Configuration guide

Client Secret Authentication

Set up SharePoint connector using client secret authentication

Before you begin

Availability depends on your school's enabled tools, provider setup, and account permissions. These settings are managed in the web workspace. A class policy may restrict a feature described here.

Client Secret Authentication#

Client secret authentication uses traditional Azure App Registration credentials to connect to SharePoint. This method is suitable for most basic SharePoint integrations.

Note: Permission sync is not available with client secret authentication. Use certificate-based authentication if you need permission sync functionality.

Setting up#

Step 1: Create Azure App Registration#

More detailed instructions can be found following the video below.

Open Azure Portal#

Open App registrations#

Navigate to "App registrations" using the search bar.

Create registration#

Click New Registration.

Name and register app#

Name it something like "Nexus SharePoint Connector", leave everything else as default, and click Register.

Save IDs#

Under "Essentials" in the overview tab, you will find the Application (client) ID and Directory (tenant) ID. Save those for later.

Step 2: Create Client Secret#

Open Certificates & secrets#

Navigate to the "Certificates & secrets" tab in Azure Portal.

Create secret#

Click New client secret.

Set expiration#

Fill out the description, set the expiration to 24 months, and click Add.

Copy secret value#

Copy the secret value in the Value column for later.

Important: Make sure to copy the secret value immediately as it won't be visible again.

Step 3: Configure API Permissions#

Two separate API permissions are required:

Permission	Provider	Type	Purpose
`Sites.Read.All`	Microsoft Graph	Application	Read documents and site pages
`Sites.FullControl.All`	SharePoint	Application	Read document role assignments during pruning

Despite its name, Sites.FullControl.All is read-only in Nexus. No write operations are performed.

Open API Permissions#

Navigate to the "API Permissions" tab in the Azure Portal.

Add Microsoft Graph permission#

Click Add a permission → Microsoft Graph → Application permissions.

Navigate to the "Sites" permission group and select Sites.Read.All.

Advanced: If you want to limit the sites this app has access to, select Sites.Selected. However, if you do this, you will need to add the App you are currently registering to each site you want to index.

How to grant site-specific access#

If you selected **Sites.Selected**, you need to grant your app **read** access to each site you want to index.

The steps below use [Microsoft Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer),
but you can also grant site permissions using:

* [PnP PowerShell](https://pnp.github.io/powershell/cmdlets/Grant-PnPAzureADAppSitePermission.html) (`Grant-PnPAzureADAppSitePermission` cmdlet)
* [Resource Specific Consent guide](https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins-modernize/understanding-rsc-for-msgraph-and-sharepoint-online)

To use Graph Explorer, complete these steps:

    Sign in with a **Global Admin** or **SharePoint Admin** account.

    Click your profile icon → **Consent to permissions** → enable **Sites.FullControl.All**.
    This grants Graph Explorer (not your Nexus app) permission to manage site access.

Get the site ID#

    Run a **GET** request, replacing `{tenant}` and `YourSiteName`:

        GET https://graph.microsoft.com/v1.0/sites/{tenant}.sharepoint.com:/sites/YourSiteName?$select=id

    Copy the `id` from the response (format: `contoso.sharepoint.com,guid1,guid2`).

Grant Read permission#

    Change the method to **POST**:

        POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

    Request body:

        {
          "roles": ["read"],
          "grantedToIdentitiesV2": [{
            "application": {
              "id": "<Nexus App Client ID>",
              "displayName": "Nexus SharePoint Connector"
            }
          }]
        }

Verify#

    Change the method to **GET**:

        GET https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

    Confirm `"roles": ["read"]` appears for the Nexus app.
  


Repeat steps 3-5 for each site you want to index.

Click Add permissions.

Add SharePoint permission#

Click Add a permission again → SharePoint → Application permissions.

Navigate to the "Sites" permission group and select Sites.FullControl.All.

Click Add permissions.

Click Grant admin consent for <Organization name> (located next to Add a permission) and click Confirm.

Step 4: Configure in Nexus#

Open SharePoint connector#

Navigate to the Nexus Admin Panel and select the SharePoint Connector.

Create Client Secret credential#

Click Create New credential and select the Client Secret tab.

Enter credential details#

Application (client) ID from Step 1
Directory (tenant) ID from Step 1
Client Secret Value from Step 2

Save credentials#

Click Create to save your credentials.

For permission sync capabilities, consider using certificate-based authentication.

Before using this source with students#

Start with approved course material. Check which documents the connector can retrieve and how it maps source permissions. Test with a student account and a teacher account before widening access. A successful sync does not prove that the intended class boundary is correct.

Use source troubleshooting when a document is missing or visible to the wrong audience.