SharePoint overview
Glean connects to Microsoft SharePoint for indexed and real-time search, scoped to each user's permissions. All content access operates under the shared Microsoft 365 parent connector app registration. Client secrets are not supported for SharePoint or OneDrive. Microsoft retired Azure ACS on April 2, 2026, so certificate authentication is the only supported method.
SharePoint is a child connector of the Microsoft 365 parent connector, which provides shared authentication and identity crawling. Set up Microsoft 365 first; SharePoint then inherits its credentials (client ID, tenant ID, and certificate) and needs only SharePoint-specific configuration.
Capabilities
Glean connects to SharePoint once, through the shared Microsoft 365 app registration, and that single connection provides three capabilities: indexed search, real-time search, and read and write tools. The new setup configures all three in one pass, because indexing and real-time search are both turned on when you connect and tools are set up in the same flow. With the previous setup, indexing is configured first and an administrator enables real-time search separately. Real-time search and tools each require the individual user to authorize their own SharePoint account before they take effect for that user.
Which capabilities do you need?
Use the comparison below to see what each capability contributes to search, ranking, and agent behavior.
| What you get | Indexed connector | Real-time search | Read and write tools |
|---|---|---|---|
| Coverage | Org-wide: everything crawled is searchable by anyone with permission | Per-user: only content the querying user can access | — |
| Freshness | Near real-time (webhook-driven updates) | Always live (fetched at query time) | — |
| AI ranking (activity signals) | ✓ Full ranking | ✗ Not available | — |
| Fetch unindexed content by URL (for example, sharing links) | ✗ (only documents already in the index) | ✓ (fetched live, even if never indexed) | — |
| Agents read and summarize documents | ✓ | ✓ | Through read tools |
| Agents can move, update, or share files | — | — | ✓ |
| Content stored in Glean's index | Yes (crawled and indexed) | No (nothing stored) | No |
| Separate app registration | No (inherits Microsoft 365) | No (inherits Microsoft 365) | Only for custom OAuth |
| Separate tool configuration | No | No | Yes (Admin console → Platform → Tools) |
| Best for | Broad, ranked, everyday search | Volatile or sensitive content kept current and unindexed | Agentic file management |
Set up SharePoint
- Choose your setup: Start with this page to identify which of Glean's two setup paths applies to you, which depends on when SharePoint was connected to your deployment.
- New setup: Follow this path if you are connecting SharePoint for the first time. The new setup connects SharePoint and configures indexing on a single page in the Admin console.
- Previous setup: Follow this path if SharePoint was already connected to your deployment before the new setup was introduced. Those connectors continue to work, and there is no migration to run.
- Set up the indexing connector: This page covers indexing in detail. It describes the permissions the connector requires, what Glean crawls from your SharePoint sites, pages, lists, and document libraries, and how to scope the crawl.
- Real-time search: Real-time search fetches content live from SharePoint at query time, which suits content that must always be current or that you would rather not store in Glean's index.
- Read and write tools: Read and write tools let Glean agents and Assistant act on SharePoint document libraries. You configure them separately from indexing.
Permissions and security
Glean reads all user access permissions from SharePoint and enforces them at query time, so users only see results they have access to. For details, see permission enforcement and the activity signals used for ranking. All authentication uses certificate-based application permissions with admin consent; no delegated user privileges are used for indexing.