SharePoint setup

The Intric SharePoint integration uses Microsoft Graph with the Sites.Selected permission scope for access to SharePoint data. This means:

• Zero access by default: without explicit configuration, the app has no permissions to any SharePoint sites or their content
• Site-level control: an Entra tenant admin chooses exactly which sites the app can access. The app cannot see or interact with any other sites
• Delegated permissions: the app acts on behalf of the signed-in user. Even within a granted site, the user can only access files and folders they already have permission to view in SharePoint
• Search enabled: once a site is granted, users can search across files within that site

All configuration is done through Microsoft Graph Explorer (https://developer.microsoft.com/graph/graph-explorer) or equivalent tooling. You must be an admin in your Entra tenant to complete these steps.

Step 1: Find your site(s)

Prerequisite: You need Sites.Read.All consented in Graph Explorer for this step.

Search for sites using a keyword:

GET https://graph.microsoft.com/v1.0/sites?search=marketing

Example response:

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites",
  "value": [
    {
      "id": "example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740",
      "displayName": "Marketing Site",
      "name": "marketing",
      "webUrl": "https://example.sharepoint.com/sites/marketing",
      "createdDateTime": "2023-01-15T10:30:00Z"
    }
  ]
}

From the response, note the id field of the site you want to grant access to. In this example, the site ID is:

example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740

You can use ?search=* to list all sites.

Step 2: Grant the Intric app access to the site

Prerequisite: You need Sites.FullControl.All consented in Graph Explorer for this step.

The Intric SharePoint app has the following configuration:

Field	Value
Application ID	a1162fb9-a25e-4bd3-9c55-e7a46a085536
Display name	Intric

Using the site ID from Step 1:

POST https://graph.microsoft.com/v1.0/sites/example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740/permissions
Content-Type: application/json

{
  "roles": ["read"],
  "grantedToIdentities": [{
    "application": {
      "id": "a1162fb9-a25e-4bd3-9c55-e7a46a085536",
      "displayName": "Intric"
    }
  }]
}

Use "roles": ["read"] for read-only or "roles": ["write"] for read and write. Currently all tools in the SharePoint integration in Intric are read-only.

Repeat for each site you want to grant access to.

Step 3: Configure in Intric

Once you’ve granted the Intric app access to your SharePoint site(s) in Microsoft Graph, add those sites to Intric:

1. Navigate to Admin in the main menu
2. Go to Integrations in the admin panel
3. Find and select SharePoint from the list of available integrations
4. Click Add site or Configure
5. Enter the Site ID of the site you granted access to in Step 2 (the same value as the id from Step 1)

Site ID format:

• Use the full site identifier string from Microsoft Graph—the id field—not the site URL from the browser
• Example: example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740
• This matches the id in the Graph API response in Step 1 and the site you used in Step 2

Repeat this process for each site you want to make available in Intric.

Once configured, the integration will automatically discover the drives (document libraries), folders, and files within the granted site(s). Users who connect their Microsoft accounts will be able to access these sites in conversations with assistants that have the SharePoint integration enabled.

Revoking access

To remove the app’s access to a site, first list the permissions:

GET https://graph.microsoft.com/v1.0/sites/{siteId}/permissions

Find the permission entry for the Intric app, then delete it:

DELETE https://graph.microsoft.com/v1.0/sites/{siteId}/permissions/{permissionId}

The app will immediately lose access to that site and all its contents.