**Note: Lolly Work**

This guide covers the optional organisation service. Configuration, console and API paths refer to your Work instance. The packaged console keeps its release-matched copy of this guide.

# Microsoft 365 / SharePoint (kind: `o365`)

Federate a SharePoint document library or OneDrive **read-only** via Microsoft Graph. OAuth2
(BYOT) - see the [shared OAuth onboarding](/info/manage/provider-guides.html#kinds-with-a-registered-consent-flow-dropbox-gdrive-o365).

## What you need from Microsoft

- **An Entra ID (Azure AD) app registration** with delegated **`Files.Read.All`** and
  **`offline_access`** (Graph). A single-tenant app is fine - set `options.tenant` to your
  tenant id/domain.
- **The drive id** of the SharePoint library / OneDrive (Graph `GET /drives/…`).
- BYOT: client id/secret are yours; refresh token via `lw providers auth`. Microsoft allows
  public (PKCE) apps too - then `clientSecret` is omitted.

## Credential shape

The OAuth JSON blob - captured, not typed:

```json
{ "clientId": "…", "clientSecret": "…", "refreshToken": "…" }
```

```bash
lw providers auth acme-o365
```

## instance.json / `lw providers add`

```json
{
  "id": "acme-o365",
  "kind": "o365",
  "label": "Acme SharePoint",
  "options": { "driveId": "b!aBcD…", "tenant": "acme.onmicrosoft.com", "itemPath": "Brand/Approved" },
  "exposure": { "groups": ["marketing"] }
}
```

- `options.driveId` (required); `options.tenant` (id or domain - `common` only for
  multi-tenant apps); `options.itemPath` scopes to a folder under the drive root.

## Verify

```bash
lw providers auth acme-o365
lw providers health acme-o365
```

## Notes / limits

- Graph `@microsoft.graph.downloadUrl` is pre-authenticated + short-lived (`expiringUrls`) -
  fetched per request, streamed. API calls and `@odata.nextLink` pagination cursors are
  host-pinned to `graph.microsoft.com`; the download itself follows Graph's short-lived
  redirect to its storage host.
- Supports the **exit** (materialize → cutover). Does **not** accept published exports.

See also: [OAuth onboarding](/info/manage/provider-guides.html#kinds-with-a-registered-consent-flow-dropbox-gdrive-o365) · [catalog](/info/manage/catalog.html) · [permissions](/info/manage/permissions.html).

---

Content ([MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/)) · [Lolly Work source](https://github.com/lolly-tools/lolly-work/tree/7f2be8cb52df5b53b539009ec62e2f151ed72d18) · [lolly.tools](https://lolly.tools)