Microsoft 365/SharePoint Online integration

Overview

The Microsoft 365 integration lets people link and embed OneDrive and SharePoint Online files in intranet pages, and find them in ThoughtFarmer search. It can also show Outlook shared, group and resource calendars.

Setup has two parts. First you register an app in Microsoft Entra ID, which gives ThoughtFarmer permission to read files on behalf of each signed-in user. Then you turn on the integration in ThoughtFarmer and connect it to that app.

This article covers the standard Microsoft 365 integration. The AI Assistant Microsoft 365 integration is set up differently.

Already set up for files and only adding calendars? Add the calendar permissions in Step 2, turn on calendars in Step 5, then log in again in Step 6.

Before you start

You need:

• A ThoughtFarmer site that uses https://.
• A Microsoft account with the Global Administrator or Application Administrator role.
• Admin access to ThoughtFarmer.
• A licensed Microsoft 365 user account to test with, one that can open SharePoint and OneDrive.

Find your SharePoint address before you start:

1. Open SharePoint in your browser.
2. Look at the address bar. Your SharePoint address is the part up to .sharepoint.com, for example https://contoso.sharepoint.com.

This address is set when your Microsoft 365 account is created. It may not match your email domain. For example, people who sign in as name@yourcompany.com might use https://yourcompanyltd.sharepoint.com.

Tip: Keep a text file open while you work. You'll copy four values from Microsoft and paste them into ThoughtFarmer: the tenant ID, the client ID, the client secret and the SharePoint address.

Step 1: Register the app in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center with your admin account.
2. Open App registrations (type it in the search bar at the top if you don't see it in the menu), then click New registration.
3. Fill in the form:
   • Name: something people will recognize, for example ThoughtFarmer Intranet.
   • Supported account types: Accounts in this organizational directory only (Single tenant).
   • Redirect URI: choose Web, then enter your intranet address followed by /entra/token/exchange. For example: https://intranet.yourcompany.com/entra/token/exchange
     
     
4. Click Register.
5. On the app's Overview page, copy these two values into your text file:
   • Application (client) ID
   • Directory (tenant) ID

Redirect URI must match exactly. Use the same address people type to open the intranet, starting with https:// and with no / at the end.

Your domain might look different here. One Microsoft 365 account can have several domains. For example, Entra's Overview page may show yourcompany.com while you sign in as name@yourcompanyltd.onmicrosoft.com. That's normal. To see all your domains, go to Domain names in Entra.

Step 2: Add permissions

All permissions in this step are Delegated permissions. Don't choose Application permissions: they appear in a different list and won't work.

Microsoft Graph permissions

1. In your app, go to API permissions and click + Add a permission.
2. Click Microsoft Graph, then Delegated permissions.
3. Search for and check each permission you need:

4. Click Add permissions.

SharePoint permission (optional)

Add this if your organization uses SharePoint Online, not only OneDrive. It's easy to miss because it's under SharePoint, not Microsoft Graph.

1. Click + Add a permission again.
2. On the Microsoft APIs tab, scroll past the large Microsoft Graph tile and click the smaller SharePoint tile.
3. Click Delegated permissions.
4. Expand the Sites group and check Sites.Search.All ("Run search queries as a user").
5. Click Add permissions.

Can't find the SharePoint tile? Click the APIs my organization uses tab, search for Office 365 SharePoint Online, select it, and continue from step 3.

Grant admin consent

1. On the API permissions page, click Grant admin consent for <your organization>, then Yes.
2. Check the Status column. Every permission, under both Microsoft Graph and SharePoint, needs a green check and Granted for <your organization>.

Changed permissions later? People who already logged in keep their old access until they log in again. See Step 6.

Step 3: Turn on tokens

1. In your app, go to Authentication, then the Settings tab.
2. Check both Access tokens (used for implicit flows) and ID tokens (used for implicit and hybrid flows).
3. Click Save.

Step 4: Create a client secret

1. In your app, go to Certificates & secrets, then the Client secrets tab.
2. Click + New client secret.
3. Enter a description, for example ThoughtFarmer SharePoint, and set Expires to 24 months.
4. Click Add.
5. Copy the Value column into your text file right away.
   
   

Copy the Value, not the Secret ID. Both columns look like long codes, but ThoughtFarmer needs the Value. It's hidden as soon as you leave the page. If you missed it, delete the secret and create a new one.

Set a reminder. The integration stops working when the secret expires. Put a reminder in your calendar about two weeks before the expiry date, then create a new secret and paste it into ThoughtFarmer.

Step 5: Set up the integration in ThoughtFarmer

1. Sign in to ThoughtFarmer as an administrator.
2. Go to Admin panel > Integrations > Cloud drives and calendars, then the Microsoft 365 tab.
3. Turn on Microsoft 365 integration.
4. Paste in the values from your text file:

5. Under Cloud drives:

   • Check Enable cloud drives.
   • SharePoint Online URL: your SharePoint address from Before you start, for example https://contoso.sharepoint.com. Enter only the main address, with no /sites/... and no / at the end.
   • Search Microsoft 365: choose OneDrive and SharePoint Online, or OneDrive if you only want OneDrive files.
   • Optional: change how many cloud drive results show in the search drop-down.

   

6. If you're adding calendars, under Calendars:
   • Check Enable Outlook calendars.
   • Optional: turn on Outlook calendars search to include events in search, and change how many show in the drop-down.
7. Click Save at the bottom of the page.

The tenant ID and client ID look alike. Double-check they're in the right fields.

Step 6: Log in and test

The Login button tests the connection. Use a private browser window so you sign in fresh with the right Microsoft account.

1. Open a private window (InPrivate in Edge, Incognito in Chrome).
2. Sign in to ThoughtFarmer and go back to Admin panel > Integrations > Cloud drives and calendars.
3. Click Login.
   
   
4. When Microsoft asks you to sign in, use an account from your organization.

It worked if the pop-up closes and no error appears.

Then check it in a real page:

1. Edit any page and insert a cloud drive file.
2. Browse to a file on a SharePoint site and add it.
3. Search for that file's name in ThoughtFarmer search.

Why a private window? If your browser is already signed in to Microsoft, the pop-up uses that session without asking, even if it's the wrong account. The test then fails with "Check your Client Id", even when the client ID is correct.

Logging in again after a change

After you change permissions in Entra, log in again so ThoughtFarmer gets the new access. If clicking Login says you're already logged in and closes, reset your sign-in:

1. In Entra, go to Enterprise applications and open your ThoughtFarmer app.
2. Click Users and groups and remove your account.
3. Go back to ThoughtFarmer and click Login again.

Step 7: Set up the mobile app

Do this once so cloud drive files also work in the ThoughtFarmer mobile app.

1. In Entra, open your ThoughtFarmer app and go to Authentication.
2. Under Platform configurations, click + Add a platform.
3. Choose Mobile and desktop applications.
4. Under Custom redirect URIs, enter exactly: com.thoughtfarmer.auth://microsoft-auth/
5. Click Configure, then Save.

Troubleshooting

Still stuck? Contact the Helpdesk. Include any AADSTS error code and the time you clicked Login.