Connecting SharePoint

To sync documents from SharePoint, Aevy needs admin consent for the Aevy Integration (AP) app in your Microsoft tenant. It also needs read access to each site you want synced. First, an administrator grants admin consent once, in the browser. Then you grant the sites with a script in Azure Cloud Shell. You can revoke either one at any time.

Before you begin

Have the following ready:

1. Your full tenant domain. For example, contoso.onmicrosoft.com. The short name contoso on its own doesn’t work. Entra ID shows the full domain as Primary domain on the tenant overview page.
2. An account that can grant admin consent. This is a Global Administrator or Privileged Role Administrator in Entra ID. Microsoft reserves admin consent for Microsoft Graph application permissions to those two roles. A Cloud Application Administrator or Application Administrator can’t grant it.
3. An account that can grant the sites. This is a SharePoint Administrator or Global Administrator. The account must also be an owner or site collection admin of each site. The grant runs as you and checks your own SharePoint permissions, so a tenant role alone isn’t enough.

Usually one IT administrator does both steps. A Global Administrator has the roles for both.

Aevy reads SharePoint with the Sites.Selected application permission. The sync runs as a background service, with no signed-in user. The permission works as follows:

1. It gives no access on its own. Unlike Sites.Read.All or Files.Read.All, Sites.Selected lets Aevy read only the sites you grant. Aevy can’t see anything else in SharePoint or OneDrive.
2. It’s read-only. Each site grant has the read role. Aevy never writes, moves, renames, or deletes anything in SharePoint.
3. It’s reversible. You can remove one site’s grant, or remove the app’s admin consent to stop the sync. See revoke access.

Single sign-on is a separate setup. See connecting your identity provider.

Grant admin consent

A Global Administrator or Privileged Role Administrator grants admin consent for the Aevy Integration (AP) app once, before any site is granted. The grant script never does this step.

1. Open the following URL, with your tenant domain in place of contoso.onmicrosoft.com. A verified custom domain such as contoso.com, or your tenant ID, also works.

   https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/adminconsent?client_id=674a5bc9-90a4-4319-8bff-425e0d9cf9a3&scope=https://graph.microsoft.com/.default&redirect_uri=https://aevy.app

2. Sign in as a Global Administrator or Privileged Role Administrator.

3. Check that the app is Aevy Integration (AP) and the permission is Sites.Selected, then click Accept.

4. When the browser opens aevy.app, close the window.

To confirm the admin consent, open Enterprise applications in the Microsoft Entra admin center, select Aevy Integration (AP), and then select Permissions. Under Admin consent, the list shows Sites.Selected with the type Application.

Grant the sites

A SharePoint Administrator or Global Administrator who can open each site runs the grant script. Run it in Azure Cloud Shell, which signs you in and has the Microsoft Graph PowerShell modules installed.

1. Open shell.azure.com and choose PowerShell.

2. Download the script into Cloud Shell:

   Invoke-WebRequest -Uri https://docs.aevy.io/scripts/aevy-grant-sharepoint.ps1 -OutFile aevy-grant-sharepoint.ps1

   To read it before you run it, enter Get-Content ./aevy-grant-sharepoint.ps1. Each step in the script explains what it does and which permission it asks for.

3. Run the script:

   ./aevy-grant-sharepoint.ps1

   The script lists what the run needs from your account, and then shows a device code.

4. Open the URL that the script prints, enter the code, and sign in.

5. The script checks that Aevy Integration (AP) has admin consent in your tenant. If it doesn’t, or if the script can’t check, the script stops before it grants anything and prints the admin consent URL. Grant admin consent as described in grant admin consent, and then run the script again.

6. Paste one site URL per line, and then press Enter on an empty line. To skip this prompt, pass the sites when you run the script: ./aevy-grant-sharepoint.ps1 -SiteUrl "https://contoso.sharepoint.com/sites/Wind", "https://contoso.sharepoint.com/sites/Solar".

Aevy can’t read a site that you don’t grant. A missing grant is the most common reason that expected documents don’t appear in Aevy.

If your team uses PnP PowerShell, you can grant a site without the script. Connect with Connect-PnPOnline, and then run the following command for each site:

Grant-PnPAzureADAppSitePermission -AppId 674a5bc9-90a4-4319-8bff-425e0d9cf9a3 -DisplayName "Aevy Integration (AP)" -Site https://contoso.sharepoint.com/sites/Wind -Permissions Read

PnP PowerShell doesn’t check admin consent or write a report. Check admin consent as described in grant admin consent, and send your Aevy contact the list of sites that you granted.

Send the report to Aevy

When the script finishes, it prints a report and saves it as aevy-grant-report.txt in your Cloud Shell home directory. The report lists the tenant, the account that granted the sites, the admin consent state, and each granted site with its site ID. Send the report to your Aevy contact.

Copying the report from the Cloud Shell window is usually enough. To download the file, click Manage files, and then click Download. If your Cloud Shell session has no storage account, Cloud Shell deletes the file when you close the window, so download it first.

Verify the connection

The script reads each site’s permission back before it reports the site as granted. The report’s Admin consent line shows whether Aevy can use those grants:

1. granted. Aevy Integration (AP) has admin consent, and the setup is complete.
2. NOT CONFIRMED. The script ran with -SkipConsentCheck, so it didn’t check admin consent. Check admin consent as described in grant admin consent, and grant it if it’s missing. You don’t need to run the script again: the site grants stay in place.

Aevy verifies the connection, typically within one business day. The first sync then copies the existing documents from each site. To learn what syncs, how often, and which file types, see how your data gets in.

Troubleshooting

The consent page says Need admin approval	Your account can’t grant admin consent. Sign in as a Global Administrator or Privileged Role Administrator.
The sign-in page says AADSTS90002: Tenant ‘contoso’ not found	The URL has the short tenant name. Use the full domain, such as contoso.onmicrosoft.com, a verified custom domain, or your tenant ID.
The script stops and says that Aevy Integration (AP) has no admin consent	Grant admin consent as described in grant admin consent, and then run the script again.
The script stops and says that it could not check admin consent	The reason follows the message. Run the script in Azure Cloud Shell, which has the modules it needs. If the check still can’t run, confirm admin consent in Enterprise applications, and then run the script with -SkipConsentCheck.
The script says that the sign-in did not get a permission	The Microsoft Graph command line tools need admin consent for Sites.FullControl.All and Application.Read.All. Sign in as a Global Administrator, select Consent on behalf of your organization, and then run the script again.
The report says Admin consent: NOT CONFIRMED	The script ran with -SkipConsentCheck. Check admin consent in Enterprise applications, and grant it if it’s missing. The site grants stay in place.
The script says that SharePoint denied access to a site	Your account can’t open that site. In the SharePoint admin center, add yourself as a site owner or site collection admin. Then run the script again for that site.
The script is denied when it grants a site	Your account isn’t a SharePoint Administrator or Global Administrator. Run the script again with an account that is.
Admin consent is in place, but no documents sync	No sites are granted yet, or a new grant hasn’t taken effect. Run the script for the sites, and then wait a few minutes.
Aevy Integration (AP) is missing from Enterprise applications	Admin consent didn’t finish, or the URL still had contoso.onmicrosoft.com in it. Open the admin consent URL again with your own tenant domain.
Some sites sync and others don’t	The other sites aren’t granted. Run the script again and enter only those sites.
The sync stopped after it worked for a while	An administrator removed the admin consent, a site grant, or the app. In Enterprise applications, check that Aevy Integration (AP) still has Sites.Selected under admin consent. Then run the script for each site that lost its grant.

For other problems, contact your Aevy contact or support@aevy.io.

Revoke access

You can revoke access to one site or to all of SharePoint:

1. One site. Remove Aevy’s permission on that site. The sync continues for the other sites.
2. All sites. In the Microsoft Entra admin center, open Enterprise applications and select Aevy Integration (AP). Remove its admin consent under Permissions, or delete the app under Properties.

Aevy stops syncing as soon as you revoke access. Documents already in Aevy stay readable, but Aevy stops updating them. To resume, grant admin consent and grant the sites again. For where Aevy stores synced files, who can access them, and what happens to them when your agreement ends, see information security.