Note: File syncing with Scytale is per-file - the files are synced individually.

There are 3 options to grant access to files on SharePoint:

All sites in account
Single site
Specific folder in a single site

How to Connect Scytale and Microsoft SharePoint

1. In Scytale, go to 'Integrations'.

2. Search for Microsoft SharePoint and select 'Connect'.

3. Fill in the following details:

Application ID
Application client secret Value
Directory ID (tenant)

Add a connection name and then select 'Connect'.

You have now successfully connected to Microsoft SharePoint.

Step 1: How to Register an Application in Azure Active Directory - Create Application and Directory ID

Log in to the Azure portal and then navigate to Microsoft Entra ID.
On the left menu, click on App registrations
On the screen that loads, click on New registration and fill in the following details:
- Name - you can choose a name, for example: scytale-sharepoint-integration
- Supported account types - select the option - "Accounts in this organizational directory only (Default Directory only - Single tenant)".
- Click on Register

Next, navigate to the app registrations page.
On the app registrations page, search and open scytale-sharepoint-integration (the application you just created in the previous step).
On the left menu, select "Overview".
Under "Essentials", copy to the connection form the following:
(A) - Application (Client) ID and (B) - Directory (tenant) ID

Step 2: How to Create a New Client Secret for the App

Ensure you are still within the "scytale-sharepoint-integration" created in step 1.
Go to "Certificates & secrets"
Click on New client secret
- Description - you can choose a description, for example: scytale-sharepoint-key
- Expires - we recommend selecting 24 months, as we cannot collect data after the key expires.
- Click on Add
Copy the secret - (C) - "Value" to the connection form.

Step 3: How to Add Permissions

Go to App registrations.
Go to the app that you created in step 1, ex: scytale-sharepoint-integration.
Go to "API permissions"
Click on Add a permission
Under "Request API permissions",
In the Microsoft API's tab, select "Microsoft Graph" and then select "application permissions".
Add the following permission:
- Files.Read.All
- Sites.Read.All

Click on Add permissions
Select "Grant admin consent for Default Directory".

Permissions Options for Microsoft SharePoint Integration

Create an application in Azure Active Directory.

Option A: Grant Full Read Access to All Sites

Note: While admin permissions are requested during setup, we will only access the specific files you choose to sync by sharing their URLs. This ensures your data stays secure and fully under your control.

Add the to API permissions the following permission:
Sites.Read.All
Files.Read.All
these are from Microsoft Graph (Application permissions).

Grant admin consent for the permission.

This will allow the app to read files across all SharePoint sites.

Option B: Grant Read Access to Specific Sites

To restrict access to selected SharePoint sites, follow these steps:

Add the Sites.Selected permission from Microsoft Graph (Application permissions).
Grant admin consent for the permission.
Assigning site permissions to the scytale-sharepoint-integration application

Go to the Graph Explorer and log in with an Azure admin account.

Create a new POST request:

Endpoint URL: https://graph.microsoft.com/v1.0/sites/{site-id}/permissions (replace site-id with the SharePoint site-id)

Identify the SharePoint site ID from the following pattern of your SharePoint hostname.

Copy /_api/site/id and paste it into the page URL.

Copy the id value from the URL and save it. You will need this later on.

Add the following request body (payload), replacing app-id and app-name with your created application values:

{  
"roles": ["read"],
"grantedToIdentities": [{
    "application": {
    "id": "app-id",    <--- Replace with your application id
    "displayName": "app-name" <--- Replace with your application name
 }
 }]
}

Open the Modify Permissions tab and click Open the permissions panel.

Grant consent to Sites.FullControl.All - this is needed for Graph Explorer to execute the request.

After granting consent, run the query successfully.

You have successfully granted Read permissions to your selected Site to the Application.

Option C: Grant Read Access to Specific Folders

This is the strictest model: the app can read only the folder(s) you grant — for example, a single "Company Policies" folder — and nothing else in the tenant.

All four steps below are done in Graph Explorer — a Microsoft web tool where you paste a request URL and click Run query. No coding needed.

Before you start:

Open Graph Explorer and sign in (profile icon, top right) with a SharePoint Administrator account.
One-time setup (same as Option B): click the gear icon → Select permissions, search for Sites.FullControl.All, and click Consent.
Each step below produces an ID that you copy and paste into the next step — keep a notepad handy.

C1. Find the site ID

In Graph Explorer, create the following request:

Make sure the method dropdown (to the left of the address bar) says GET.
Paste this into the address bar:

GET <https://graph.microsoft.com/v1.0/sites/{tenant}.sharepoint.com:/sites/{SiteName}>

Replace {tenant} with your organization's SharePoint name — the first part of your SharePoint URL. For example, if your SharePoint lives at contoso.sharepoint.com, the tenant is contoso.
Replace {SiteName} with the name of the site that contains your folder, exactly as it appears in the site's URL (e.g. ComplianceDocs).
Click Run query.
In the response at the bottom, find the line starting with "id": and copy the value in quotes — a long composite like contoso.sharepoint.com,a1b2...,c3d4.... This is your Site ID; you'll use it in step C2.

C2. Find the document library's drive ID

Still in Graph Explorer, with the method set to GET:

Paste this into the address bar:

GET <https://graph.microsoft.com/v1.0/sites/{siteId}/drives>

Replace {siteId} with the Site ID you copied in step C1.
Click Run query.
The response lists the site's document libraries. Find the one that contains your folder — usually the entry with "name": "Documents" — and copy its "id" value (a long code starting with b!). This is your Drive ID; you'll use it in steps C3 and C4.

C3. Find the folder's item ID

Now look up the folder itself, with the method still set to GET:

Paste this into the address bar:

GET <https://graph.microsoft.com/v1.0/drives/{driveId}/root:/{FolderName}>

Replace {driveId} with the Drive ID from step C2.
Replace {FolderName} with the name of your folder, exactly as it appears in SharePoint. If the name contains spaces, replace each space with %20. For example, for a folder called "Company Policies":

GET <https://graph.microsoft.com/v1.0/drives/{driveId}/root:/Company%20Policies>

If the folder sits inside another folder, include the full path — e.g. root:/Compliance/Company%20Policies.

Click Run query.
In the response, find the "id": line and copy its value. This is your Folder item ID; you'll use it in step C4.

C4. Grant the app read access to the folder

POST https://graph.microsoft.com/v1.0/drives/{driveId}/items/{folderItemId}/permissions
Content-Type: application/json

{
 "roles": ["read"],
 "grantedToIdentities": [{
     "application": {
       "id": "<Application (client) ID>",
       "displayName": "Scytale SharePoint App"
     }
   }]
}

How to send it:

Change the method dropdown from GET to POST.
Paste the URL into the address bar, replacing {driveId} with the Drive ID from step C2 and {folderItemId} with the Folder item ID from step C3.
Open the Request body tab (below the address bar) and paste the JSON body shown above.
In the body, replace <Application (client) ID> with the Application (client) ID you saved in Step 1 — from the app registration's Overview page, not the Object ID.
Click Run query.
A 201 Created response confirms the grant. Note the returned permission id if you want to revoke this specific grant later.

Repeat steps C3–C4 for each additional folder you want Scytale to read.

We recommend granting access to folders rather than to individual files. Per-file grants prevent folder syncs from working, and each item-level grant breaks SharePoint permission inheritance on that item (which counts against SharePoint's unique-permission limits).

Microsoft SharePoint - User Guide