Set up Microsoft 365

Set up the Microsoft 365 identity app first. Then connect SharePoint and OneDrive with their own content apps. Each connector uses its app's client ID and certificate credentials, while the directory tenant ID stays on the Microsoft 365 parent.

You're reading the new setupSee the previous setup interface →

If a connector's setup shows inherited credentials instead of editable fields, keep the existing shared app and manage its credentials on Microsoft 365. You don't need to recreate working connections, replace their registrations, or reconnect users because of these instructions.

1. Sign in to the Admin consoletoday — current step
2. Register the identity app in Microsoft Entra IDtoday — current step
3. Connect the suite in Gleantoday — current step
4. Set up SharePoint, OneDrive, and Outlookafter saving — current step
5. Identity crawl runs in the backgrounda few days — happens automatically

Connector setup

Register and connect the identity app before configuring content connectors.

Prerequisites

Confirm the following before you begin.

Requirement	Why it is needed
A Glean admin who can add and configure connectors	Adds the Microsoft 365 suite and enters its credentials in the Admin console
A Microsoft 365 Global Administrator	Registers the app, grants admin consent, and uploads the certificate in Azure

Step 1. Sign in to the Admin console

1. Sign in to Glean and open the Admin console.
2. Go to Connectors.
3. Add the Microsoft 365 connector.
4. Keep this page open. You return to it in step 3 to enter the identity app credentials.

Step 2. Register the Glean app in Microsoft Entra ID

Create the identity app for the Microsoft 365 parent connector.

1. Sign in to the Azure portal as a Global Administrator.
2. Select Microsoft Entra ID → Manage → App registrations → New registration.
3. Register an app named Glean, with Accounts in this organizational directory only (Single tenant) and no redirect URI, then select Register.
4. Add identity permissions.
   • Open Manage → API Permissions.
   • Select Add a permission → Microsoft Graph → Application permissions.
   • Add User.Read.All, GroupMember.Read.All, Reports.Read.All, and Member.Read.Hidden.
5. Grant admin consent.
   • Sign in to Azure as a Global Administrator.
   • Use the search box to go to Enterprise applications, then select the Glean app you created.
   • Open Security, then Permissions.
   • Review the permissions shown, then select Grant admin consent.
6. Add certificate authentication.
   • Generate a certificate and private key.
   • Upload the certificate to the app under Manage → Certificates and secrets.
   • For the exact commands and the private-key format, follow Set up certificate authentication in the reference.

Request all suite permissions upfront

You can request security approval for the identity and content apps together. Keep their permissions separate and grant admin consent on each app, rather than adding all scopes to the identity app. See Request all suite permissions upfront.

Step 3. Connect the suite in Glean

Enter the identity app's credentials on the Microsoft 365 page in the Admin console.

1. In Azure, open the identity app's Overview page and copy the Application (client) ID and Directory (tenant) ID from the Essentials panel.
2. In Glean, paste the Application (client) ID and Directory (tenant) ID.
3. Click Upload certificate file (.crt) and upload the certificate. Click Upload private key file (.key) and upload the matching private key.
4. Select your tenant size.
5. Click Continue to save the Microsoft 365 configuration and start identity crawling.

Glean uses the parent app for identity crawling. SharePoint and OneDrive inherit the directory tenant ID when you configure them, not the identity app's client ID or certificate credentials.

Step 4. Set up SharePoint, OneDrive, and Outlook

For each content connector you plan to use, register its app, grant its permissions and admin consent, and configure its client ID and certificate credentials in Glean. The tenant ID comes from the Microsoft 365 parent and doesn't appear in the new SharePoint and OneDrive indexing forms.

• SharePoint setup
• OneDrive setup
• Outlook setup

Don't register extra apps for crawl speed. If additional apps are already configured, keep them in place and maintain their permissions and credentials on the connector that owns them. This doesn't change the required identity and content apps.

Native real-time access needs delegated permissions and the redirect URI on the default app only.

After setup

• Check progress any time from the Microsoft 365 connector page in the Admin console.
• Use Data fetching for recently created or updated content. It supplements indexed results, requires end-user authentication, and doesn't apply sensitivity-label indexing exclusions. See Real-time access for OneDrive and Set up real-time access for SharePoint.

If a content connector needs additional permissions later, add them to its app and any applicable existing additional apps, then grant admin consent again.

See also

• Choose your Microsoft 365 setup shows which setup is yours and how the suite fits together.
• Microsoft 365 overview explains how the suite works and which child connectors it covers.
• Microsoft 365 setup is the full configuration reference, including certificate generation.