Connect SharePoint: consent and library grant

Before you start

• Your plan includes external sources. Otherwise Kyros shows a plan hint instead of the “SharePoint” tile.
• SharePoint Online (Microsoft 365). SharePoint Server in your own data centre isn’t supported, nor are personal OneDrive folders.
• A separate document library with content that may be public only. The chatbot may repeat anything in this library publicly. The whole library is always synced.
• Two roles in your tenant: a Global Administrator for the one-time consent (step 1) and a SharePoint administrator for the library grant (step 2).
• PDF, DOCX, TXT, Markdown and CSV up to 20 MB per file are taken over; scanned PDFs only on plans with text recognition. Other files (e.g. Excel, PowerPoint, pages) are skipped and listed.

What the app may do

The Kyros app requests only the application permission Lists.SelectedOperations.Selected. It gives no access until a specific list or library is granted explicitly. Kyros requests neither Sites.Read.All nor Files.Read.All. We store your tenant ID and the library’s IDs, but no password and no token of your tenant.

1. Give consent (Global Administrator)

1. In Kyros, open the knowledge base, click “SharePoint” under “Add content” and confirm that the library holds public content only.
2. Click “Connect Microsoft 365”. Microsoft’s sign-in page opens; the Global Administrator signs in there – this can happen in the same browser, together with the person setting up Kyros.
3. Microsoft shows the app’s name, its publisher and the permission. Click “Accept”.
4. Microsoft sends you back to Kyros; the wizard now asks for the library.

After consent the app is listed in your Microsoft Entra admin center under “Enterprise applications”, together with its Application ID ({app-id}), which you need in step 2.

2. Grant the library (SharePoint administrator)

You grant access with Microsoft Graph, for example in Graph Explorer or with PowerShell, using the delegated permission Sites.ReadWrite.All. First look up the IDs of the site and the library (example: tenant example, site Office):

GET https://graph.microsoft.com/v1.0/sites/example.sharepoint.com:/sites/Office
→ "id": "{site-id}"

GET https://graph.microsoft.com/v1.0/sites/{site-id}/lists?$select=id,displayName,webUrl
→ "id": "{list-id}" (the library)

Then give the app the role read on this one library:

POST https://graph.microsoft.com/v1.0/sites/{site-id}/lists/{list-id}/permissions
Content-Type: application/json

{
  "roles": ["read"],
  "grantedToV2": {
    "application": {
      "id": "{app-id}",
      "displayName": "Kyros Wissensdatenbank-Connector"
    }
  }
}

The same with the Microsoft Graph PowerShell SDK:

Connect-MgGraph -Scopes "Sites.ReadWrite.All"
New-MgSiteListPermission -SiteId "{site-id}" -ListId "{list-id}" -BodyParameter @{
  roles = @("read")
  grantedToV2 = @{ application = @{ id = "{app-id}" } }
}

Grant read only, no write access. A grant on the whole site isn’t needed. To check: GET https://graph.microsoft.com/v1.0/sites/{site-id}/lists/{list-id}/permissions lists the app with the role read.

3. Check and connect in Kyros

1. Open the library in SharePoint and copy the address from the browser, e.g. https://example.sharepoint.com/sites/Office/Public.
2. Paste it into Kyros and click “Check permission”. Kyros confirms read access or says what is missing (consent or grant).
3. Optionally “Show links to SharePoint in answers”: the chatbot then links the file in SharePoint below its answers. Only useful if your visitors may open those files; otherwise it names the title only.
4. Check the preview, choose a name and an interval (every 15 minutes to daily), then “Connect and sync”.

What happens next

The first sync takes over every matching file. After that Kyros asks Microsoft only for the changes at the chosen interval: new, changed, renamed and deleted files. Kyros doesn’t keep the original files, only the extracted text, which counts towards your storage. Microsoft’s EU Data Boundary covers processing at Microsoft; the text Kyros has fetched is covered by your data processing agreement with us.

End the access

• One library: delete the app’s permission on the list (DELETE …/lists/{list-id}/permissions/{permission-id}). Kyros then reports “Access denied”; the documents stay until you disconnect.
• Everything: delete the app under “Enterprise applications” or revoke the consent.
• In Kyros: “Disconnect”. You choose whether the synced documents are deleted (preselected) or kept.

If it doesn’t work

• “There is no administrator consent”: consent is missing or not active yet. Connect again and check once more after a few minutes.
• “The app may not read this library”: step 2 is missing, or the grant is for a different library.
• “The library was not found”: check the address; it must point to a document library, not a page or list.

More about the knowledge base on the product page. Nextcloud has its own guide: Connect Nextcloud.