Skip to main content
The SharePoint connector syncs files into Kepler from the SharePoint sites that one Microsoft 365 account can open. A Kepler admin connects it once for the whole organization. Kepler only reads. It never changes or deletes anything in SharePoint. This page has two parts:

​
Before you start

  • A Kepler organization admin, signed in to Kepler in an incognito window. Only admins can manage connectors. The Microsoft sign-in uses the Microsoft account your browser is already signed in to. An incognito window makes sure you connect the dedicated account, not your own.
  • A dedicated Microsoft 365 account, for example kepler-sync@yourcompany.com, with access to the sites you want to sync. Don’t use a person’s own account: Kepler can read everything the account can open, and the selected content becomes visible to your whole organization.
If SharePoint is not listed when you add a connector, it is not yet turned on for your organization. Email desk@kepler.ai to turn it on.

​
Connect SharePoint

1

Open organization connectors

In Kepler, open the account menu in the sidebar and select Settings. Under Organization, select Org connectors.
Kepler Organization connectors page with an Add connector button

The Org connectors page, before any connector is added.

2

Add SharePoint

Select Add connector, then select SharePoint.
Add a connector dialog listing SharePoint, Egnyte, Box, Google Drive, OneDrive, and Outlook
The SharePoint row opens and shows the two setup steps.
SharePoint row showing two steps: connect the service account, and choose what syncs
3

Connect the dedicated account

Under Connect the service account, select Connect. A dialog explains that you will sign in with Microsoft. Select Connect again, then sign in to Microsoft as the dedicated account.Microsoft asks you to accept the permissions Kepler needs. Select Accept. If Microsoft shows Need admin approval instead, a Microsoft 365 admin must approve Kepler first. Send them to For Microsoft 365 admins.When the connection works, the step shows Connected as with the dedicated account’s name and email. Check that it is the dedicated account, not your own.
SharePoint row after connecting, with the account connected and a Choose content button
4

Choose what syncs

Under Choose what syncs, select Choose content. Nothing syncs until you make a selection.The picker lists the sites that the dedicated account can open. Select a site to sync its document libraries and its pages. To sync less, open the site and select document libraries, folders, or files inside.Select the items to sync, then select Review. The button shows how many items you selected.
SharePoint content picker listing sites, with four sites selected
5

Review and save

Check the list under Review what syncs, then select Save selection.To limit what syncs, open Global Content Filters. You can allow or block file extensions, skip hidden files, set a maximum file size, or sync only files modified after a date.
Review what syncs dialog listing the Documents library and Site Pages of each selected site, the Global Content Filters, and a Save selection button
The SharePoint row now shows Syncing. New and changed files usually become searchable within minutes.
SharePoint row with the status Syncing and an Edit selection button

SharePoint is connected and syncing the selected content.

Kepler manages access to a connection and access to its synced content separately. If your SharePoint content does not appear in the Documents library within 5 minutes, email desk@kepler.ai.

​
For Microsoft 365 admins

Many Microsoft 365 tenants don’t let regular users approve apps that read files. In that case the dedicated account sees Need admin approval when it signs in, and an admin must approve Kepler’s app for the tenant once.

​
What Kepler asks for

Kepler asks for read-only, delegated access as the one account that signs in. It can’t change or delete files, and it can’t open anything that account can’t open. You need one of these Microsoft Entra roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator.
If the consent link shows Need admin approval after you sign in, your account doesn’t have one of these roles. Many companies that use a managed service provider (MSP) for IT have no one in-house with these roles. Send the link to the person who has one, often at your MSP. They sign in with their admin account for your tenant. Keep your domain in the link, so that the consent goes to your tenant and not to theirs.
1

Open the consent link

Replace <your-tenant-domain> with your domain, for example yourcompany.com, and open the link:
2

Sign in and accept

Sign in with your admin account. Check that the screen shows Kepler SharePoint and the permissions above, then select Accept. The screen doesn’t show openid, email or profile as separate lines. It includes them in Sign in and read user profile.Microsoft then opens a Kepler page that can show an error. You can close it: your consent was saved when you selected Accept.
3

Confirm

In the Microsoft Entra admin center, open Enterprise applications, search for Kepler SharePoint, and open Permissions. The Admin consent tab lists the permissions under Microsoft Graph.
Then tell your Kepler admin to connect again. The sign-in no longer asks for approval.

​
App restrictions

Skip this if your tenant does not limit which apps users can sign in to. Otherwise, in Enterprise applications, open Kepler SharePoint and check:
  • Properties → Assignment required? If this is Yes, open Users and groups and add the dedicated account.
  • Conditional Access. If a policy blocks third-party apps or requires a managed device, allow Kepler SharePoint for the dedicated account. Kepler syncs from the cloud, not from a device on your network.

​
Remove access

Either of these stops Kepler reading SharePoint:
  • In Kepler: a Kepler admin opens Org connectors, expands SharePoint, and selects Delete SharePoint connection.
  • In Microsoft Entra: open Enterprise applications, open Kepler SharePoint, then Properties → Delete. This removes the app and its consent from your tenant.

​
Troubleshooting

Your tenant requires an admin to approve Kepler’s app. Follow Grant admin consent, then connect again. If the consent link also shows this message, your account can’t approve apps. Send the link to an admin who can, for example at your managed service provider (MSP).
Assignment required? is on for Kepler’s app. Add the dedicated account under Users and groups. See App restrictions.
A Conditional Access policy covers Kepler’s app. Allow it for the dedicated account. See App restrictions.
The browser reused an existing Microsoft sign-in. Select Disconnect, then connect again from an incognito window.
The picker shows only the sites that the dedicated account can open. Add the account as a member or visitor of the site, then open Choose content again. A site you just added the account to can take some time to appear.