> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dema.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft SharePoint

> Let the Dema Agent manage SharePoint sites, lists, document libraries, files, folders, and sharing through Microsoft's hosted SharePoint MCP server.

export const Agent365SetupIntro = () => <>
    Microsoft's Agent 365 tools are exposed by a shared resource called **Agent 365 Tools** (application ID `ea9ffc3e-8a23-4a7d-836d-234d7c7565c1`). Its service principal is **not** provisioned in your tenant automatically, so an admin has to create it once before anyone can connect.

    <Warning>
      If you skip this step, the connection fails with **AADSTS650052** ("your organization lacks a service principal") and the required permissions never appear in Entra.
    </Warning>
  </>;

export const MicrosoftAgentPreviewNote = () => <Note>
    Microsoft Teams, Outlook, and SharePoint are currently **preview** integrations. They are built on Microsoft's Agent 365 / Work IQ MCP servers, which Microsoft ships as a preview feature — tool behavior may change, and your workspace may need the preview enabled before the integration appears.
  </Note>;

## Overview

Once Microsoft SharePoint is connected, the Dema Agent can work with SharePoint sites, lists and list items, columns, document libraries, files, and folders, and manage file sharing — all on your behalf. Use it to find documents, read list data, and organize content during a conversation.

SharePoint is served by Microsoft's official hosted **Work IQ / Agent 365** SharePoint MCP server. The agent acts as the user who authorizes the connection, so it only sees the sites and files that user can already access.

<MicrosoftAgentPreviewNote />

<Tip>
  File operations are limited to files of **5 MB or less**.
</Tip>

***

## Prerequisites

* A **Microsoft 365** organization (work or school account). Personal Microsoft accounts are not supported.
* A **Microsoft 365 Copilot** license for the user who connects. Work IQ is backed by the Microsoft 365 Copilot Chat API, so tool calls fail without it.
* A **Microsoft Entra (Azure AD) administrator** to complete the one-time tenant setup below.
* Your **Microsoft Entra tenant ID** (a GUID). Find it in the [Entra admin center](https://entra.microsoft.com) under **Overview → Tenant ID**.

***

## One-time tenant setup (admin)

<Agent365SetupIntro />

<Steps>
  <Step title="Provision the Agent 365 Tools service principal">
    A Global Administrator runs this once per tenant, using the [Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli):

    ```bash theme={null}
    az ad sp create --id ea9ffc3e-8a23-4a7d-836d-234d7c7565c1
    ```

    Prefer a UI? In [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer), signed in as an admin, send `POST https://graph.microsoft.com/v1.0/servicePrincipals` with body `{"appId": "ea9ffc3e-8a23-4a7d-836d-234d7c7565c1"}`. A `201 Created` response means it worked.
  </Step>

  <Step title="Grant admin consent">
    After the service principal exists, grant tenant-wide admin consent for the SharePoint permission (`McpServers.SharePoint.All`) when prompted during the first connection, or ahead of time from the [Microsoft 365 admin center](https://admin.microsoft.com) under **Agents → Tools**.
  </Step>
</Steps>

<Note>
  This setup is shared across the Microsoft Teams, Outlook, and SharePoint integrations. If you already provisioned the service principal for one of them, you only need to consent to the SharePoint permission here.
</Note>

***

## Connect Microsoft SharePoint

<Steps>
  <Step title="Open the integration in Dema">
    In Dema, go to **Agents → Settings → Integrations**, find **Microsoft SharePoint**, and click **Connect**.
  </Step>

  <Step title="Enter your tenant MCP URL">
    Enter the **MCP URL** in the form below, replacing `{tenant_id}` with your Entra tenant ID:

    ```
    https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_SharePointRemoteServer
    ```
  </Step>

  <Step title="Sign in and approve">
    Click **Add**, sign in with your Microsoft **work or school** account, and approve the permission Dema requests. You are returned to Dema with the integration marked as Active.
  </Step>
</Steps>

***

## Scopes Dema requests

| Scope                       | What it allows                                                                                                      |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `McpServers.SharePoint.All` | Manage SharePoint sites, lists, list items, columns, document libraries, files, folders, and sharing on your behalf |
| `offline_access`            | Refresh access so you do not have to reconnect frequently                                                           |

The session runs as the user who authorizes it, so the agent only sees the sites and files that user can already access.

***

## Troubleshooting

* **AADSTS650052 / "your organization lacks a service principal".** The Agent 365 Tools service principal is not provisioned in your tenant. An admin must run the provisioning step above.
* **Sign-in rejected.** You are using a personal Microsoft account. Use a work or school (organizational) account.
* **The agent gets no access or a 403.** The signing-in user is missing a Microsoft 365 Copilot license. Assign one and allow time for it to propagate.
* **Dema says the URL is invalid.** The MCP URL must be `https://agent365.svc.cloud.microsoft/agents/tenants/{tenant_id}/servers/mcp_SharePointRemoteServer` with `{tenant_id}` replaced by your real tenant GUID.
* **A file operation fails.** File operations are limited to files of 5 MB or less.
* **Permission not grantable in Entra.** An Entra admin must register/consent the Work IQ SharePoint MCP server (`mcp_SharePointRemoteServer`) before the `McpServers.SharePoint.All` permission can be consented.

***

## Additional resources

* [Set up the Agent 365 Tools service principal](https://learn.microsoft.com/microsoft-agent-365/developer/tooling)
* [Manage tools for agents in the Microsoft 365 admin center](https://learn.microsoft.com/microsoft-agent-365/bring-your-own-mcp)
* [Work IQ API permissions](https://learn.microsoft.com/microsoft-365/copilot/extensibility/work-iq/permissions)