> ## Documentation Index > Fetch the complete documentation index at: https://docs.kepler.ai/llms.txt > Use this file to discover all available pages before exploring further. # SharePoint > Connect SharePoint sites so everyone in your organization can search their files in Kepler. The SharePoint connector syncs files into Kepler from the SharePoint sites that one Microsoft 365 account can open. A Kepler admin connects it once for the whole organization. Kepler only reads. It never changes or deletes anything in SharePoint. This page has two parts: * [For Kepler admins](#connect-sharepoint): connect SharePoint and choose what syncs. * [For Microsoft 365 admins](#for-microsoft-365-admins): approve Kepler's app when your tenant blocks the sign-in. ## Before you start * **A Kepler organization admin, signed in to Kepler in an *incognito window*.** Only admins can manage connectors. The Microsoft sign-in uses the Microsoft account your browser is already signed in to. An incognito window makes sure you connect the dedicated account, not your own. * **A dedicated Microsoft 365 account**, for example `kepler-sync@yourcompany.com`, with access to the sites you want to sync. Don't use a person's own account: Kepler can read everything the account can open, and the selected content becomes visible to your whole organization. > [!NOTE] > > If **SharePoint** is not listed when you add a connector, it is not yet turned on for your organization. Email [desk@kepler.ai](mailto:desk@kepler.ai) to turn it on. ## Connect SharePoint **1. Open organization connectors** In Kepler, open the account menu in the sidebar and select **Settings**. Under **Organization**, select **Org connectors**. ![Kepler Organization connectors page with an Add connector button](https://mintcdn.com/kepler-a6ccf6fc/RnlQKyo-7KmJ5tO0/images/connectors/org-connectors-page.png?fit=max\&auto=format\&n=RnlQKyo-7KmJ5tO0\&q=85\&s=0c273c43fe87f3d25fef4b51e805970d) The Org connectors page, before any connector is added. **2. Add SharePoint** Select **Add connector**, then select **SharePoint**. ![Add a connector dialog listing SharePoint, Egnyte, Box, Google Drive, OneDrive, and Outlook](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/add-connector-sharepoint.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=7226161058558498ba1a418a8b8d3df4) The SharePoint row opens and shows the two setup steps. ![SharePoint row showing two steps: connect the service account, and choose what syncs](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/sharepoint-setup-steps.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=5fcfa13824a6516c4390618248f840d6) **3. Connect the dedicated account** Under **Connect the service account**, select **Connect**. A dialog explains that you will sign in with Microsoft. Select **Connect** again, then sign in to Microsoft as the dedicated account. Microsoft asks you to accept the permissions Kepler needs. Select **Accept**. If Microsoft shows **Need admin approval** instead, a Microsoft 365 admin must approve Kepler first. Send them to [For Microsoft 365 admins](#for-microsoft-365-admins). When the connection works, the step shows **Connected as** with the dedicated account's name and email. Check that it is the dedicated account, not your own. ![SharePoint row after connecting, with the account connected and a Choose content button](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/sharepoint-connected.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=946d76c9ca53f950b5618c0fea37a9ae) **4. Choose what syncs** Under **Choose what syncs**, select **Choose content**. Nothing syncs until you make a selection. The picker lists the sites that the dedicated account can open. Select a site to sync its document libraries and its pages. To sync less, open the site and select document libraries, folders, or files inside. Select the items to sync, then select **Review**. The button shows how many items you selected. ![SharePoint content picker listing sites, with four sites selected](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/sharepoint-picker.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=40027418ca5a589be68e47a758d1c55b) **5. Review and save** Check the list under **Review what syncs**, then select **Save selection**. To limit what syncs, open **Global Content Filters**. You can allow or block file extensions, skip hidden files, set a maximum file size, or sync only files modified after a date. ![Review what syncs dialog listing the Documents library and Site Pages of each selected site, the Global Content Filters, and a Save selection button](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/sharepoint-review.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=12c9dd040d739c63d845f1cf9751aa39) The SharePoint row now shows **Syncing**. New and changed files usually become searchable within minutes. ![SharePoint row with the status Syncing and an Edit selection button](https://mintcdn.com/kepler-a6ccf6fc/3POW7_xLRh_2gBfX/images/connectors/sharepoint-syncing.png?fit=max\&auto=format\&n=3POW7_xLRh_2gBfX\&q=85\&s=d4690fec934157b0a65213fc49fcc42a) SharePoint is connected and syncing the selected content. > [!NOTE] > > Kepler manages access to a connection and access to its synced content separately. If your SharePoint content does not appear in the **Documents** library within 5 minutes, email [desk@kepler.ai](mailto:desk@kepler.ai). ## For Microsoft 365 admins Many Microsoft 365 tenants don't let regular users approve apps that read files. In that case the dedicated account sees **Need admin approval** when it signs in, and an admin must approve Kepler's app for the tenant once. ### What Kepler asks for Kepler asks for **read-only, delegated** access as the one account that signs in. It can't change or delete files, and it can't open anything that account can't open. ### Grant admin consent You need one of these Microsoft Entra roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator. > [!NOTE] > > If the consent link shows **Need admin approval** after you sign in, your account doesn't have one of these roles. Many companies that use a managed service provider (MSP) for IT have no one in-house with these roles. Send the link to the person who has one, often at your MSP. They sign in with their admin account for your tenant. Keep your domain in the link, so that the consent goes to your tenant and not to theirs. **1. Open the consent link** Replace `` with your domain, for example `yourcompany.com`, and open the link: [https://login.microsoftonline.com/\/adminconsent?client\_id=5c0ede89-f3b1-4279-9584-7e4a71a8a158](https://login.microsoftonline.com/\/adminconsent?client_id=5c0ede89-f3b1-4279-9584-7e4a71a8a158) **2. Sign in and accept** Sign in with your admin account. Check that the screen shows **Kepler SharePoint** and the permissions above, then select **Accept**. The screen doesn't show `openid`, `email` or `profile` as separate lines. It includes them in **Sign in and read user profile**. Microsoft then opens a Kepler page that can show an error. You can close it: your consent was saved when you selected **Accept**. **3. Confirm** In the [Microsoft Entra admin center](https://entra.microsoft.com), open **Enterprise applications**, search for **Kepler SharePoint**, and open **Permissions**. The **Admin consent** tab lists the permissions under Microsoft Graph. Then tell your Kepler admin to connect again. The sign-in no longer asks for approval. ### App restrictions Skip this if your tenant does not limit which apps users can sign in to. Otherwise, in **Enterprise applications**, open **Kepler SharePoint** and check: * **Properties → Assignment required?** If this is **Yes**, open **Users and groups** and add the dedicated account. * **Conditional Access.** If a policy blocks third-party apps or requires a managed device, allow **Kepler SharePoint** for the dedicated account. Kepler syncs from the cloud, not from a device on your network. ### Remove access Either of these stops Kepler reading SharePoint: * **In Kepler:** a Kepler admin opens **Org connectors**, expands **SharePoint**, and selects **Delete SharePoint connection**. * **In Microsoft Entra:** open **Enterprise applications**, open **Kepler SharePoint**, then **Properties → Delete**. This removes the app and its consent from your tenant. ## Troubleshooting > [accordion] Microsoft says “Need admin approval” > > Your tenant requires an admin to approve Kepler's app. Follow [Grant admin consent](#grant-admin-consent), then connect again. If the consent link also shows this message, your account can't approve apps. Send the link to an admin who can, for example at your managed service provider (MSP). > [accordion] Error AADSTS50105: not assigned to a role for the application > > **Assignment required?** is on for Kepler's app. Add the dedicated account under **Users and groups**. See [App restrictions](#app-restrictions). > [accordion] Error AADSTS53003: blocked by Conditional Access > > A Conditional Access policy covers Kepler's app. Allow it for the dedicated account. See [App restrictions](#app-restrictions). > [accordion] The connection shows the wrong account > > The browser reused an existing Microsoft sign-in. Select **Disconnect**, then connect again from an incognito window. > [accordion] A site is missing from the picker > > The picker shows only the sites that the dedicated account can open. Add the account as a member or visitor of the site, then open **Choose content** again. A site you just added the account to can take some time to appear. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.