SharePoint
Connect SharePoint to search your sites, read and update lists, work with document libraries, and draft and publish pages.
You register an app in the Microsoft Entra admin center, copy its Application (client) ID and a client secret Value into PopMCP, then sign in with your work or school Microsoft account and approve access to SharePoint. In most organizations an administrator approves it once.
App review before this connector works
Microsoft reviews nothing: an app you register in the Microsoft Entra admin center can sign in straight away. Your organization is the gate. SharePoint needs Sites.Read.All or Sites.ReadWrite.All, and since 2025 Microsoft's default consent settings make an administrator approve those once.
- Typical wait
- None if you are an administrator or your organization lets people approve these permissions. Otherwise, until a Microsoft 365 administrator approves the app once.
- Cost
- Free. Registering an app and the calls PopMCP makes as you cost nothing. It needs a work or school account on Microsoft 365 with a license that includes SharePoint; personal Microsoft accounts have no SharePoint.
- Blocked until approved
- Everything until it is approved: Microsoft stops the sign-in with Need admin approval. Nothing narrower reaches SharePoint sites, so there is no smaller set to start with.
- Works meanwhile
- Register the app, add PopMCP's Redirect URI and the permissions, create the client secret, and send the app's API permissions page to your administrator. Everything is ready to connect the moment it is approved.
Where to apply: No application. An administrator of your organization (Global Administrator, Privileged Role Administrator or Cloud Application Administrator) opens the app in the Microsoft Entra admin center (Entra ID, App registrations, your app, API permissions) and selects Grant admin consent. Or the administrator connects SharePoint in PopMCP once and checks Consent on behalf of your organization, or approves your request under Enterprise apps, Admin consent requests when your organization uses that workflow.
- Microsoft's permissions list says Sites.Read.All needs no admin consent, but the organization's consent settings decide, and Microsoft's default stops people approving it themselves. Do not trust the Admin consent required column alone.
- Microsoft's consent is all or nothing: one ticked option that needs an administrator stops the whole sign-in until it is approved. Term store, Site administration and Organization settings always need one.
- The connection acts as the signed-in person: approval lets the app ask, and SharePoint's own permissions still decide what each person can open.
- Copy the client secret's Value, not its Secret ID. The Value is shown only once, right after you create the secret.
- Client secrets expire (24 months at most). When yours expires the connection stops: create a new secret and reconnect with it.
- Add the Redirect URI under Authentication as a Web platform, not as a Single-page application or Mobile and desktop one. An app registered as Single tenant only also needs its Directory (tenant) ID in the connect form.
- Setup time
- 10 min
- Auth
- OAuth authorization
- API base URL
- https://graph.microsoft.com/v1.0
- Rate limits
- SharePoint allows about 3,000 requests per 5 minutes per person, and each app gets a share of its organization's limit (from 1,250 resource units a minute for small organizations; a list or a write costs 2, a single read 1, a permission call 5). All of Microsoft Graph allows 130,000 requests per 10 seconds per app. A 429 says how long to wait in Retry-After.
Before you begin
- A work or school account on Microsoft 365 with a license that includes SharePoint. Personal Microsoft accounts have no SharePoint.
- A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off, and the Application Developer role always can).
- PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback
- In most organizations, an administrator who can approve the app once: a Global Administrator, Privileged Role Administrator or Cloud Application Administrator. SharePoint needs Sites.Read.All or Sites.ReadWrite.All, and since 2025 Microsoft's default consent settings stop people approving those for themselves.
Get your credentials
Open App registrations
Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration.
App registrations
| Display name | Application (client) ID | Created on | Certificates & secrets |
|---|---|---|---|
| Marketing siteSingle tenant only | 4c5d****-****-****-****-****8e21 | 3/14/2026 | Current |
Owned applications lists the apps you registered yourself.
Register the app
Enter a Name people will recognize, such as PopMCP: Microsoft shows it when asking for access. Under Supported account types pick Any Entra ID Tenant, then select Register. Single tenant only works too for your organization's own accounts, but then the app's Directory (tenant) ID goes into PopMCP as well.
Register an application
The user-facing display name for this application.
Add PopMCP's Redirect URI
On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter https://app.popmcp.com/api/providers/microsoft/callback exactly as PopMCP shows it, and select Configure.
PopMCP | Authentication
Choose Web, not Single-page application or Mobile and desktop: the address must match character for character.
Create a client secret
Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as PopMCP, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret.
PopMCP | Certificates & secrets
| Description | Expires | Value | Secret ID |
|---|---|---|---|
| PopMCP | 4/24/2027 | Kq8~****************************3fZaCopy this one | 7d1e****-****-****-****-****0b9c |
Copy the Application (client) ID
Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only.
PopMCP
Overview
- Display name
- PopMCP
- Application (client) ID
- 2f6c****-****-****-****-****a91d
- Directory (tenant) ID
- 72f9****-****-****-****-****1db4
- Client credentials
- 0 certificate, 1 secret
- Redirect URIs
- 1 web, 0 spa, 0 public client
The Application (client) ID is a GUID. A value with a tilde in it is a client secret.
Add the permissions and approve them
Open API permissions and select Add a permission, then Microsoft Graph, then Delegated permissions. Tick Sites.ReadWrite.All, Sites.Manage.All, User.Read and offline_access, then select Add permissions. If you are an administrator, select Grant admin consent for your organization. If you are not, send this page to one: it is the step that lets people in your organization connect.
PopMCP | API permissions
| API / Permissions name | Type | Admin consent required | Status |
|---|---|---|---|
| Sites.ReadWrite.All | Delegated | No | Granted for ContosoAfter Grant admin consent |
| Sites.Manage.All | Delegated | No | Granted for ContosoAfter Grant admin consent |
| User.Read | Delegated | No | Granted for Contoso |
| offline_access | Delegated | No | Granted for Contoso |
Paste both into PopMCP and sign in
In PopMCP put the ID in Application (client) ID and the secret's Value in Client secret Value (the Directory (tenant) ID under More options only for a Single tenant only app). Under More options you can also tick Term store, Site administration or Organization settings; each needs an administrator. Select Sign in with Microsoft, pick your work or school account and select Accept. If Microsoft says Need admin approval, an administrator has to do the previous step first.
Connect in PopMCP
Open your workspace, choose SharePoint in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Application (client) IDtext | Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Any Entra ID Tenant under Supported account types and select Register, then copy the Application (client) ID from Overview. |
| Client secret Valuesecret | In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server.Encrypted with AES-256-GCM on save and never shown again. |
| Directory (tenant) IDtext | Only for an app registered as Single tenant only. Copy it from the app's Overview page. |
| Extra accesschecklist | — |
https://app.popmcp.com/api/providers/microsoft/callbackIn your app registration open Authentication, select Add Redirect URI, choose Web, enter this exact URL and select Configure. It must match exactly, or Microsoft refuses the sign-in. Every Microsoft connector uses this same URL.
PopMCP verifies the credential against SharePoint immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions to request
PopMCP asks SharePoint for exactly the permissions you tick in the connect form. Unticked permissions leave their tools listed but failing, so keep the defaults unless you have a reason to narrow them.
SharePoint grants exactly what you tick. 0 of 3 are on by default.
term_storeTerm storeRead managed metadata: term groups, sets and terms (and change them, if write actions are on). An administrator approves this once.full_controlSite administrationSee and grant which apps can reach a site, and publish content types from the hub. An administrator approves this once.tenant_settingsOrganization settingsRead the organization's SharePoint settings (and change them, if write actions are on). For SharePoint administrators.
Verify it worked
PopMCP shows SharePoint as Connected under the account's address, and sharepoint_search_sites lists the sites you can open.
Troubleshooting
"The app's redirect URI does not match"
Why: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character.
Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again.
"Microsoft did not accept the app's client secret"
Why: The **Secret ID** was pasted instead of the secret's **Value** (AADSTS7000215), or the Value was cut short when copying.
Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and paste it into PopMCP.
"The app's client secret has expired"
Why: Client secrets last at most 24 months (AADSTS7000222).
Fix: Create a new client secret under **Certificates & secrets** and reconnect SharePoint with its Value.
"This app does not accept the kind of Microsoft account you signed in with"
Why: You signed in with a personal Microsoft account. SharePoint needs a work or school one.
Fix: Sign in with your Microsoft 365 work or school account, and register the app with **Any Entra ID Tenant**.
"Your app is registered for one organization only"
Why: A Single tenant only app was used without its tenant (AADSTS50194).
Fix: Copy the **Directory (tenant) ID** from the app's **Overview**, enter it under **More options** in PopMCP and connect again.
"Need admin approval" on Microsoft's page, or "Your organization needs an administrator to approve this app"
Why: Since 2025 Microsoft's default consent settings stop people approving an app that asks for Sites.Read.All or Sites.ReadWrite.All (AADSTS65001 or AADSTS90094). Nothing narrower reaches SharePoint sites.
Fix: An admin opens the app in the Microsoft Entra admin center, **API permissions**, and selects **Grant admin consent** for the organization. Then connect again.
"This organization has no SharePoint Online that this account can reach"
Why: The account has no license that includes SharePoint, or the organization does not use SharePoint Online.
Fix: Ask your Microsoft 365 admin for a license that includes SharePoint, then connect again.
"This needs TermStore.Read.All (Term store), which this connection was not given"
Why: The term store, site administration and organization settings are optional and were not ticked when connecting.
Fix: Reconnect SharePoint with the box the message names ticked under **More options**, and have an administrator approve it.
403 on a site or list even though the connection is fine
Why: The connection acts as you: your own rights in SharePoint are the limit, whatever the connection allows.
Fix: Ask the site's owner for access. Open the same link in a browser to check.
A filter or a new row says a column name is wrong
Why: Rows use a column's internal name, which can differ from what the page shows: Due Date is often DueDate or field_3.
Fix: sharepoint_describe_list gives every column's internal name.
429 with a Retry-After header
Why: SharePoint allows about 3,000 requests per 5 minutes per person, and each app has a share of its organization's limit.
Fix: Wait the time Microsoft gives and try again. sharepoint_search and the fields option do in one call what would otherwise take many.