
* `sharepoint_read_file` — Read supported text files or download a binary file up to 5 MB into the Aster conversation.
* `sharepoint_upload_file` — Upload inline text or an existing Aster attachment/file to a document library; supports fail, replace, or rename behavior for name conflicts.
* `sharepoint_create_folder` — Create a folder in a document library or existing folder.
* `sharepoint_move_item` — Move or rename a file or folder within the same document library.
* `sharepoint_copy_item` — Copy a file or folder within a document library or to another drive. Microsoft processes copies asynchronously.
## Choosing a Mode
Use **Each member connects** when SharePoint permissions differ by person, access must be attributable to the acting member, or the Microsoft tenant does not permit a broadly accessible service account.
Use **Shared Microsoft account** when the organization deliberately maintains a Microsoft account whose SharePoint access should be available to everyone using the Aster integration. The shared account's SharePoint permissions become the effective permissions for all those users, so keep its access narrowly scoped.
Changing modes does not remove the active connection when the OAuth flow starts. Aster switches the organization only after the replacement authorization succeeds. Canceling the flow or being blocked by a Microsoft security policy leaves the current connection active.
## Security
* **Delegated Microsoft Graph access:** Aster requests `Sites.Read.All` for site/list discovery and `Files.ReadWrite.All` for file operations. The integration remains bounded by the acting or shared Microsoft account's own SharePoint permissions.
* **Per-agent tools:** each agent receives only the SharePoint tools selected in its configuration. Connecting SharePoint does not automatically add tools to agents.
* **Mode-enforced credential selection:** per-user mode uses only the acting Aster member's credential; shared mode uses only the organization's credential.
* **Server-side tokens:** access and refresh tokens are never returned to the browser or agent.
* **Legacy-safe rollout:** connections created before per-user mode remain organization-shared unless an admin completes a mode change.
* **Bounded requests:** Graph calls have timeouts, limited throttling retries, and a 5 MB limit for binary file downloads.
* **Untrusted content:** agents should treat SharePoint file contents as data, never as instructions.
Connections authorized before SharePoint write tools were released must reconnect once to grant `Files.ReadWrite.All` before those tools can succeed. Existing read tools continue to work with their previously granted scopes.
## Troubleshooting
The organization uses per-user mode, but your Aster user has not authorized Microsoft SharePoint yet, or the saved credential needs to be reconnected. Use the connection prompt and sign in with your own Microsoft account.
The Microsoft tenant may block end-user consent. Ask a Microsoft Entra administrator to approve the Aster application and its delegated SharePoint permissions for the tenant, then retry the connection.
In per-user mode, this is expected when Microsoft permissions differ between those accounts. Grant the member access in Microsoft 365, or intentionally switch the Aster integration to a suitably restricted shared account.
Aster keeps the previous SharePoint connection and mode until the replacement OAuth flow completes successfully. No rollback is necessary.