Authorize with an organization account
- Open Spaces > Connections > Microsoft and start the connection.
- Sign in and review the requested Microsoft permissions.
- If your tenant requires administrator consent, submit the request. After the Entra administrator approves it, repeat the sign-in step to finish connecting.
- Select the sites and files to synchronize.
Files.Read.All, Sites.Read.All, User.Read, and offline_access to read files and sites, identify the user, and refresh access. Use the application identity and callback shown in your Counso setup; they belong to that deployment.
A dedicated integration account makes ongoing access easier to manage. Its direct and inherited group memberships determine the available SharePoint sites and Teams-backed files. Review public sites, private sites where the account is a member, and standard, shared, or private Teams channels it belongs to. Selecting content in Counso does not replace Microsoft permissions.
Authorize with a service principal
If the connection offers service-principal authentication, create an Entra app registration, grant the appropriate Microsoft Graph application permissions, obtain administrator consent, and create a client secret. Enter its tenant ID, client ID, and secret value in Counso. For access restricted to particular sites, useSites.Selected and explicitly grant the application access to each selected site. Consent alone grants no site access. Enter the allowed site IDs in the connection when requested. Do not mix this app-only flow with the delegated permissions used for an interactive user. See Microsoft’s selected-permission model for the site assignment steps.