Skip to main content
A client secret is a password Microsoft generates for your Entra application. It is the quickest way to get the SharePoint connector indexing, and the right choice when every indexed document can share one access level in Onyx. A client secret cannot be used for permission sync: SharePoint will not release its permission data to an application that signed in with a secret, whatever permissions you grant it. If you need Onyx to mirror who can see what in SharePoint, set up certificate authentication instead.

​
Register the application

1

Open App registrations

Sign in to the Microsoft Entra admin center or the Azure portal and go to App registrations.
2

Create the registration

Select New registration. Name it something recognizable, such as Onyx SharePoint Connector. Leave the supported account types and redirect URI at their defaults. Select Register.
3

Record the two IDs

On the application’s Overview page, copy the Application (client) ID and the Directory (tenant) ID.

​
Create the client secret

1

Open Certificates & secrets

In your app registration, go to Certificates & secrets → Client secrets.
2

Add a secret

Select New client secret, give it a description, and choose an expiry. Microsoft allows up to 24 months. Select Add.
3

Copy the value immediately

Copy the Value column, not the Secret ID. The value is shown only while you stay on this page. Once you navigate away you cannot get it back, and you have to create a new secret.

​
Grant permissions

1

Add the Microsoft Graph permission

Go to API permissions → Add a permission → Microsoft Graph → Application permissions, and add Sites.Read.All. This lets the application read your sites, document libraries, files, and pages.
2

Consider narrowing the scope

Sites.Read.All lets the app read every site in your tenant, even if the connector indexes only one. If that is too broad, add Sites.Selected instead and authorize the app one site at a time. The connector’s Sites configuration can no longer be left empty in Onyx.See Limiting the app to specific sites for the procedure.
3

Grant admin consent

Select Grant admin consent for <your organization> and confirm. The permission should then show Granted. Until you do this, it does not take effect.This step needs the Global Administrator or Privileged Role Administrator role. No other role can consent to Microsoft Graph application permissions, so if the button is unavailable or consent fails, ask someone with one of those roles to do it.
A new registration already lists a delegated User.Read permission. The connector never uses it. Leave it or remove it, as you prefer.

​
Add the credential to Onyx

1

Open the SharePoint connector

In Onyx, go to Admin Panel → Add Connector and select SharePoint.
2

Create a client secret credential

Select Create New, then the Client Secret tab, and enter:
  • Application (client) ID, from the app registration Overview page
  • Directory (tenant) ID, from the same page
  • Client Secret: the secret Value you copied
3

Save and continue

Select Create, confirm the new credential is selected, and continue to the connector settings described in Configure the connector in Onyx.

​
Rotating the secret

Indexing stops when the secret expires. To rotate without downtime:
1

Create a second secret

In Certificates & secrets, add a new client secret and copy its value. Entra holds more than one at a time, and both work until the old one expires.
2

Update the credential in Onyx

In Admin Panel → Existing Connectors, open the connector’s credential and replace the secret value.
3

Delete the old secret

Once an indexing attempt has succeeded, delete the previous secret in Entra.

​
Troubleshooting

The secret is wrong or expired. Check that you copied the secret Value rather than the Secret ID, and that it has not passed its expiry date.
Permission sync is on, and it cannot work with a client secret. Rebuild the credential with a certificate.
Indexing your whole tenant needs Sites.Read.All. Under Sites.Selected, list your sites explicitly.
Under Sites.Selected, each site must also be granted to the app. Consent alone grants nothing.
Admin consent was never given, or was given before you added the last permission. Select Grant admin consent again.
The secret expired. See Rotating the secret.
For problems with sites, scoping, file types, and content, see Troubleshooting on the overview page.