> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/sharepoint-server.md).

# Microsoft SharePoint Server

Configuring the Veza integration for SharePoint Server (on-premises).

### Overview

Veza can discover and analyze permissions in SharePoint Server environments that are configured with Microsoft Entra ID (formerly Azure AD) federated authentication. This offers visibility into your on-premises SharePoint infrastructure using an existing [Azure Integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/azure.md), including:

* Site collections and sub-sites discovery
* Document libraries and folders
* Effective permission analysis
* Microsoft Entra ID user and group federation
* Optional site filtering with allow and deny lists

### Prerequisites

* SharePoint Server 2013 or newer
* The SharePoint environment must be configured for federated authentication with Microsoft Entra ID following Microsoft's [official documentation](https://learn.microsoft.com/en-us/entra/identity/saas-apps/sharepoint-on-premises-tutorial)
* The Azure integration in Veza must be configured with a valid SSL certificate for SharePoint site discovery (Signed certificate recommended for production environments)

### Configuring the Azure Integration for SharePoint Server

You can connect to SharePoint by providing a certificate for app-only access when configuring an Azure integration. For testing environments, you can generate a self-signed certificate following the [Microsoft documentation](https://docs.microsoft.com/sharepoint/dev/solution-guidance/security-apponly-azuread).

The integration requires read-only API permissions to discover SharePoint resources:

1. Go to the Integrations page and add or edit an Azure integration, following the instructions in [Microsoft Azure](/4yItIzMvkpAvMVFAamTf/integrations/integrations/azure.md).
2. In Azure, create or edit the app registration for the integration with the additional API scopes:
   * SharePoint:
     * `User.Read.All`
     * `Sites.Read.All`
   * Microsoft Graph API:
     * `Directory.Read.All`
     * `Files.Read.All`
     * `Sites.Read.All`
     * `Reports.Read.All`
3. Enable SharePoint discovery by providing a certificate for app-only access and granting optional API permissions as documented in [Microsoft SharePoint Online](/4yItIzMvkpAvMVFAamTf/integrations/integrations/sharepoint.md).
4. If you are limiting the services discovered by the integration, ensure that SharePoint is enabled under **Limited Services** in the integration configuration.
5. (Optional) In the **Limit Services** > **SharePoint** section, add SharePoint site URLs to the allow or deny lists to limit extraction of specific sites. The integration will detect all on-premesis SharePoint sites included in the `/sites/getAllSites` Microsoft Graph API response.
6. Save your changes to the integration configuration after supplying the X.509 certificate and password, if encrypted.
7. When discovery completes, perform a Graph search for relationships between Azure AD Users and SharePoint Sites to validate that on-premises sites are appearing as expected.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/sharepoint-server.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.