--- schema_version: "1" id: 08df402f6aadfe69b74a79d006281d7ed7396d988466c830bdd7fca79bdf7e64 title: Prepare Your Microsoft SharePoint Unstructured (Site Pages & Site Assets) Connection collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/guides/microsoftsharepoint/c360-a-prepare-microsoftsharepoint-unstructured-spsa-connection.md canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-prepare-microsoftsharepoint-unstructured-spsa-connection.html source_site: developer.salesforce.com content_type: documentation content_hash: 5b5ef7f63c11976b7cb6f2c9c69d8b9b31e58f4631ec905735db801c2f60df03 products: - Data 360 Integration Guide - Data 360 Developer Documentation --- # Prepare Your Microsoft SharePoint Unstructured (Site Pages & Site Assets) Connection To set up a SharePoint Unstructured (Site Pages & Site Assets) connection with Data 360, you need to provide some details. Gather this information before you get started. ## Step 1 - Create an App Registration To connect Salesforce and Microsoft, configure a [Microsoft Azure app](https://help.salesforce.com/s/articleView?id=ind.sf_contracts_create_a_microsoft_azure_app.htm&type=5) by completing steps 1–5 only. * Make note of the **Application (client) ID** and **Directory (tenant) ID**. ## Step 2 - Grant SharePoint API Permissions 1. Go to your Azure Portal. In the app registration, go to API permissions. 2. Click **Add a permission**. Select **SharePoint** as the API, and choose **Application permissions** (not Delegated permissions) for all of the following. 3. Select the required permissions based on your preferred access level: * Option A \- Broad Access This option grants your application broad access to all SharePoint Sites, which is simpler to set up. Add the following Application permission: * Sites.FullControl.All (Application) * Option B \- Secure Workaround (Restricted Access) This option uses the more restrictive Sites.Selected permission, requiring an extra step to explicitly grant the application access to specific sites. Add the following Application permission: * Sites.Selected (Application) 4. Click **Add permissions**. 5. Click **Grant admin consent for \[your organization\]** to apply the permissions for whichever option you choose. ### Grant App Access to a Specific SharePoint Site (For Option B Only) If you choose the **Sites.Selected** permission, your application can't access any site by default. Explicitly grant it access to the target site(s) before proceeding. This step requires a SharePoint or Global admin account with the **Sites.FullControl.All** scope. 1. **Retrieve Site ID:** Go to your SharePoint site and append `/_api/site/id` to the site URL. For example: `https://yourcompany.sharepoint.com/sites/dottedcloud-integration-testing/_api/site/id`. The API returns an XML response containing an `Edm.Guid` value — this is your short-form Site ID. For example, in the response `a1b2c3d4-e5f6-7890-abcd-ef1234567890`, the Site ID is `a1b2c3d4-e5f6-7890-abcd-ef1234567890`. 2. **Request App Permission:** Use an API client like Postman, and send a POST request with the admin's access token to grant your app access. * **Request URL:** POST `https://graph.microsoft.com/v1.0/sites/{siteId}/permissions` * **Headers:** * Authorization: Bearer \ * Content-Type: application/json * **Body (JSON):** ``` { "roles": [ "read" ], "grantedToIdentities": [ { "application": { "id": "", "displayName": "" } } ] } ``` ## Step 3 - Generate a Client Certificate To generate a client certificate, first create a certificate folder. This step is optional but recommended. 1. **Create a dedicated folder to store your certificate files.** For Mac or Linux terminal: * `mkdir ~/mycert` * `cd ~/mycert` For Windows (Command Prompt or PowerShell): * `mkdir C:\Users\YourUsername\mycert` * `cd C:\Users\YourUsername\mycert` 2. **Generate a self-signed certificate with OpenSSL.** Run this command for Mac, Linux, or Windows with OpenSSL installed: * `openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out cert.pem` 3. **Command parameters:** * `-newkey rsa:2048`: Generates a new 2048-bit RSA key * `-nodes`: Bypasses encrypting the private key so no password is required * `-keyout key.pem`: Outputs the private key file * `-x509`: Generates a self-signed certificate * `-days 365`: Makes the certificate valid for 1 year * `-out cert.pem`: Outputs the certificate file 4. **The system prompts you to enter:** * Country Name (a 2-letter code, such a US) * State or Province * Locality or City * Organization * Common Name (App name, domain, or identifier) 5. **This action generates two files.** * `key.pem`: Private key * `cert.pem`: Certificate 6. **Create a password-protected `.pfx` file.** This action bundles your public certificate, `cert.pem`, and private key, `key.pem`, into a single file for use during application setup. Run this command for Mac, Linux, or Windows with OpenSSL installed: * `openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx` 7. **When prompted, set a password for the `.pfx` file.** 8. **This action generates these files:** * `key.pem`: Private key * `cert.pem`: Certificate * `cert.pfx`: pfx file 9. **Convert the certificate to a `.cer` file for Azure App Registration.** Run this command for Mac, Linux, or Windows with OpenSSL installed: * `openssl x509 -in cert.pem -out cert.cer -outform DER` 10. **This action generates these files:** * `key.pem`: Private key * `cert.pem`: Certificate * `cert.pfx`: Bundled `.pfx` file used during connector or application setup * `cert.cer`: Public certificate used in Azure app registration ## Step 4 - Copy and Store the Private Key The private key is stored in `key.pem`. * For Mac or Linux: `cat ~/mycert/key.pem` * For Windows (PowerShell): `type C:\Users\YourUsername\mycert\key.pem` The output looks like this: ``` -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD... ... -----END PRIVATE KEY----- ``` If a system asks for the private key, copy the text between `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----`. Save this private key because you need it later in the connection setup. **Tip:** To copy the key easily, open the file in a text editor, such as VS Code, Notepad, or TextEdit. ## Step 5 - Upload the Certificate to App Registration 1. Navigate to Azure Portal – App registrations. 2. Select your application. 3. Go to Certificates & secrets. 4. Under Certificates, click Upload certificate. 5. Upload the `.cer` (public certificate). 6. Save and confirm the certificate is listed. 7. Copy the Thumbprint. ## Step 6 - Copy and Save the Certificate Thumbprint On the Certificates & Secrets page, locate the uploaded certificate and copy its Thumbprint value. Securely save the Thumbprint along with these items. * Client ID * Tenant ID * Private key, `key.pem` You need the Thumbprint during the connector setup to identify the certificate. ## Step 7 - Locate Your SharePoint Site Name You need your SharePoint Site Name to construct the Base URI and create a data stream and connection. The Site Name is the identifier used in the SharePoint site URL. Ask your SharePoint administrator for this information, or locate it yourself: 1. Open the SharePoint site in your browser. 2. In the address bar, copy the value in the URL that appears after `/sites/`. For example, in the URL https://yoursite.sharepoint.com/sites/MarketingTeam, the site name is **MarketingTeam**. Watch a comprehensive demo of how to configure Microsoft SharePoint Unstructured (Site Pages & Site Assets): ::video{src="https://developer.salesforce.com/docs/data/data-cloud-int/guide/LkNwMSN1cEyGwNZfhin5Rj" title="Microsoft SharePoint Unstructured (Site Pages & Site Assets) Connection Set-up" type="vidyard"} ## Next Step - [Set Up a Microsoft SharePoint Unstructured (Site Pages & Site Assets) Connection](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-microsoftsharepoint-unstructured-spsa-connection.md)