SharePoint setup

You're reading the new setupSee the previous setup interface →

The new setup connects SharePoint in the Admin console: connect tools, configure indexing with the SharePoint app's certificate credentials, then review the setup. The Microsoft 365 parent connector provides identity crawling and the tenant ID. See Microsoft 365.

If the SharePoint credential fields show inherited credentials, use the existing parent app for the permissions and certificate steps, and update its credentials on the Microsoft 365 parent connector. You do not need to recreate an existing connection.

• Time required. Roughly 15 minutes of administrator work. The first crawl then runs in the background, and takes anywhere from a few hours to a few days depending on how much content your SharePoint tenant holds.
• Who does it. A Glean administrator, working with a Microsoft 365 Global Administrator who can grant consent on behalf of the tenant.
• What you get. Permission-aware search across your SharePoint sites, pages, files, and lists, plus read and write tools that are available upon connecting.

How features become available after setup

Connecting SharePoint configures tools. Each user must authorize their own account to use them. Indexed search results appear progressively as the first crawl works through your sites.

Capability	When it becomes available
Read and write tools	After tools are connected and each user authorizes their own account.
Permission-aware search over SharePoint content	After the first crawl indexes your content. Results appear progressively as the crawl works through your sites.
Activity signals used for ranking	After the first crawl, once Glean has SharePoint usage history to rank results with.
Real-time search	Enabled by this setup. Each user authorizes their own account before real-time results reach them. See Real-time search.
Crawling restrictions	Configure before starting indexing, or update later. See Crawling restrictions to control which sites and content Glean crawls.

Set up the connector

Prerequisites

Prepare the following before setup:

• Set up the Microsoft 365 parent connector for identity crawling and the tenant ID.
• Prepare a SharePoint app registration with a certificate and the required application permissions for indexing. See Add SharePoint permissions.
• SharePoint Online. The connector supports SharePoint Online. Have your SharePoint domain to hand, for example company.sharepoint.com.
• Have a Microsoft 365 Global Administrator complete the app-permission and tenant-wide consent steps in this guide.
• Glean administrator access. You need permission to add and configure connectors in the Admin console.
• A custom OAuth application, only if your organization requires one. Most deployments use Glean's managed application and need nothing here. If you must use your own registration, have the client ID and client secret ready, along with the ability to add a redirect URI to that registration in Microsoft Entra ID.

Step 1: Open the SharePoint setup page

Sign in to the Glean Admin console as an administrator, then open the SharePoint setup page under the Microsoft 365 suite. SharePoint uses the parent connector's identity data and tenant ID, with its own app credentials for content access.

Step 2: Connect SharePoint

1. In Name, keep the default connector name or enter one of your own. This is the name your organization's members see for this connector.

2. Under Select an authorization method, choose how Glean authorizes tools. This choice applies to tools only. Configure the SharePoint indexing app credentials in Set up indexing. Central is preselected and is the only option shown until you select Set up a custom app instead.

3. Select Connect, then complete the Microsoft sign-in and grant consent when prompted. Sign in with an account that holds the Global Administrator role, so that consent covers the whole tenant rather than your own account.

Multi-geo SharePoint tenants

If your SharePoint configuration contains multiple geo domains, Glean automatically uses the first configured domain when it creates the SharePoint tool connection. You do not need to select a domain manually during Connect. Continue to Step 3: Set up indexing to configure SharePoint indexing.

Authorization methods

Central (recommended)

Central uses Glean's managed OAuth application. There is nothing to register in Microsoft: Glean's application is already configured, and you grant it access to your tenant during this step. Most deployments use this option and need no further configuration.

Custom OAuth app

Use this option only if your organization requires its own application registration in Microsoft Entra ID. Select Set up a custom app instead to reveal it, then provide the following:

• Client ID and Client secret of your application registration.
• The Callback URL that Glean displays. Add it as a redirect URI on your registration before you continue, otherwise Microsoft rejects the authorization request.
• The delegated Microsoft Graph and SharePoint permissions that Glean lists. The list shown in the Admin console is already scoped to your deployment, so grant exactly those permissions rather than substituting values of your own.

For the full walkthrough, including how to create the registration and where each value comes from, see Microsoft 365 tools setup.

A custom application still relies on your Microsoft 365 connection for the Azure tenant ID. Connect Microsoft 365 first, or Glean cannot complete the setup.

Tools authorization does not start indexing. Configure the indexing app next, then start the crawl from Review setup.

Step 3: Set up indexing

Glean advances to the Set up indexing step once SharePoint is connected.

1. Under Set up indexing for SharePoint, select View instructions. Register a single-tenant SharePoint app, grant its application permissions, and grant admin consent. For tenant-wide indexing, add Microsoft Graph Sites.FullControl.All and Files.ReadWrite.All, plus SharePoint Sites.FullControl.All. For site-specific access, use Setup (Selected sites) instead.

2. Generate a certificate and private key, then upload the certificate to the SharePoint app in Azure. See Set up certificate authentication.

3. In Glean, enter the SharePoint app's Application (client) ID and upload the certificate and private key. The tenant ID is inherited from Microsoft 365 and is not entered here.

4. Configure the delegated permissions and redirect URI on the default SharePoint app for native real-time search. Use the URI shown in the setup instructions, which follows this pattern:

   https://<your-company-be.glean.com>/instance/o365/oauth/verify_code

   See Set up real-time access for SharePoint. This configuration is separate from tools authorization.

5. Enter your SharePoint domain, for example company.sharepoint.com.

6. Select Continue.

Don't register extra apps for crawl speed. If additional apps are already configured, keep them in place and maintain their permissions and credentials. Native real-time delegated permissions and the redirect URI belong on the default app, not the additional apps.

Two different URLs

If you set up a custom application for tools, Glean shows two similar-looking URLs during setup, and they serve different purposes. The path ending in /tools/oauth/verify_code is the callback URL of the read and write tools authorization flow. The path ending in /instance/o365/oauth/verify_code is the redirect URI for native real-time search on the default SharePoint app. Add each one where Glean asks for it, and do not substitute one for the other.

If Glean shows an inherited-credentials message instead of editable credential fields, keep using the parent app and update its credentials on the Microsoft 365 parent connector. After you select Continue, Glean advances to the final step.

Step 4: Review setup

Under What to expect, Glean summarizes tools, continuous indexing, and how it uses your data. Under Manage test groups, you can limit the connector to a test group before opening it to everyone.

Before starting indexing, configure any crawl restrictions under Data access (optional) and click Save. For Sites.Selected, inclusion rules are required despite the optional label. Enter the site URLs and resolve validation errors before proceeding. See Provide the list of all sites to be crawled.

Select Begin indexing to finish and start the crawl.

The first crawl runs in the background, and search results appear progressively as sites finish indexing.

Manage tools

Tools require no separate enablement step. Connecting SharePoint makes them available, and you configure them on the Tools tab of the SharePoint connector page in the Admin console. Tools appear on that tab once Glean has finished syncing them from SharePoint, and new tools are enabled by default as Glean adds them.

Glean groups the tools into read tools and write tools, and shows how many of each are available.

Read tools

Read tools only retrieve. Every call runs as the person asking, scoped to their own SharePoint permissions, so a read tool cannot surface content that person could not already open in SharePoint. Examples include the following:

Tool	What it does
Get SharePoint site page content	Returns the content of a SharePoint site page
List SharePoint folder contents	Lists the items in a SharePoint folder
Get SharePoint item by sharing URL	Resolves a SharePoint sharing link to the item it points at

Write tools

Write tools change SharePoint content or permissions. They also run as the person asking, so a write tool can never do something that person could not do themselves. Examples include the following:

Tool	What it does
Move SharePoint item	Moves a file or folder to a different location
Update SharePoint file content	Replaces the contents of an existing file
Share SharePoint item with user	Grants another user access to a file or folder

Several SharePoint tools are still in beta, and availability varies by deployment. For the current inventory and each tool's status, see Microsoft 365 tools.

Tool settings you can change afterwards

• Which tools are on. Turn individual read and write tools on or off. Leave write tools off until you are ready for Glean to act on SharePoint content on a user's behalf.
• Where the tools appear. Select Advanced settings to enable tools per surface, across Chat and Agents. Changes there apply immediately.
• Who can invoke them. Set department access per surface, so that only the teams that need SharePoint tools get them.

For the full guide, see Tools overview.

Real-time search

Real-time search is part of this setup rather than something you add later. Glean fetches content live from SharePoint at query time and stores nothing in the index, which keeps results current for content that changes constantly, and covers content that has not been crawled yet.

Real-time search runs as the person asking, so each user authorizes their own SharePoint account once before they see real-time results. Until they do, Glean answers their SharePoint questions from indexed content only. Users can authorize in either of two ways:

• Proactively: A user goes to Your Settings → Connectors and selects SharePoint.
• On demand: Glean prompts the user to authenticate when a query includes a link to a document that Glean has not indexed yet.

For the delegated permissions involved and how Glean handles live requests, see Real-time access.

Optional configuration

Choose site-limited app access and crawl restrictions before starting indexing. Coordinate changes to an existing app's permissions with your Glean Deployment Engineer.

• Selected sites: Limits the app to explicitly granted sites. This requires site-limited application permissions, per-site grants, and inclusion rules, not just a change to the crawl scope.
• Crawling restrictions: Controls which content Glean crawls using inclusion rules, exclusion rules, and draft exclusions. You can update these rules after setup.

Permissions and security

Glean reads all user access permissions from SharePoint and enforces them for every query, so users only see results they can already open in SharePoint.

Two different permission types are involved, and they cover different capabilities:

Permission type	What it covers	How it is granted
Application permissions in Microsoft Entra ID	File and site indexing on the SharePoint app. Identity syncing uses the separate Microsoft 365 parent app.	By a Global Administrator granting admin consent during setup
Delegated permissions in Microsoft Entra ID	Native real-time search on the default SharePoint app. Tools use their central or custom OAuth app.	Admin consent where required, followed by each user's authorization

These indexing setup instructions use certificate-based authentication. Azure Access Control Services (ACS) authentication for SharePoint Online stopped working on April 2, 2026. See Azure ACS retirement in Microsoft 365.

For the full picture, see permission enforcement, the permission design, and the API endpoints the connector calls.

After setup

• Watch the first crawl. Coverage builds up over hours rather than minutes. Search for content you know is in SharePoint to confirm results are appearing and that permissions look right.
• Check what is being crawled. Confirm that the crawling restrictions you configured before starting indexing match the sites you intend to include.
• Look up any errors. If setup or crawling reports a problem, see error codes for what each one means and how to resolve it.

See also

• Choose your setup: How this setup differs from the previous one, and which applies to your deployment.
• SharePoint overview: What the SharePoint connector indexes and how it fits into the Microsoft 365 suite.
• Set up the indexing connector: Indexing configuration in detail, including what Glean crawls and which permissions each capability needs.
• Microsoft 365 connector: The parent connector that provides identity crawling and the tenant ID.
• Microsoft 365 tools setup: Authentication options for Microsoft 365 tools, including how to register a custom OAuth application.