Log in

SharePoint

Let agents browse SharePoint sites and document libraries, read files, and draft file uploads for your approval.

The SharePoint connector plugs your workspace's agents into your organization's SharePoint: they can find sites, walk document libraries, read file contents, and draft new or updated files for you to approve.

Before You Start

  • The connector uses your work or school Microsoft account — personal Microsoft accounts can't connect.
  • No admin consent is required. The connector requests delegated scopes only, so you can connect it yourself.
  • It shares a single Microsoft sign-in with the Teams and Outlook connectors — connect one and the others reuse the same credential.

What the Agent Can Do

Agents navigate SharePoint top-down: find the site, list its document libraries, browse folders, then read files. This keeps every step scoped to what your account can already see.

Find sites

sites_search — search SharePoint sites by name. This is the entry point: use it to find the site that hosts a document library before doing anything else. No approval required. Scope: Sites.Read.All.

List document libraries

site_drives — list the document libraries (drives) of a site, using the site id from sites_search. No approval required. Scope: Sites.Read.All.

Browse files and folders

drive_items — list the files and folders in a document library. Start at the root of a drive, or pass a folder id from a previous call to go deeper. Each result includes the item's name, type (file or folder), size, and last-modified time. No approval required. Scope: Files.Read.All.

Read file contents

item_content — download a file's content by its drive and item ids (from drive_items). No approval required. Scope: Files.ReadWrite.All.

Upload a file

file_upload — write a file. It can create a new file in a drive or folder, or replace an existing file's content in place. Text content is passed inline; binary content (e.g. an Excel .xlsx workbook) must be written to the run's workspace and referenced by filePath — the runtime reads the exact bytes. The file's content type is set from its extension. Requires your approval — the upload runs only after you review it in the Outbox. Scope: Files.ReadWrite.All.

Summary

ToolDoesApprovalScope
sites_searchSearch sites by nameNot requiredSites.Read.All
site_drivesList a site's document librariesNot requiredSites.Read.All
drive_itemsBrowse files and folders in a driveNot requiredFiles.Read.All
item_contentRead a file's contentNot requiredFiles.ReadWrite.All
file_uploadCreate or replace a file (text or binary)RequiredFiles.ReadWrite.All

Security Notes

  • Egress-restricted. All requests go through Headways' egress gateway, which only reaches graph.microsoft.com and your tenant's own SharePoint download host. Nothing else on the internet is reachable.
  • Your permissions, enforced twice. SharePoint only returns what your account can see, and the connector never requests more scope than the tools above need.
  • No path games. File names and ids are validated before use — a crafted name can't escape its folder or reach another endpoint.
  • Errors surface as errors. An expired session or a throttling response comes back as a visible failure, never silently as "no results."
  • Content types come from the file name. An upload's content type is inferred from its extension (or you can set it explicitly), so an .html or .svg file is stored as an active content type — only upload files you intend your tenant to serve.