Configuration guide

Certificate-Based Authentication

Set up SharePoint connector using certificate-based authentication with optional permission sync support

Before you begin

Availability depends on your school's enabled tools, provider setup, and account permissions. These settings are managed in the web workspace. A class policy may restrict a feature described here. Some options require a separately licensed feature. The presence of a guide does not unlock that feature.

Certificate-Based Authentication#

Certificate-based authentication provides a secure way to connect to SharePoint and supports both basic integration and permission sync functionality.

Use certificate authentication when:

You need permission sync capabilities
You prefer certificate-based security over client secrets
Your organization requires certificate-based authentication

For basic SharePoint integration without permission sync, you can also use client secret authentication.

Setting up#

Step 1: Create Azure App Registration#

Open Azure Portal#

Open App registrations#

Navigate to "App registrations" using the search bar.

Create registration#

Click New Registration.

Name and register app#

Name it something like "Nexus SharePoint Connector - Certificate", leave everything else as default, and click Register.

Save IDs#

Under "Essentials" in the overview tab, you will find the Application (client) ID and Directory (tenant) ID. Save those for later.

Step 2: Generate and Upload Certificate#

Option A: Generate Self-Signed Certificate#

# Generate private key
openssl genrsa -out sharepoint-cert.key 2048

# Generate certificate signing request
openssl req -new -key sharepoint-cert.key -out sharepoint-cert.csr

# Generate self-signed certificate (valid for 1 year)
openssl x509 -req -days 365 -in sharepoint-cert.csr -signkey sharepoint-cert.key -out sharepoint-cert.crt

# Convert to PFX format
openssl pkcs12 -export -out sharepoint-cert.pfx -inkey sharepoint-cert.key -in sharepoint-cert.crt

Option B: Use Organization Certificate#

Obtain a certificate from your school's Certificate Authority (CA) following your internal security policies.

We only support PFX format for certificate uploads in Azure.

Step 3: Upload Certificate to Azure#

Open Certificates & secrets#

In your Azure App Registration, navigate to the "Certificates & secrets" tab.

Upload certificate#

Click Upload certificate.

Select file#

Select your certificate file (.crt, .pem, or .cer format).

Add certificate#

Add a description and click Add.

Step 4: Configure API Permissions#

Open API Permissions#

Navigate to the "API Permissions" tab in the Azure Portal.

Add a permission#

Click Add a permission.

Basic Permissions (No Permission Sync)#

If you are not planning to enable permission sync, you only need basic permissions:

Choose Microsoft Graph#

Click Microsoft Graph, then click on Application permissions.

Select Sites.Read.All#

Navigate to the "Sites" permission group. Select the checkbox for Sites.Read.All.

Advanced: If you want to limit the sites this app has access to, select Sites.Selected. However, if you do this, you will need to add the App you are currently registering to each site you want to index.

How to grant site-specific access#

If you selected **Sites.Selected**, you need to grant your app **read** access to each site you want to index.

The steps below use [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer),
but you can also grant site permissions using:

* [PnP PowerShell](https://pnp.github.io/powershell/cmdlets/Grant-PnPAzureADAppSitePermission.html) (`Grant-PnPAzureADAppSitePermission` cmdlet)
* [Resource Specific Consent guide](https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins-modernize/understanding-rsc-for-msgraph-and-sharepoint-online)

To use Graph Explorer, complete these steps:

    Sign in with a **Global Admin** or **SharePoint Admin** account.

    Click your profile icon → **Consent to permissions** → enable **Sites.FullControl.All**.
    This grants Graph Explorer (not your Nexus app) permission to manage site access.

Get the site ID#

    Run a **GET** request, replacing `{tenant}` and `YourSiteName`:

        GET https://graph.microsoft.com/v1.0/sites/{tenant}.sharepoint.com:/sites/YourSiteName?$select=id

    Copy the `id` from the response (format: `onyx.sharepoint.com,guid1,guid2`).

Grant Read permission#

    Change the method to **POST**:

        POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

    Request body:

        {
          "roles": ["read"],
          "grantedToIdentitiesV2": [{
            "application": {
              "id": "<Nexus App Client ID>",
              "displayName": "Nexus SharePoint Connector"
            }
          }]
        }

Verify#

    Change the method to **GET**:

        GET https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

    Confirm `"roles": ["read"]` appears for the Nexus app.
  


Repeat steps 3-5 for each site you want to index.

Add and grant#

Click Add permissions. Finally, click Grant admin consent for <Organization name> and click Confirm.

Extended Permissions (With Permission Sync)#

If you plan to enable permission sync, you'll need additional permissions:

Add another permission#

Click Add a permission again.

Microsoft Graph application permissions#

Click Microsoft Graph, then click on Application permissions. Add the following additional Microsoft Graph permissions:

Directory.Read.All - Used to query the overall organizational directory structure, including how users, groups, organizational units, and other directory objects relate to each other.
Group.Read.All - Used to read detailed group-specific information such as group properties, settings, types (Security vs Microsoft 365), and configurations.
GroupMember.Read.All - Used to retrieve and expand all members within a group, including nested group memberships. This allows Nexus to determine which users have access to SharePoint content through group membership.
Member.Read.Hidden - Allows reading memberships of security groups that are marked as "hidden" in Entra ID.
User.Read.All - Used to retrieve complete user profiles and enumerate all users in the directory. Click Add permissions.

Microsoft Graph delegated permission#

Click Add a permission again in API Permissions tab. Click Microsoft Graph, then click on Delegated permissions. Add the following delegated permission:

User.Read - This delegated permission allows the application to sign in on behalf of a user and read the signed-in user's basic profile information. Unlike application permissions which work without a user context, this delegated permission is required when the app needs to establish an authenticated identity context for making API calls to Microsoft Graph and SharePoint. It provides the minimum required access for user authentication flows. Click Add permissions.

SharePoint application permissions#

Click Add a permission again in API Permissions tab. Click SharePoint, then click on Application permissions. Add the following SharePoint permissions:

Sites.FullControl.All - Despite the name, Nexus only uses this to retrieve details about permissions. No write operations are performed. If you selected Sites.Selected and need to grant fullcontrol only for specific sites, see the Using Sites.Selected with Permission Sync section below.
User.Read.All - Used to list all users within the directory for permission mapping. Click Add permissions.

Finally, click Grant admin consent for <Organization name> and click Confirm.

Using Sites.Selected with Permission Sync#

If you selected Sites.Selected instead of Sites.Read.All and plan to enable permission sync, you need to grant your app fullcontrol access to each site.

The steps below use Microsoft Graph Explorer, but you can also grant site permissions using:

PnP PowerShell (Grant-PnPAzureADAppSitePermission cmdlet)
Resource Specific Consent guide

To use Graph Explorer, complete these steps:

Sign in with a **Global Admin** or **SharePoint Admin** account.

Click your profile icon → **Consent to permissions** → enable **Sites.FullControl.All**.
This grants Graph Explorer (not your Nexus app) permission to manage site access.

Get the site ID#

Run a **GET** request, replacing `{tenant}` and `YourSiteName`:

    GET https://graph.microsoft.com/v1.0/sites/{tenant}.sharepoint.com:/sites/YourSiteName?$select=id

Copy the `id` from the response (format: `onyx.sharepoint.com,guid1,guid2`).

Grant FullControl permission#

Change the method to **POST**:

    POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

Request body:

    {
      "roles": ["fullcontrol"],
      "grantedToIdentitiesV2": [{
        "application": {
          "id": "<Nexus App Client ID>",
          "displayName": "Nexus SharePoint Connector"
        }
      }]
    }

Verify#

Change the method to **GET**:

    GET https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

Confirm `"roles": ["fullcontrol"]` appears for the Nexus app.

Repeat steps 3-5 for each site you want to index.

Step 5: Configure in Nexus#

Open SharePoint connector#

Navigate to the Nexus Admin Panel and select the SharePoint Connector.

Create Certificate credential#

Click Create New credential and select the Certificate tab.

Enter credential details#

Application (client) ID from Step 1
Directory (tenant) ID from Step 1
Certificate File: Upload your certificate file (.pfx file)
Certificate Password: Enter password which you used to export the certificate file

Save credentials#

Click Create to save your credentials.

Step 6: Enable Permission Sync (Optional)#

When creating your SharePoint connector with certificate authentication:

Locate Permission Sync option#

In the connector configuration, you'll see a Permission Sync option.

Enable Permission Sync#

Enable this option to synchronize SharePoint permissions with Nexus.

Permission sync is available only on Cloud and the Enterprise Edition of Nexus.

Permission Sync Details#

When permission sync is enabled:

Document-level permissions: Nexus will respect SharePoint document permissions
Site-level permissions: Users will only see documents from sites they have access to
Group permissions: SharePoint group memberships are synchronized
Real-time sync: Permissions are updated regularly to reflect SharePoint changes

For basic SharePoint integration without permission sync, you can use client secret authentication.

Before using this source with students#

Start with approved course material. Check which documents the connector can retrieve and how it maps source permissions. Test with a student account and a teacher account before widening access. A successful sync does not prove that the intended class boundary is correct.

Use source troubleshooting when a document is missing or visible to the wrong audience.