About SharePoint Connector Permissions

​

Overview

Glean leverages both the Microsoft Graph API and the SharePoint REST API to fetch content from your company’s SharePoint instance.

• → More information: SharePoint & OneDrive API Endpoints

Both the Microsoft Graph API and the SharePoint REST API have separate permission sets that need to be managed independently. For each API, this document will cover:

• Each permission that Glean requests, why it is required, and how it is used.
• Typical objections encountered when requesting the specified permission.
• Alternatives for permissions that are not permitted as part of your organization’s Standard Operating Procedure (SOP).

​

Graph API Permissions

​

Overview

Glean adheres to the principles of least privilege and only requests the minimum permission scopes required to read data from the Graph API. The following permission scopes are required when integrating with SharePoint:

All permissions must be granted as Application permissions. Delegated permissions cannot be used.

• → More information: Application vs Delegated Permissions

​

Permissions Explained

​

SharePoint REST API Permissions

​

Overview

Glean adheres to the principles of least privilege and only requests the minimum permission scopes required to read data from the Graph API. The following permission scopes are required when integrating with SharePoint:

​

Permissions Explained

There are four (4) SharePoint REST API endpoints that Glean leverages:

• Get site groups
• Get site list items
• Get site item permissions
• Get page content

The minimum permission to be able to read data from these endpoints is Sites.FullControl.All. At no point is data ever written by Glean’s crawlers using the API.

Should Microsoft adjust the minimum API scope required to read from these endpoints, Glean will follow suit and adjust our guidance on requiring Sites.FullControl.All

​

Constraining Access & Scope

To constrain the scope of data that the SharePoint crawler has access to (and the actions it can subsequently perform via the Graph and SharePoint REST APIs), there are multiple methods of control that can be leveraged.

These can be divided into two categories:

• Controls configured on the Glean side.
• Controls configured on the Microsoft side.

​

Crawling Restrictions

For SharePoint and OneDrive, Glean can constrain the SharePoint crawler in your deployment to only target specific Sites or User drives as defined by you. Conversely, specific Sites or User drives can also be excluded from crawling.

This involves providing Glean with:

• The SharePoint Site URL(s) to explicitly include (or exclude) when crawling; and/or
• The Azure AD/Entra ID Group ID containing the users to explicitly include (or exclude) when crawling; and/or
• The usernames of the users to explicitly include (or exclude) when crawling.

For more information, refer to Supported Crawling Restrictions for SharePoint.

​

IP Restrictions (Conditional Access)

Using Entra ID Conditional Access, you can restrict usage of the App Registration (and associated secret) created for the Glean SharePoint crawler to only be permitted from the IP range of your Glean tenant.

This involves:

• Adding the static IP address of NAT gateway used by the crawlers in your Glean tenant as a location within Entra ID.
• Adding a new Conditional Access policy targeting specific source workload identities corresponding to the Service Principal(s) created for the Glean SharePoint crawler.
• Excluding the location created in step 1 from the Conditional Access policy.
• Setting the policy to block as an action.

For more information, refer to Permission & Security Controls for SharePoint - IP Restrictions.

​

Monitoring Audit Logs

Microsoft Purview can be used to monitor the Glean SharePoint crawler and alert on any attempts to misuse granted permissions to write data back to SharePoint.

For more information, refer to Permission & Security Controls for SharePoint - Monitoring via Purview.

​

Sites.Selected

The Sites.Selected permission can be used to provide the required Graph & SharePoint REST API permissions at a site-level instead of at a global-level. Use of Sites.Selected has significant trade-offs however, including:

• Severely degrading the search result quality for SharePoint.
• Limiting Glean’s ability to synchronize content updates (including permissions) to only once every 24 hours.
• Requiring your company to manually authorize every site AND sub-site that you want to be available in Glean (Sites.Selected does not allow for automatic site and sub-site discovery)

Glean does not recommend this approach.

For more information, refer to:

• Permission & Security Controls for SharePoint - Sites.Selected (Graph API).
• Permission & Security Controls for SharePoint - Sites.Selected (SharePoint REST API).