> ## Documentation Index > Fetch the complete documentation index at: https://cogno.studio/docs/llms.txt > Use this file to discover all available pages before exploring further. # Connect SharePoint to Cogno > Let Cogno find, read, save and update shared files in the sites your Projects select. ![SharePoint shared files](https://mintcdn.com/genaxis/SBpH_n58NKMVlbl7/images/integrations/sharepoint.svg?fit=max\&auto=format\&n=SBpH_n58NKMVlbl7\&q=85\&s=dc37c4d00f8b5594841170fcbb54a5d8) ## At a glance | | | | - | - | | **Direction** | Two-way: read shared files and save or replace finished files. | | **Connect with** | Cogno's shared Microsoft application, with credentials managed by Nango. | | **Who can set up** | A Workspace member with permission to manage integrations, with a Microsoft administrator. | | **You'll need** | A Microsoft Global Administrator or Privileged Role Administrator and an approved SharePoint site. | Cogno uses your team's shared documents while doing work in a [Project](https://cogno.studio/docs/projects.md), and saves finished files back to SharePoint. Each Project explicitly selects its sites. Members do not connect their personal Microsoft accounts to read those sites. One Workspace connection can serve multiple sites. Cogno provides one shared multitenant Microsoft application. Your organization does not create an application or issue a client secret. Nango stores the application's credentials and renews access tokens. Cogno uses that connection to call Microsoft Graph for file operations. > [!WARNING] > > This is organization-shared access. Each person's SharePoint permissions are not inherited. Only connect an entire site that may be shared with the participants of every Project that selects it. Keep its contents within those Projects. ## Before you start * Ask your Microsoft Global Administrator or Privileged Role Administrator to sign in during connection setup and approve Cogno's shared application. This setup verifies their administrator identity; individual members do not sign in for everyday file access. * Grant Cogno's application `write` access to each approved site separately. The application uses Microsoft Graph's `Sites.Selected` **application** permission. Admin consent alone does not grant site access. **Add site** does not change Microsoft-side permissions. Follow Microsoft's [selected permissions guide](https://learn.microsoft.com/en-us/graph/permissions-selected-overview). * Prepare the HTTPS site URL, such as `https://contoso.sharepoint.com/sites/Shared`. Use a site URL, not a file sharing link. ## Connect SharePoint in Cogno **1. Approve Cogno's shared application** Open **Integrations → SharePoint** and select **Connect**. Sign in to Microsoft with your organization's Global Administrator or Privileged Role Administrator account, then approve the requested application permissions. Cogno creates the Nango connection on the server. You do not enter application credentials. A Teams connection is not required. **2. Connect the approved site** Enter the **SharePoint site URL**. Select **I confirm this entire site may be shared with participants of the Projects that select it.**, then select **Add site**. Cogno checks live access to the site's document libraries. This read check does not prove the application has write access. Add more approved sites through the same connection. **3. Select the site for a Project** Open the Project's integration settings and select the connected SharePoint site. A Project with no selected sites has no SharePoint access. Review the Project's participants before selecting a site. **4. Review agent permissions** Under **Agent tools**, review **Read SharePoint** and **Write to SharePoint**. Reading is allowed by default; saving and updating require approval by default. Changes apply to the next run. Project settings can further restrict access. ## Find and read files Ask Cogno to list a site's document libraries, browse a folder or find a file by name. Search matches file names, not document contents, and scans at most 20 provider pages. Cogno reports when that scan is incomplete. Shortcuts to other locations are excluded. Cogno reads text and PDF files up to 5 MiB and returns at most 20,000 characters, with truncation indicated. Other formats return file metadata and a link, not extracted contents. Use the returned SharePoint link as the source when answering questions. If the file changes during a read, read it again. ## Save and update finished files Ask Cogno to save a file produced on the current Task or run. Review the destination, file name and content before approving. Saved files inherit their destination's sharing. | Operation | Behavior | | - | - | | Save a new file | Uses the selected document library and folder. An existing file name is refused. | | Update a file | Reads the current version first and supplies that version when replacing the file. A version conflict stops the update. | | Supported size | From 1 byte to 50 MiB. Empty files are refused. | | Word and Excel | Save a completed document or workbook, or replace the whole file. This integration does not edit paragraphs, cells or worksheets directly. | | Unknown outcome | Cogno does not automatically resend a write whose result Microsoft did not confirm. Check SharePoint before requesting another write. | File deletion, sharing-permission changes, SharePoint Lists, site pages and background crawling are not included. Disconnecting SharePoint stops access to all its registered sites. Revoking Microsoft's site permission stops new access to that site. These changes do not erase answers or files already shared. ## Common states | State or symptom | Meaning | Next action | | - | - | - | | **No sites connected yet.** | No site has been added to the Workspace's SharePoint connection. | Add an approved site. | | The administrator permission error appears | Microsoft has refused access. | Check admin consent and the application grant on that exact site. Read access alone does not permit writing. | | The Project cannot see a connected site | The site is not selected for the Project, or its tools are blocked. | Review the Project's site selection and agent permissions. | | A file is missing from search | Search matches names and has a scan limit. | Browse the relevant document library or folder and narrow the file name. | | Only metadata is returned | The format is not supported for extraction or the file exceeds 5 MiB. | Open the SharePoint link to read the original. | | A name or version conflict is reported | The destination name exists or the target version changed. | Choose a new file name, or read the current file and review the update again. | | The write result is unknown | The write may already exist in SharePoint. | Check the destination; do not repeatedly request the same save. | ## Deployment administrator setup Cogno's deployment administrator configures this once per deployment, not once per customer Workspace. * Register the shared application in Cogno's Microsoft tenant for accounts in multiple organizational tenants. Add Microsoft Graph's `Sites.Selected` application permission. * Register the HTTPS Web redirect URI formed from `COGNO_API_URL` plus `/api/v1/sharepoint/callback`. * Set the application manifest's `groupMembershipClaims` to `DirectoryRole`. Setup checks the signed ID token's `wids` claim for Global Administrator or Privileged Role Administrator; missing role claims stop connection setup. * Configure `SHAREPOINT_CLIENT_ID` and `SHAREPOINT_CLIENT_SECRET` in the server's secret-backed configuration. Keep the secret out of browsers, Tasks and Project instructions. * Configure the self-hosted Nango integration `sharepoint-online-oauth2-cc` with scope `https://graph.microsoft.com/.default`, and the server's Nango URL and secret key. Cogno sends the common credentials to Nango server-side for each verified organization. * When rotating the shared client secret, update every existing Nango connection that stores it as well as the server configuration. Updating only the integration configuration does not replace credentials already saved in connections. ## Reference URLs * [Nango: SharePoint client-credentials connection](https://nango.dev/docs/integrations/all/sharepoint-online-oauth2-cc) * [Microsoft: Selected permissions](https://learn.microsoft.com/en-us/graph/permissions-selected-overview) * [Microsoft: Upload sessions and conflict handling](https://learn.microsoft.com/en-us/graph/api/driveitem-createuploadsession?view=graph-rest-1.0) * [Microsoft: Replace file contents](https://learn.microsoft.com/en-us/graph/api/driveitem-put-content?view=graph-rest-1.0) * [Microsoft: File search permission limits](https://learn.microsoft.com/en-us/graph/api/driveitem-search?view=graph-rest-1.0) ## Related docs * [Integrations](https://cogno.studio/docs/integrations.md) * [Projects](https://cogno.studio/docs/projects.md) * [Troubleshooting](https://cogno.studio/docs/troubleshooting.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.