Skip to main content
The SharePoint connector indexes the sites of your Microsoft 365 tenant through Microsoft Graph, and it can mirror who may read each item with Auto Sync Permissions. It also indexes OneDrive: a user’s OneDrive is a SharePoint site of its own, listed by URL. See OneDrive. The connector signs in as an application set up in Microsoft 365 Setup. This page lists what SharePoint needs beyond those shared steps.

​
What gets indexed

You can configure Onyx to index your entire tenant or a specific list of sites. From each site, Onyx indexes:
  • Files in document libraries, including any images inside them.
  • Pages published on the site (.aspx).
Onyx files each document under the site, library, and folder it came from, so you can browse or filter at any level. After the first run, each refresh picks up only what changed.

​
What is not indexed

  • SharePoint lists, their items, and their attachments
  • Personal OneDrive sites, unless you explicitly list /personal/ URLs in Sites
  • Files with an unsupported extension, and files over the size limit
Onyx indexes files with the following extensions:The legacy Office formats .doc, .xls, and .ppt are not supported. Convert older files in SharePoint if you need them indexed.Onyx also skips the image formats .bmp, .tiff, .gif, .svg, and .avif.

​
Before you begin

You need a Microsoft 365 tenant with SharePoint Online and the roles listed in Microsoft 365 Setup. Complete Microsoft 365 Setup with the SharePoint rows of its permission table. Indexing needs only Sites.Read.All, and a client secret is enough for it. The rest are for permission sync, which needs a certificate credential.

​
Configure the connector in Onyx

1

Open the SharePoint connector

In Onyx, go to Admin Panel → Add Connector and select SharePoint.
2

Select or create a credential

Pick an existing credential from the list, or select Create New and enter the details from your Entra app registration, as described in Microsoft 365 Setup. Select Create, confirm the new credential is selected, and continue.
3

Name the connector and choose sites

Give the connector a descriptive Connector Name.In Sites, add one entry per site you want indexed, such as https://contoso.sharepoint.com/sites/support. Leave the list empty to index every site in the tenant.
4

Adjust the advanced settings

Select Advanced Options to reach the content, exclusion, and national cloud settings described in Connector settings. By default, Onyx indexes both files and site pages from every site you listed.
5

Choose the access type

Public shows every indexed document to all Onyx users. Private limits them to selected Onyx user groups.Auto Sync Permissions mirrors SharePoint’s own permissions and needs a certificate credential. See Permission sync.See Document Access Controls for what each access type means.
6

Set an indexing start date

Under Advanced Configuration, set an Indexing Start Date unless you need every file, whatever its age. Without one, the first indexing attempt reads every file and page in every listed site, and a tenant with millions of files takes days to become searchable. With a start date, Onyx indexes the files and pages created or last modified on or after it and skips the rest. See Advanced Configuration.
7

Create and verify

Select Create Connector. Onyx checks the credential and your site URLs when you save, so most permission problems appear here rather than during indexing.Then open Admin Panel → Existing Connectors, select the connector, and confirm the first indexing attempt finishes with roughly the document count you expect.

​
Connector settings

​
Scoping to sites, libraries, and folders

An entry in Sites can name a site, a library within it, or a folder within that library. Onyx reads the path after the site name as a library, and anything after that as a folder: Team sites (/teams/…) and personal OneDrive sites (/personal/…) work the same way.
Naming a library in the URL works only on English, German, and Spanish tenants, because Onyx has to match the library’s display name (Shared Documents, Freigegebene Dokumente, Documentos compartidos) against the name SharePoint reports. On a tenant in any other language, enter the bare site URL instead. A site-level entry finds every library, whatever its name. Contact the Onyx team if you need another language mapped.

​
Limiting the app to specific sites

With Sites.Selected instead of Sites.Read.All, the app reads only the sites you grant it, and Sites cannot be empty. Grant read for indexing and fullcontrol for permission sync. See Limiting the app to specific sites.

​
OneDrive

OneDrive is becoming a connector of its own in Onyx. Until it ships, index OneDrive through the SharePoint connector as described here.
A user’s OneDrive is a SharePoint site on your tenant’s -my host, at https://contoso-my.sharepoint.com/personal/jane_contoso_com, where the last part is the user principal name with its dots and @ replaced by underscores. Open the user’s OneDrive in a browser to see the exact URL.
1

List each OneDrive

Add each user’s personal site URL to Sites. An empty Sites list indexes every SharePoint site in the tenant but skips personal sites, so a OneDrive is indexed only when you list it.
2

Grant access

Sites.Read.All covers personal sites. With Sites.Selected, grant the app a role on each personal site the same way as on any other site. See Limiting the app to specific sites.
3

Name a folder if you want one

A personal site’s primary library is called Documents in the browser and OneDrive in Microsoft Graph. Onyx resolves either, so https://contoso-my.sharepoint.com/personal/jane_contoso_com/Documents/Reports indexes that folder. With Auto Sync Permissions, list the bare personal site URL instead: the permission sync matches library names exactly and does not resolve Documents, so a folder entry leaves the site’s documents without access.
Auto Sync Permissions works on personal sites as on any other site: each file is visible to the people SharePoint grants it to, which for most OneDrive files is the owner alone.

​
Permission sync

With permission sync on, each document keeps its SharePoint access. An Onyx user finds a document in search only if they can open it in SharePoint.
Permission sync is a paid feature: the Business and Enterprise tiers on Onyx Cloud, and the Enterprise Edition when self-hosted. It also requires a certificate credential.
Onyx runs two syncs on their own schedules, separate from indexing: The group sync starts as soon as the connector exists, and the document sync runs once the first index finishes, so permissions are in place before anything becomes searchable. A user’s access comes from their own account and from the groups they belong to, both SharePoint site groups and Entra ID security groups, including nested ones. Set SHAREPOINT_PERMISSION_DOC_SYNC_FREQUENCY and SHAREPOINT_PERMISSION_GROUP_SYNC_FREQUENCY (seconds) to change the intervals on a self-hosted deployment. What each Graph grant is for: GroupMember.Read.All works out who is in a group, nested groups included. Group.Read.All tells security groups apart from Microsoft 365 groups. Directory.Read.All reads how users and groups relate to each other. User.Read.All matches the people in your directory to their Onyx accounts. Member.Read.Hidden reads the membership of groups whose members are hidden in Entra ID. Onyx treats items shared by link as private unless you turn on Treat sharing links as public. It ignores users and groups that hold only SharePoint’s Limited Access role, because that role lets someone pass through a folder rather than open what is inside it.

​
Limits

​
Troubleshooting

See Microsoft 365 Setup for credential, consent and certificate problems every Microsoft 365 connector can show.
The app is missing Sites.FullControl.All, admin consent was never granted, or a site under Sites.Selected was not given full control. Add the permission under SharePoint, not Microsoft Graph.
Add Microsoft Graph → GroupMember.Read.All as an application permission, then grant admin consent again.
An entry in Sites is not a full https:// URL containing /sites/, /teams/, or /personal/.
An entry in Sites points at a different tenant than the credential belongs to. One connector covers one tenant. A OneDrive URL on the tenant’s -my host is accepted.
Index Documents and Index ASPX Sites are both off. Turn at least one back on.
Authority Host and Graph API Host describe different clouds. Match them, and the domain suffix, to one row of National clouds.
Discovering sites tenant-wide needs Sites.Read.All. Under Sites.Selected, list your sites explicitly.
Under Sites.Selected, check that each site was granted to the app. Consent alone grants nothing. See Limiting the app to specific sites.
Onyx skips sites it cannot read, and sites that are locked or archived, so the rest of the tenant still indexes. Check the connector’s error list for the affected URLs.
Personal sites are indexed only when listed in Sites. Add the personal site URL. Under Sites.Selected, grant the app a role on that personal site as well.
Library names resolve only on English, German, and Spanish tenants. Use the bare site URL instead. See Scoping to sites, libraries, and folders.
The page’s layout is corrupted, so SharePoint does not return its contents. Onyx keeps the page rather than dropping it. Opening the page in SharePoint and re-saving it normally repairs this.
Onyx skips files over 20 MB. See Limits.
The credential uses a client secret, or the deployment is not on a paid tier.