Microsoft 365
Microsoft 365
Scan SharePoint sites, OneDrive files, and Teams files via Microsoft Graph API.
- Category
- Collaboration
- Source type
- MICROSOFT_365
- Produces
- fileimagesitedrive
SharePoint, OneDrive and Teams are one filesystem with three front doors, and between them they hold most of the documents an organisation produces. This source reads all three through Microsoft Graph.
What you need to connect
An Entra (Azure AD) app registration: tenant ID, client ID, and one of
| Mode | What you supply |
|---|---|
| Client secret | The app’s secret |
| Certificate | A PEM certificate and its password |
| Managed identity | Nothing — the workload’s own identity is used |
Grant the app read-only application permissions — Sites.Read.All and
Files.Read.All are the usual pair. Permission metadata needs more
(Sites.FullControl.All), which is why it’s a separate switch.
What Classifyre reads
Pick which ecosystems to scan — SharePoint sites, OneDrive, Teams files — then narrow by site, by drive, by folder path, and by file extension.
Every file becomes an asset and is read with the full file pipeline. Optionally also:
- Site and drive assets, so the structure itself is inventoried.
- Sharing permissions on each item — useful when the question is not just what is sensitive but who can see it.
Files in SharePoint, OneDrive and Teams are read with the shared file pipeline: see Supported File Formats for everything it can open, and OCR & Transcription for reading text out of images, audio and video.
Metadata on every asset
Asset kind · file
| Field | Type | Always present | What it is |
|---|---|---|---|
| size_bytes | integer | Yes | Raw byte size of the content |
| mime_type | string | Yes | Resolved MIME type |
| parse_error | string | No | Set when content extraction failed |
| image_width | integer | No | Width in pixels |
| image_height | integer | No | Height in pixels |
| page_count | integer | No | Number of pages (pdf) |
| paragraph_count | integer | No | Number of paragraphs (docx) |
| table_count | integer | No | Number of tables (docx) |
| row_count | integer | No | Number of data rows |
| columns | object[] | No | Columns as {name, type} objects (type may be empty for csv/xlsx) |
| encoding | string | No | Detected character encoding |
| json_root_type | string | No | Root JSON type: object, array, or scalar |
| top_level_keys | integer | No | Number of top-level keys when the root is an object |
| array_length | integer | No | Length when the root is an array |
| site_name | string | No | SharePoint site display name |
| drive_name | string | Yes | Drive display name |
| item_path | string | Yes | Full path within the drive |
| ecosystem | string | Yes | Source ecosystem (sharepoint_sites, onedrive, teams_files) |
| web_url | string | No | Browser-accessible URL for the item |
| etag | string | No | Graph API eTag for the item |
| created_by | string | No | User who created the file |
| modified_by | string | No | User who last modified the file |
| permissions | string[] | No | Sharing permissions on the item: list of {role, grantee_type, grantee} entries (requires include_permissions) |
Asset kind · image
| Field | Type | Always present | What it is |
|---|---|---|---|
| size_bytes | integer | Yes | Raw byte size of the content |
| mime_type | string | Yes | Resolved MIME type |
| parse_error | string | No | Set when content extraction failed |
| source_hash | string | Yes | Hash of the parent file asset |
| location | string | Yes | Location of the embedded image within the parent |
Asset kind · site
| Field | Type | Always present | What it is |
|---|---|---|---|
| site_id | string | Yes | Graph API site ID |
| site_url | string | No | Site URL |
| site_name | string | Yes | Site display name |
| drive_count | integer | No | Number of document libraries |
Asset kind · drive
| Field | Type | Always present | What it is |
|---|---|---|---|
| drive_id | string | Yes | Graph API drive ID |
| drive_name | string | Yes | Drive display name |
| drive_type | string | No | Drive type (documentLibrary, personal, etc.) |
| site_name | string | No | Parent site display name |
| quota_total | integer | No | Total storage quota in bytes |
| quota_used | integer | No | Used storage in bytes |
Lineage
Lineage
This source records no lineage. Nothing in the system it reads describes data moving from one place to another, so no FLOW edges are produced. Related items are still linked — see Lineage & Relationships for what those links mean and how they differ from lineage.
Worth knowing
- Teams files are SharePoint files. Scanning Teams reads each team’s document library — chat messages are not included.
- Graph throttling is handled with backoff and retries; a large tenant is a matter of time, not failure.
- Start with one site collection. A tenant-wide first scan is rarely the quickest way to a useful answer.
Configuration
Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.
Required
Without these, the source will not save.
This section depends on which authentication method you pick — one of the following applies.
Microsoft 365 Client Secret
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "CLIENT_SECRET" | Yes | — | — |
| tenant_id | string | Yes | Azure AD tenant ID (directory ID) | — |
| client_id | string | Yes | Azure AD application (client) ID | — |
Microsoft 365 Certificate
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "CERTIFICATE" | Yes | — | — |
| tenant_id | string | Yes | Azure AD tenant ID (directory ID) | — |
| client_id | string | Yes | Azure AD application (client) ID | — |
Microsoft 365 Managed Identity
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "MANAGED_IDENTITY" | Yes | — | — |
| client_id | string | No | User-assigned managed identity client ID (omit for system-assigned) | — |
Secrets
Stored encrypted and never shown again after you save them. See Configuration & Fields.
This section depends on which authentication method you pick — one of the following applies.
Microsoft 365 Client Secret
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| client_secret | string | Yes | Azure AD application client secret | — |
Microsoft 365 Certificate
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| certificate_pem | string | Yes | PEM-encoded certificate (private key + cert chain) | — |
| certificate_password | string | No | Passphrase for encrypted PEM private key (optional) | — |
Microsoft 365 Managed Identity
Secret fields · Microsoft 365 Managed Identity: none for this source.
Optional
Everything you can tune. Sensible defaults apply when you leave them alone.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| optional | object | No | —no extra properties | — |
| connection | object | No | Network and throttle controls for Graph API requests.no extra properties | — |
| connection.max_retries | integer | No | Maximum retries on transient errors and 429 throttlingmin 0, max 10 | 3 |
| connection.page_size | integer | No | Items per page for Graph API list requestsmin 1, max 999 | 200 |
| connection.rate_limit_delay_seconds | number | No | Base delay between requests when throttled (exponential backoff applied)min 0 | 1 |
| connection.request_timeout_seconds | integer | No | Socket timeout for Graph API operationsmin 5, max 300 | 30 |
| extraction | object | No | Controls which structural assets to emit beyond files.no extra properties | — |
| extraction.include_drive_metadata | boolean | No | Emit drive-level assets with metadata | true |
| extraction.include_permissions | boolean | No | Include file/site permission metadata (requires Sites.FullControl.All) | false |
| extraction.include_site_metadata | boolean | No | Emit site-level assets with metadata | true |
| scope | object | No | Ecosystem selection and content filtering.no extra properties | — |
| scope.drive_filter | array | No | Drive names or IDs to include (empty = all) | — |
| scope.drive_filter[] | string | No | — | — |
| scope.ecosystems | array | No | Microsoft 365 ecosystems to scan (select one or more) | ["sharepoint_sites"] |
| scope.ecosystems[] | enum | No | Microsoft 365 ecosystem to scan Allowed: sharepoint_sites, onedrive, teams_files | — |
| scope.exclude_extensions | array | No | Skip files with these extensions | — |
| scope.exclude_extensions[] | string | No | — | — |
| scope.include_extensions | array | No | Only include files with these extensions (e.g. .pdf, .docx) | — |
| scope.include_extensions[] | string | No | — | — |
| scope.max_object_bytes | integer | No | Skip files larger than this many bytes (default 100 MB)min 0 | 104857600 |
| scope.path_prefix | string | No | Only scan items under this folder path (e.g. /Documents/Legal) | — |
| scope.site_filter | array | No | SharePoint site hostnames or paths to include (empty = all accessible) | — |
| scope.site_filter[] | string | No | — | — |