The purpose of this document is to provide the detailed steps to configure SharePoint Online as a drop-off location for your Cloudockit documentation on the SaaS or the Desktop version. Many organizations find value in dropping their documentation on SharePoint. Their employees already have access to SharePoint which makes it easy for them to consume the documentation. Dropping in SharePoint Online means the documentation can be easily accessible via Teams as well.

Cloudockit can drop the documents it generates straight into a SharePoint Online document library, where they are also available from the corresponding Microsoft Teams channel.

This article walks through the one-time setup that lets Cloudockit connect to your SharePoint site.

Important – the setup method has changed (April 2026)

Cloudockit used to authenticate to SharePoint using the SharePoint Add-In / Azure ACS “app-only” model – the one where you created a “Service Account” through /_layouts/15/appregnew.aspx and granted it rights through /_layouts/15/appinv.aspx.

Microsoft retired that model on April 2nd, 2026. It no longer works for anyone, on any tenant, with no grace period. This is a global Microsoft change – it is not controlled by the IsSharePointAddInsDisabled (or DisableCustomAppAuthentication) tenant setting, and it applies even if your old client secret has not expired yet.

Cloudockit now connects using Microsoft Entra ID app-only authentication via the Microsoft Graph API.

• New customers: just follow the steps below.
• Existing customers: your previous configuration has stopped working. There is no automatic migration – you need to register a new Entra ID application and re-enter the connection details in Cloudockit, as described below. The old “Service Account” (appregnew/appinv) registration cannot be reused.

Step 1 – Identify your SharePoint site and library

You will need two pieces of information about the destination:

1. SharePoint site URL – for example https://contoso.sharepoint.com/sites/Documentation. Copy it exactly as the browser shows it, including the path segment: classic sites sit under /sites/, but sites created from a Microsoft 365 group or a Teams team sit under /teams/. Use whichever yours has.
2. Document library title – the display name of the library you want the documents to land in (for example Documents).

You can confirm both by opening the target library in the browser and going to Settings → Library settings.

You can optionally target a sub-folder inside that library (see Step 5). The folder must already exist at the root of the library; leave it empty to use the library root.

Step 2 – Register an application in Microsoft Entra ID

This application is what Cloudockit uses to authenticate. It replaces the old “Service Account”.

1. Sign in to the Azure Portal and open Microsoft Entra ID → App registrations → New registration.
2. Name: something recognizable, e.g. Cloudockit SharePoint Drop-off.
3. Supported account types: Accounts in this organizational directory only (Single tenant).
4. Redirect URI: leave it empty – this is an app-only application, there is no interactive sign-in.
5. Click Register.
6. On the application’s Overview page, copy and keep these two values – you will paste them into Cloudockit in Step 5:
   • Application (client) ID
   • Directory (tenant) ID

Step 3 – Create a client secret

1. In your new app registration, open Certificates & secrets → Client secrets → New client secret.
2. Give it a description and choose an expiration period.
3. Click Add, then immediately copy the secret Value – Azure only shows it once. This is the client secret you will paste into Cloudockit in Step 5.

Note the expiration date. When the secret expires, drop-off will stop working until you create a new secret and update it in Cloudockit.
Plan to rotate it before it expires.

Step 4 – Grant access to SharePoint

Access is granted in two parts: first the application is allowed to request per-site access, then you grant it access to the specific site.

4a. Add the Microsoft Graph permission

1. In the app registration, open API permissions → Add a permission.
2. Choose Microsoft Graph → Application permissions.
3. Search for and add Sites.Selected.
4. Back on the API permissions page, click Grant admin consent for <your tenant> and confirm. The permission must show a green Granted status.

Sites.Selected deliberately gives the application no access to any site on its own – it only lets the app be granted access to specific sites, which you do next. This keeps the application scoped to exactly the site(s) you choose.

4b. Grant the application access to your site

This step must be done by a SharePoint / tenant administrator. The easiest way is Microsoft Graph Explorer (sign in as an admin, Sites.FullControl.All consent required).

First, look up the site’s ID. Graph addresses a site “by path”, which maps directly to your SharePoint site URL from Step 1: take that URL, drop the https://, and put a colon (:) right after the hostname. The last part of the path is the site you’re granting access to.

So the request is (replace the hostname – here contoso – and the trailing site name – here Documentation – with your own):

GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/Documentation

Mind the /sites/ vs /teams/ segment – it must match your real site URL. Sites created from a Microsoft 365 group or a Teams team live under /teams/, not /sites/. For example https://contoso.sharepoint.com/teams/HR becomes contoso.sharepoint.com:/teams/HR. Using the wrong segment makes the site lookup fail.

The response contains an "id" that looks like contoso.sharepoint.com,<guid>,<guid> – copy that whole value.

Then grant the application write access to that site:

POST https://graph.microsoft.com/v1.0/sites/<the-id-you-copied>/permissions
Content-Type: application/json

{
  "roles": ["write"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "<Application (client) ID from Step 2>",
        "displayName": "Cloudockit SharePoint Drop-off"
      }
    }
  ]
}

write is enough for drop-off (creating folders and uploading files). Repeat this call for every site you want Cloudockit to drop documents into.

Step 5 – Configure drop-off in Cloudockit

In Cloudockit, open the SharePoint Online / Teams drop-off settings and fill in:

Click Validate to confirm the connection. Once validated, you’re ready to have Cloudockit drop documents into that library.

Zipped vs. unzipped: by default some reports are bundled into a ZIP file. Enable “Do not zip the documents” to have Cloudockit place those reports in a folder inside the library / specified folder instead.

Notes & troubleshooting

• Tenant ID is now required. If you are updating an older configuration and don’t see a value in the Tenant ID field, that configuration predates the new flow – re-enter all the fields from a freshly registered Entra ID application.
• No user account is involved. This is app-only authentication – there is no username/password and no MFA prompt. The connection relies solely on the client ID, tenant ID and client secret.
• IsSharePointAddInsDisabled / DisableCustomAppAuthentication no longer matter for Cloudockit drop-off. Those flags controlled the old ACS model, which is retired.
• “Access denied” after setup almost always means the per-site grant (Step 4b) was missed for that specific site, or admin consent (Step 4a) wasn’t granted. Both are required.
• Client secret expiry silently breaks drop-off on the next scheduled run. Rotate the secret in Entra ID and update it in Cloudockit before the expiration date.

References

• Azure ACS retirement announcement
• SharePoint Add-in retirement announcement
• Microsoft Graph Sites.Selected overview