SharePoint App Registration & Certificate Setup

Overview

Bring your SharePoint documents into Conveyor AI. Before Conveyor can sync documents from your SharePoint site, your organization needs to register a dedicated Azure AD application, secure it with a certificate, and hand a few non-secret identifiers plus the certificate to your Conveyor Administrator.

This app is registered in your own Azure AD tenant and is owned by your organization.

Prerequisites

For IT / Microsoft 365 (Azure AD) Administrators:

• Access to your organization's Azure AD (Microsoft Entra) admin center
• Permissions to register applications and grant admin consent for API permissions
• Ability to generate or obtain an X.509 certificate and upload the public certificate to the app registration

For Conveyor Administrators:

• Access to a Conveyor Admin account
• Ability to configure integrations in Conveyor
• Coordination with IT to receive the tenant ID, client ID, site ID, certificate, and private key

Time to complete:

• Azure AD Administrator tasks: ~15 minutes
• Conveyor Administrator tasks: ~5 minutes

Important: If a different team manages your Azure AD environment, loop them in early. The app registration and permission grant require admin rights that a typical Conveyor Administrator won't have.

Microsoft 365 Administrator Steps

Step 1: Register a new app in Azure AD

1. Open the Azure Portal and navigate to Microsoft Entra ID (Azure AD) → App registrations.
2. Click "New registration".
   • Name: something recognizable, e.g. Conveyor SharePoint Integration
   • Supported account types: select "Accounts in this organizational directory only" (single tenant). This app is scoped to your organization only. It is not a shared, multi-tenant app.
   • Redirect URI: leave blank. This integration doesn't use interactive sign-in.
3. Click "Register".
4. Note down the Application (client) ID and Directory (tenant) ID shown on the app's Overview page — you'll need both later.

Step 2: Add the Sites.Selected permission

1. Open your new app registration and go to API permissions.
2. Click "Add a permission" → select Microsoft Graph → select Application permissions (not delegated).
3. Search for and select Sites.Selected, then click "Add permissions".
   • This permission grants no access by itself. It only allows the app to be granted access to individual sites later, one at a time.
4. Click "Grant admin consent for [your organization]" and confirm.
   • This step requires admin rights. Admin consent is required because Sites.Selected is an application-level (not user-delegated) permission.

Step 3: Generate and upload a certificate

1. Generate an X.509 certificate, or use one already issued by your organization's PKI. If you need to generate one, your IT team likely has a preferred process; a self-signed certificate is also acceptable for this purpose (it's used only to prove possession of the private key, not for public trust).
2. In the app registration, go to Certificates & secrets → Certificates tab.
3. Click "Upload certificate" and upload the public certificate file (.cer or .crt).
4. Note the certificate's thumbprint shown after upload, for your own records.

Step 4: Hand off to your Conveyor Administrator

Securely share the following with your Conveyor Administrator:

• Tenant ID (Directory ID)
• Client ID (Application ID)
• The certificate (PEM format) and its matching private key (PEM format)

Use an encrypted channel or your organization's standard secrets-sharing process — treat the private key like any other credential.

Conveyor Administrator Steps

Step 5: Configure the SharePoint integration in Conveyor

1. Log into your Conveyor Admin account and navigate to Organization Settings → Integrations.
2. Click "Add Integration" and select SharePoint.
3. Fill in the integration form:
   • Tenant ID: the Directory (tenant) ID from Step 1
   • Client ID: the Application (client) ID from Step 1
   • Site ID: the identifier for the SharePoint site you plan to sync. Enter the site's URL (e.g. https://yourtenant.sharepoint.com/sites/YourSite); your Conveyor Administrator or Azure AD Administrator can confirm the exact format your instance expects.
   • Certificate: paste the certificate provided by your Azure AD Administrator
   • Private Key: paste the matching private key
4. Save the integration. Conveyor stores these credentials encrypted; the private key is never displayed again after saving.

At this point the integration exists in Conveyor, but it won't be able to read anything yet — the app still needs to be granted access to your site.

Next Steps

Continue to Granting Site Access to Your SharePoint Integration to authorize the app to read your specific SharePoint site.