Skip to main content

​
Overview

Once Microsoft SharePoint is connected, the Dema Agent can work with SharePoint sites, lists and list items, columns, document libraries, files, and folders, and manage file sharing — all on your behalf. Use it to find documents, read list data, and organize content during a conversation. SharePoint is served by Microsoft’s official hosted Work IQ / Agent 365 SharePoint MCP server. The agent acts as the user who authorizes the connection, so it only sees the sites and files that user can already access.
File operations are limited to files of 5 MB or less.

​
Prerequisites

  • A Microsoft 365 organization (work or school account). Personal Microsoft accounts are not supported.
  • A Microsoft 365 Copilot license for the user who connects. Work IQ is backed by the Microsoft 365 Copilot Chat API, so tool calls fail without it.
  • A Microsoft Entra (Azure AD) administrator to complete the one-time tenant setup below.
  • Your Microsoft Entra tenant ID (a GUID). Find it in the Entra admin center under Overview → Tenant ID.

​
One-time tenant setup (admin)

1

Provision the Agent 365 Tools service principal

A Global Administrator runs this once per tenant, using the Azure CLI:
az ad sp create --id ea9ffc3e-8a23-4a7d-836d-234d7c7565c1
Prefer a UI? In Microsoft Graph Explorer, signed in as an admin, send POST https://graph.microsoft.com/v1.0/servicePrincipals with body {"appId": "ea9ffc3e-8a23-4a7d-836d-234d7c7565c1"}. A 201 Created response means it worked.
2

Grant admin consent

After the service principal exists, grant tenant-wide admin consent for the SharePoint permission (McpServers.SharePoint.All) when prompted during the first connection, or ahead of time from the Microsoft 365 admin center under Agents → Tools.
This setup is shared across the Microsoft Teams, Outlook, and SharePoint integrations. If you already provisioned the service principal for one of them, you only need to consent to the SharePoint permission here.

​
Connect Microsoft SharePoint

1

Open the integration in Dema

In Dema, go to Agents → Settings → Integrations, find Microsoft SharePoint, and click Connect.
2

Enter your tenant MCP URL

Enter the MCP URL in the form below, replacing {tenant_id} with your Entra tenant ID:
https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_SharePointRemoteServer
3

Sign in and approve

Click Add, sign in with your Microsoft work or school account, and approve the permission Dema requests. You are returned to Dema with the integration marked as Active.

​
Scopes Dema requests

ScopeWhat it allows
McpServers.SharePoint.AllManage SharePoint sites, lists, list items, columns, document libraries, files, folders, and sharing on your behalf
offline_accessRefresh access so you do not have to reconnect frequently
The session runs as the user who authorizes it, so the agent only sees the sites and files that user can already access.

​
Troubleshooting

  • AADSTS650052 / “your organization lacks a service principal”. The Agent 365 Tools service principal is not provisioned in your tenant. An admin must run the provisioning step above.
  • Sign-in rejected. You are using a personal Microsoft account. Use a work or school (organizational) account.
  • The agent gets no access or a 403. The signing-in user is missing a Microsoft 365 Copilot license. Assign one and allow time for it to propagate.
  • Dema says the URL is invalid. The MCP URL must be https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_SharePointRemoteServer with {tenant_id} replaced by your real tenant GUID.
  • A file operation fails. File operations are limited to files of 5 MB or less.
  • Permission not grantable in Entra. An Entra admin must register/consent the Work IQ SharePoint MCP server (mcp_SharePointRemoteServer) before the McpServers.SharePoint.All permission can be consented.

​
Additional resources