SharePoint

OAuthStorage & AssetsOrg connection

Org-level connection

SharePoint is connected once at the org level by an admin. The credential is shared across all groups that have been granted access — individual team members don't need to connect their own accounts.

How to connect

Click "Connect with OAuth" below to authorize On Belay to access your SharePoint sites. You'll be redirected to Microsoft to approve the connection — no credentials to copy or paste. Work/school (Microsoft 365) accounts only — personal Microsoft accounts are not supported.

Important: this connection almost always needs your Microsoft 365 admin. Site-wide permissions (Sites.ReadWrite.All, Files.ReadWrite.All) are admin-consent permissions in most tenants, so unless you are a Global Administrator you will see a "Need admin approval" screen from Microsoft. That is expected — forward the consent link Microsoft shows you to your IT admin and have them approve it once for the tenant. After they approve, come back here and click "Connect with OAuth" again.

The connection runs as the user who authorizes it and can reach any SharePoint site that user can reach — connect from an account with access to the sites you want On Belay to work in. On Belay can read file contents, and can create folders, rename, move, delete, and update list items. It cannot currently upload or replace the contents of a file.

Ready to connect?

Permissions (scopes)

These are the data scopes On Belay can be granted for SharePoint. Your org admin controls which scopes are enabled per group.

Scope	Description	Access
`offline_access`	Maintain offline access	Read only
`User.Read`	Read my profile	Read only
`Sites.Read.All`	Read items in all site collections	Read only
`Sites.ReadWrite.All`	Edit or delete items in all site collections	Read / Write
`Files.Read.All`	Read all files the signed-in user can access	Read only
`Files.ReadWrite.All`	Read and write all files the user can access	Read / Write

Troubleshooting

"redirect_uri_mismatch" error during OAuth

Your OAuth app's authorized redirect URIs don't include the On Belay callback URL. Add https://app.onbelay.ai/api/oauth-callback/sharepoint to the allowed redirect URIs in your OAuth app settings.

"invalid_scope" error

The API or scope isn't enabled in your cloud project. For Google integrations, make sure the relevant API (e.g. Google Ads API, Search Console API) is enabled in Google Cloud Console for your project.

Connected but Claude can't access data

Check that your group has been granted access to this integration in On Belay → Groups → [your group] → Integrations. Also verify the specific scopes your group is permitted to use match what your query requires.

Still stuck? We're happy to help.

Contact support →