Skip to main content
Both connectors read files through Microsoft Graph and expose them to the agent as a file catalog — Excel, CSV and documents become searchable and readable. They differ in whose files they reach:
  • SharePoint connects to one site and document library that an admin picks. Everyone who can use the connection sees the same library.
  • OneDrive connects to each user’s own drive. There is nothing for an admin to pick, and no shared catalog exists.
The SharePoint and OneDrive connectors are part of the Enterprise Edition.

​
Shared vs per-user catalogs

This is the most important difference between the two, and it changes what you configure. Because OneDrive’s catalog is per user, there is no admin-side file list to index or curate, and no “select which files the agent may use” step. Each user connects their own account and the agent works against that drive. See User context and per-user data.

​
How it works

Bag of words calls Microsoft Graph (https://graph.microsoft.com/v1.0) to resolve the site and drive, walk folders, search, and download file content. .csv, .tsv, .xlsx and .xls are parsed into tables; .pdf, .docx and .pptx are text-extracted; plain-text formats are read as text. For SharePoint, folder_path is the server-side base — the efficient way to scope a connection — and include_globs is the access boundary on top of it. A file outside the globs is denied, not merely hidden, including for drive-wide search results.
Graph requires delegated (per-user) authentication for file reads on most tenants. The service principal reliably enumerates SharePoint sites and drives, but app-only file reads can be refused depending on tenant policy. Plan on per-user sign-in for the read path.

​
Before you start

  • A Microsoft Entra ID app registration in your tenant, with a client secret.
  • A Global Administrator (or Privileged Role Administrator) who can grant admin consent for the Graph permissions.
  • Your Bag of words base URL, for the OAuth redirect URI.
  • For SharePoint: the full site URL, and the name of the document library if it is not the site’s default Documents.

​
Step 1 — Register an Entra ID application

In the Azure Portal → Microsoft Entra ID → App registrations → New registration.
1

Create the app registration

Name it (e.g. Bag of words - Microsoft 365). Under Supported account types, choose Accounts in this organizational directory only unless you specifically need multi-tenant.
2

Copy the Tenant ID and Client ID

From the app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID.
3

Create a client secret

Certificates & secrets → New client secret. Copy the secret value immediately — it is shown once.
4

Add the redirect URI

Under Authentication → Add a platform → Web, add:
Replace <your-bow-host> with your Bag of words base URL.

​
Step 2 — Grant Microsoft Graph permissions

Under API permissions → Add a permission → Microsoft Graph, add the permissions for the connectors you plan to use, then click Grant admin consent for <tenant>. If you also want the shared service principal to enumerate SharePoint without a signed-in user, add the corresponding Application permissions (Sites.Read.All, Files.Read.All) and grant admin consent for those too — the app-only token is issued for https://graph.microsoft.com/.default, so it carries exactly the application permissions the app has been granted.
Without admin consent, sign-in fails or returns a token with no usable Graph scopes. offline_access is required for the refresh token — omit it and users have to re-authenticate whenever the access token expires.

​
Connect in Bag of words

Go to Data Sources → Add data source and pick SharePoint or OneDrive.

​
SharePoint fields

allowed_extensions is deprecated — use include_globs with a pattern like **/*.xlsx instead.

​
OneDrive fields

OneDrive has no config fields. Each user’s own drive is the catalog, so there is nothing to scope on the admin side. You supply the app registration credentials and the connector does the rest. Internally, OneDrive walks recursively by default, since a user’s drive root is almost always folders rather than loose files.

​
Authentication modes

Both connectors offer the same two modes.

​
Entra ID App (Service Principal) — service_principal

Scopes: system and user. This is where the app registration lives. The same credentials back both the app-only token (client credentials) and the per-user sign-in flow.

​
Sign in with Microsoft — oauth

Scope: user only, and it has no fields — each user clicks Connect and completes the Microsoft authorization-code flow against the app registration above. Discovery and reads then run as that user, so people see only what their own account can see. For OneDrive this is the only meaningful path: the drive being read is the signed-in user’s own. For SharePoint it is the recommended read path, because Graph enforces the library’s own permissions per user. See Authentication and access for how to require user sign-in on a connection.

​
Troubleshooting

The app registration must have https://<your-bow-host>/api/connections/oauth/callback registered as a Web platform redirect URI, matching your Bag of words base URL exactly, scheme and trailing path included.
Most tenants require delegated auth for Graph file downloads. Switch the connection to per-user sign-in, or grant the Files.Read.All Application permission with admin consent.
include_globs is the access boundary and is matched relative to folder_path. A path outside the patterns is denied by design. Also check recursive if the file is in a subfolder.
offline_access is missing from the granted delegated permissions, so no refresh token is issued.