---
updatedAt: 2026-07-31T02:37:46.000Z
agentTools:
  projectIndex: https://docs.conveyor.com/llms.txt
---

# SharePoint App Registration & Certificate Setup

## Overview

Bring your SharePoint documents into Conveyor AI. Before Conveyor can sync documents from your SharePoint site, your organization needs to register a dedicated Azure AD application, secure it with a certificate, and hand a few non-secret identifiers plus the certificate to your Conveyor Administrator.

This app is registered in **your own** Azure AD tenant and is owned by your organization. 

## Prerequisites 

**For IT / Microsoft 365 (Azure AD) Administrators:**

* Access to your organization's Azure AD (Microsoft Entra) admin center
* Permissions to register applications and grant admin consent for API permissions
* Ability to generate or obtain an X.509 certificate and upload the public certificate to the app registration

**For Conveyor Administrators:**

* Access to a Conveyor Admin account
* Ability to configure integrations in Conveyor
* Coordination with IT to receive the tenant ID, client ID, site ID, certificate, and private key

**Time to complete:**

* Azure AD Administrator tasks: \~15 minutes
* Conveyor Administrator tasks: \~5 minutes

> **Important:** If a different team manages your Azure AD environment, loop them in early. The app registration and permission grant require admin rights that a typical Conveyor Administrator won't have.

## Microsoft 365 Administrator Steps

### Step 1: Register a new app in Azure AD

1. **Open the Azure Portal** and navigate to **Microsoft Entra ID** (Azure AD) → **App registrations**.
2. **Click "New registration"**.
   * **Name:** something recognizable, e.g. `Conveyor SharePoint Integration`
   * **Supported account types:** select **"Accounts in this organizational directory only"** (single tenant). This app is scoped to your organization only. It is not a shared, multi-tenant app.
   * **Redirect URI:** leave blank. This integration doesn't use interactive sign-in.
3. **Click "Register"**.
4. **Note down the Application (client) ID and Directory (tenant) ID** shown on the app's Overview page — you'll need both later.

### Step 2: Add the Sites.Selected permission

1. **Open your new app registration** and go to **API permissions**.
2. **Click "Add a permission"** → select **Microsoft Graph** → select **Application permissions** (not delegated).
3. **Search for and select **`Sites.Selected`, then click **"Add permissions"**.
   * This permission grants no access by itself. It only allows the app to be granted access to individual sites later, one at a time.
4. **Click "Grant admin consent for \[your organization]"** and confirm.
   * This step requires admin rights. Admin consent is required because `Sites.Selected` is an application-level (not user-delegated) permission.

### Step 3: Generate and upload a certificate

1. **Generate an X.509 certificate**, or use one already issued by your organization's PKI. If you need to generate one, your IT team likely has a preferred process; a self-signed certificate is also acceptable for this purpose (it's used only to prove possession of the private key, not for public trust).
2. **In the app registration, go to Certificates & secrets → Certificates tab**.
3. **Click "Upload certificate"** and upload the **public** certificate file (`.cer` or `.crt`).
4. **Note the certificate's thumbprint** shown after upload, for your own records.

### Step 4: Hand off to your Conveyor Administrator

Securely share the following with your Conveyor Administrator:

* **Tenant ID** (Directory ID)
* **Client ID** (Application ID)
* The **certificate (PEM format)** and its matching **private key (PEM format)**

Use an encrypted channel or your organization's standard secrets-sharing process — treat the private key like any other credential.

## Conveyor Administrator Steps

### Step 5: Configure the SharePoint integration in Conveyor

1. **Log into your Conveyor Admin account** and navigate to **Organization Settings → Integrations**.
2. **Click "Add Integration"** and select **SharePoint**.
3. **Fill in the integration form:**
   * **Tenant ID**: the Directory (tenant) ID from Step 1
   * **Client ID**: the Application (client) ID from Step 1
   * **Site ID**: the identifier for the SharePoint site you plan to sync. Enter the site's URL (e.g. `https://yourtenant.sharepoint.com/sites/YourSite`); your Conveyor Administrator or Azure AD Administrator can confirm the exact format your instance expects.
   * **Certificate**: paste the certificate provided by your Azure AD Administrator
   * **Private Key**: paste the matching private key
4. **Save the integration.** Conveyor stores these credentials encrypted; the private key is never displayed again after saving.

At this point the integration exists in Conveyor, but it won't be able to read anything yet — the app still needs to be granted access to your site.

## Next Steps

Continue to [Granting Site Access to Your SharePoint Integration](https://docs.conveyor.com/docs/granting-site-access-to-your-sharepoint-integration) to authorize the app to read your specific SharePoint site.

<br />