Skip to main content
The SharePoint connector indexes the sites of your Microsoft 365 tenant through Microsoft Graph, and it can mirror who may read each item with Auto Sync Permissions. Use the OneDrive connector to discover users and index their personal drives. The connector signs in as an application set up in Microsoft 365 Setup.

​
What gets indexed

You can configure Onyx to index your entire tenant or a specific list of sites. From each site, Onyx indexes:
  • Files in document libraries, including any images inside them.
  • Pages published on the site (.aspx).
Onyx files each document under the site, library, and folder it came from, so you can browse or filter at any level. After the first run, each refresh picks up only what changed.

​
What is not indexed

  • SharePoint lists, their items, and their attachments
  • Personal OneDrive sites, unless you explicitly list /personal/ URLs in Sites. Use the dedicated OneDrive connector for new setups.
  • Files with an unsupported extension, and files over the size limit
Onyx indexes files with the following extensions:The legacy Office formats .doc, .xls, and .ppt are not supported. Convert older files in SharePoint if you need them indexed.Onyx also skips the image formats .bmp, .tiff, .gif, .svg, and .avif.

​
Before you begin

You need a Microsoft 365 tenant with SharePoint Online and the roles listed in Microsoft 365 Setup. Complete Microsoft 365 Setup with the SharePoint rows of its permission table. Indexing needs only Sites.Read.All, and a client secret is enough for it. The rest are for permission sync, which needs a certificate credential.

​
Configure the connector in Onyx

1

Select or create an authentication account

In Onyx, go to Admin Panel → Connectors and select SharePoint. Under Authentication Account, pick a saved account, or select Create New and enter the details from your Entra app registration, as described in Microsoft 365 Setup. Select Create, confirm the new account is selected, and continue.
2

Name the connector and choose sites

Give the connector a descriptive Display Name.In Sites, add one entry per site you want indexed, such as https://contoso.sharepoint.com/sites/support. Leave the list empty to index every site in the tenant. The advanced settings hold the content, exclusion, and national cloud settings described in Connector settings.
3

Choose the document access

Under Document Access, Everyone in Your Organization shows every indexed document to all Onyx users. Specific Groups limits them to selected Onyx user groups.Sync with SharePoint mirrors SharePoint’s own permissions and needs a certificate account. See Permission sync. Specific Groups and Sync with SharePoint are paid features: the Business and Enterprise tiers on Onyx Cloud, and the Enterprise Edition when self-hosted.
4

Set an indexing start date

Under Schedule, set Index Documents After unless you need every file, whatever its age. Without one, the first indexing attempt reads every file and page in every listed site, and a tenant with millions of files takes days to become searchable. With a start date, Onyx indexes the files and pages created or last modified on or after it and skips the rest. See Advanced Configuration.
5

Create and verify

Select Create Connector. Onyx checks the credential and your site URLs when you save, so most permission problems appear here rather than during indexing.Then open Admin Panel → Indexing Status, select the connector, and confirm the first indexing attempt finishes with roughly the document count you expect.

​
Connector settings

​
Scoping to sites, libraries, and folders

An entry in Sites can name a site, a library within it, or a folder within that library. Onyx reads the path after the site name as a library, and anything after that as a folder: Team sites (/teams/…) and personal OneDrive sites (/personal/…) work the same way.
Naming a library in the URL works only on English, German, and Spanish tenants, because Onyx has to match the library’s display name (Shared Documents, Freigegebene Dokumente, Documentos compartidos) against the name SharePoint reports. On a tenant in any other language, enter the bare site URL instead. A site-level entry finds every library, whatever its name. Contact the Onyx team if you need another language mapped.

​
Limiting the app to specific sites

With Sites.Selected instead of Sites.Read.All, the app reads only the sites you grant it, and Sites cannot be empty. Grant read for indexing and fullcontrol for permission sync. See Limiting the app to specific sites.

​
OneDrive

Use the dedicated OneDrive connector for new setups. It discovers users, follows each drive’s changes, and supports OneDrive permission sync.
Existing SharePoint connectors that list personal-site URLs continue to work. You do not need to migrate them unless you want the dedicated connector’s user discovery and drive-level refreshes.

​
Permission sync

With permission sync on, each document keeps its SharePoint access. An Onyx user finds a document in search only if they can open it in SharePoint.
Permission sync is a paid feature: the Business and Enterprise tiers on Onyx Cloud, and the Enterprise Edition when self-hosted. It also requires a certificate credential.
Onyx runs two syncs on their own schedules, separate from indexing: The group sync starts as soon as the connector exists, and the document sync runs once the first index finishes, so permissions are in place before anything becomes searchable. A user’s access comes from their own account and from the groups they belong to, both SharePoint site groups and Entra ID security groups, including nested ones. Set SHAREPOINT_PERMISSION_DOC_SYNC_FREQUENCY and SHAREPOINT_PERMISSION_GROUP_SYNC_FREQUENCY (seconds) to change the intervals on a self-hosted deployment. What each Graph grant is for: GroupMember.Read.All works out who is in a group, nested groups included. Group.Read.All tells security groups apart from Microsoft 365 groups. Directory.Read.All reads how users and groups relate to each other. User.Read.All matches the people in your directory to their Onyx accounts. Member.Read.Hidden reads the membership of groups whose members are hidden in Entra ID. Onyx treats items shared by link as private unless you turn on Treat Sharing Links as Public. It ignores users and groups that hold only SharePoint’s Limited Access role, because that role lets someone pass through a folder rather than open what is inside it.

​
Limits

​
Troubleshooting

See Microsoft 365 Setup for credential, consent and certificate problems every Microsoft 365 connector can show.
The app is missing Sites.FullControl.All, admin consent was never granted, or a site under Sites.Selected was not given full control. Add the permission under SharePoint, not Microsoft Graph.
Add Microsoft Graph → GroupMember.Read.All as an application permission, then grant admin consent again.
An entry in Sites is not a full https:// URL containing /sites/, /teams/, or /personal/.
An entry in Sites points at a different tenant than the credential belongs to. One connector covers one tenant. A OneDrive URL on the tenant’s -my host is accepted.
Index Documents and Index ASPX Sites are both off. Turn at least one back on.
Authority Host and Graph API Host describe different clouds. Match them, and the domain suffix, to one row of National clouds.
Discovering sites tenant-wide needs Sites.Read.All. Under Sites.Selected, list your sites explicitly.
Under Sites.Selected, check that each site was granted to the app. Consent alone grants nothing. See Limiting the app to specific sites.
Onyx skips sites it cannot read, and sites that are locked or archived, so the rest of the tenant still indexes. Check the connector’s error list for the affected URLs.
Personal sites are indexed only when listed in Sites. Add the personal site URL. Under Sites.Selected, grant the app a role on that personal site as well.
Library names resolve only on English, German, and Spanish tenants. Use the bare site URL instead. See Scoping to sites, libraries, and folders.
The page’s layout is corrupted, so SharePoint does not return its contents. Onyx keeps the page rather than dropping it. Opening the page in SharePoint and re-saving it normally repairs this.
Onyx skips files over 20 MB. See Limits.
The credential uses a client secret, or the deployment is not on a paid tier.