Skip to Content
DocumentationIntegrationsSharePoint / OneDrive

SharePoint / OneDrive

Erato provides support for Microsoft SharePoint and OneDrive  integration, allowing users to attach files from their Microsoft cloud storage directly to chats.

Overview

When enabled, users can:

  • Browse their OneDrive and SharePoint drives
  • Search drive/site names and filenames across accessible libraries
  • Keep selected files while changing searches or browsing other folders
  • Attach files from SharePoint/OneDrive to chats
  • Use SharePoint files with assistants
  • Reference SharePoint files in messages for AI processing

The integration uses the Microsoft Graph API to access files. Users must authenticate with an identity provider that provides a valid Microsoft access token with the appropriate permissions.

Prerequisites

Before enabling the SharePoint integration, ensure:

  1. OIDC Provider: Your SSO/OIDC provider (e.g., Microsoft Entra ID / Azure AD) is configured to issue access tokens with Microsoft Graph API permissions
  2. Token Forwarding: Your authentication proxy (e.g., oauth2-proxy) forwards the access token to the backend via the X-Forwarded-Access-Token header
  3. Graph API Permissions: Cross-drive filename search (enabled by default) requires delegated Files.Read.All or Sites.Read.All permission for Microsoft Graph. For deployments with only Files.Read, set file_search_enabled = false to retain drive/site search and browsing. Individual discovery sources may require additional permissions.

Configuration

To enable the SharePoint/OneDrive integration, add the following to your configuration:

erato.toml
[integrations.sharepoint]
enabled = true

Configuration Options

OptionTypeDefaultDescription
enabledbooleanfalseWhether the SharePoint integration is enabled
file_search_enabledbooleantrueEnable cross-drive filename search; false restores drive/site-only search
file_upload_enabledbooleantrueWhether file linking from SharePoint is enabled
auth_via_access_tokenbooleantrueUse the user’s forwarded access token for MS Graph API (currently required)
show_disclaimerbooleanfalseShow a disclaimer about unexpectedly visible SharePoint/OneDrive directories in the picker
all_drives_sourcesstring[][]Optional subset of Graph discovery surfaces for /all-drives; empty means all

Full Example

erato.toml
[integrations.sharepoint]
enabled = true
file_upload_enabled = true
file_search_enabled = true
auth_via_access_token = true
show_disclaimer = true
all_drives_sources = ["me_drive", "me_drives", "shared_with_me", "shared_drive_details"]

Drive Discovery Sources

all_drives_sources controls which Microsoft Graph discovery surfaces Erato uses when listing accessible drives. Supported values are:

  • me_drive
  • me_drives
  • joined_teams
  • group_drives
  • site_search
  • site_drives
  • shared_with_me
  • shared_drive_details

If you do not set all_drives_sources, Erato queries the full set of sources to preserve the existing behavior. This can be useful for tenants where some discovery paths return very large numbers of drives or where only a subset of drive types should appear in browsing and drive-name search. This setting does not restrict the cross-drive filename search scope; Microsoft Graph applies the signed-in user’s access permissions.

With integrations.sharepoint.file_search_enabled = true (the default), the picker searches filenames across all indexed SharePoint and OneDrive files the signed-in user can access, including public libraries. It uses Microsoft Search  (POST /v1.0/search/query) with a filename restriction, one request per result page instead of one search per drive. Drive/site-name search runs independently using all_drives_sources; it is not a prerequisite for finding files.

File results show their library, site, and folder path when metadata is available. Only libraries/sites represented in the bounded result set are looked up for display metadata. A failed metadata lookup does not prevent selecting the file. Selections persist across searches and navigation.

Search uses the signed-in user’s delegated Microsoft Graph access token; it does not grant additional access. Only filename matches are displayed. Microsoft’s indexed phrase/prefix matching does not guarantee arbitrary filename substring matches, and recently changed files may not appear immediately.

Search displays up to 100 files and reads at most ten global result pages. Graph work is bounded to 20 seconds overall, with shorter budgets for file queries and optional drive-name discovery. Successful file pages survive subsequent failures, and incomplete discovery does not block file results. The picker indicates when search limits are reached.

To disable filename search and restore the original drive/site-only search:

[integrations.sharepoint]
enabled = true
file_search_enabled = false

This changes the picker field back to “Search drives…”, uses the existing /all-drives?query=... endpoint, and disables /integrations/sharepoint/search on the backend. Browsing and attaching files remain available. This is also the compatibility option for deployments without the Microsoft Search permissions listed above.

Authentication Flow

  1. User authenticates via your OIDC provider (e.g., Microsoft Entra ID)
  2. The OIDC provider issues an access token with MS Graph permissions
  3. oauth2-proxy (or similar) forwards the token via X-Forwarded-Access-Token header
  4. Erato backend uses this token to call the Microsoft Graph API on behalf of the user

Limitations

  • Token-based auth only: Currently requires the user’s access token to be forwarded; service account authentication is not yet supported
  • Read-only: Files are referenced by ID; Erato does not upload files to SharePoint
Last updated on
PrometheusMicrosoft Teams bot