Microsoft 365 / SharePoint (kind: o365)

Federate a SharePoint document library or OneDrive read-only via Microsoft Graph. OAuth2 (BYOT) - see the shared OAuth onboarding.

What you need from Microsoft

• An Entra ID (Azure AD) app registration with delegated Files.Read.All and offline_access (Graph). A single-tenant app is fine - set options.tenant to your tenant id/domain.
• The drive id of the SharePoint library / OneDrive (Graph GET /drives/…).
• BYOT: client id/secret are yours; refresh token via lw providers auth. Microsoft allows public (PKCE) apps too - then clientSecret is omitted.

Credential shape

The OAuth JSON blob - captured, not typed:

{ "clientId": "…", "clientSecret": "…", "refreshToken": "…" }

lw providers auth acme-o365

instance.json / lw providers add

{
  "id": "acme-o365",
  "kind": "o365",
  "label": "Acme SharePoint",
  "options": { "driveId": "b!aBcD…", "tenant": "acme.onmicrosoft.com", "itemPath": "Brand/Approved" },
  "exposure": { "groups": ["marketing"] }
}

• options.driveId (required); options.tenant (id or domain - common only for multi-tenant apps); options.itemPath scopes to a folder under the drive root.

Verify

lw providers auth acme-o365
lw providers health acme-o365

Notes / limits

• Graph @microsoft.graph.downloadUrl is pre-authenticated + short-lived (expiringUrls) - fetched per request, streamed. API calls and @odata.nextLink pagination cursors are host-pinned to graph.microsoft.com; the download itself follows Graph's short-lived redirect to its storage host.
• Supports the exit (materialize → cutover). Does not accept published exports.

See also: OAuth onboarding · catalog · permissions.