SharePoint and OneDrive Sync Administrator Setup | Axero Documentation

Introduction

The steps below configure the Microsoft SharePoint and Microsoft OneDrive integration with Axero. This integration syncs files both ways between your Axero platform and Microsoft 365, so people can open, upload, and manage their files from either side.

The setup takes approximately 1 hour and requires a system administrator with one of the Microsoft Entra ID roles listed under Prerequisites. After setup, users can connect their SharePoint and OneDrive accounts from within the Axero platform.

For end-user setup instructions, see SharePoint and OneDrive Sync User Setup.

Overview

• Introduction
• Prerequisites
• Step 1: Configure Entra App Registration
• Step 2: Configure Axero Integration
• Step 3: Configure External Drive Connections
• Step 4: Configure File Download Permissions (Optional)
• Verify Your Setup
• Troubleshooting
• Maintenance
• Microsoft documentation and user setup
• Support and Feedback

Prerequisites

Before you start, ensure you have:

• Cloud Application Administrator, Application Administrator, or Global Administrator role in Microsoft Entra ID
• Site Administrator access to your Axero platform
• Access to your organization's Microsoft 365 tenant

Step 1: Configure Entra App Registration

1.1 Create the App Registration

1. Sign in to the Microsoft Entra admin center using an account with Cloud Application Administrator, Application Administrator, or Global Administrator permissions.
2. Navigate to Entra ID > App registrations.
3. Select New registration.
4. Enter a descriptive name for your application (e.g., "Axero SharePoint Integration").
5. Under Supported account types, select Single tenant only.

6. Under Redirect URI, select Web as the platform and enter your Axero site URL followed by /oauth2/sharepoint/callback
   
   Example: https://your-site.com/oauth2/sharepoint/callback

   Important: The Redirect URI must use HTTPS and match your Axero URL exactly, including path and casing. Do not include a trailing slash or trailing spaces.

7. Select Register to create the application.
8. On the app's Overview page, copy and securely store the Application (client) ID and Directory (tenant) ID for later use.

1.2 Configure Authentication Credentials

1. In the left navigation, select Certificates & secrets.
2. Under Client secrets, select New client secret.
3. Enter a meaningful Description (e.g., "Axero Integration Secret").
4. Under Expires, select an expiration period. Microsoft recommends an expiration of less than 12 months, and a secret can last no longer than 24 months.
5. Select Add.
6. Immediately copy the client secret Value (not the Secret ID). This value is only displayed once and cannot be retrieved later.

1.3 Configure API Permissions

1. In the left navigation, select API permissions.
2. Select Add a permission.
3. Select Microsoft Graph.
4. Select Delegated permissions and add the following:
   • Files.ReadWrite.All: Read, create, update, and delete files the signed-in user can access in SharePoint and OneDrive
   • offline_access: Maintain access when users are not actively signed in, enabling automatic background synchronization
   • openid: Authenticate users and return an ID token through Microsoft's identity platform
   • profile: Read basic profile information to associate Microsoft accounts with Axero platform users
   • Sites.Read.All: Read SharePoint site properties and document libraries the signed-in user can access
   • User.Read: Read the signed-in user's profile to verify identity for secure account linking
5. Select Add permissions.
6. Select Add a permission again.
7. Select Microsoft Graph.
8. Select Application permissions and add:
   • Files.Read.All: Read files from all SharePoint sites and OneDrive accounts without a signed-in user, required for background synchronization tasks. Search also depends on it. To read the words inside a SharePoint file for full-text search, Axero tries this application credential first. It falls back to the token of a user connected to the account only if that fails. While the application credential works, search keeps finding words inside SharePoint files no matter who authenticated each drive. That holds even on drives whose connecting account has since left. The credential covers only the text inside files, not whether a file is in the index at all. A file's basic search entry is rebuilt from Axero's own database and needs no Microsoft credential. So when files have dropped out of search, a search index rebuild brings them back; a credential change doesn't. Axero tries the application credential for SharePoint drives only. OneDrive content always uses a connected user's token.
9. Select Add permissions.
10. Select Grant admin consent for [Your Organization] (where [Your Organization] is your Microsoft 365 tenant name) to pre-approve these permissions for all users. Individual users then aren't asked to grant consent themselves.
11. In the confirmation dialog, select Yes. Check that every permission shows a green checkmark under the Status column. That confirms consent was granted.

Step 2: Configure Axero Integration

1. In your Axero platform, navigate to Control Panel > System > Integrations.
2. Locate the Office 365 section and select Connect.
3. Enter the following information from your Entra ID app registration:
   • Tenant ID: The Directory (tenant) ID copied earlier
   • App Client Id: The Application (client) ID copied earlier
   • App Client Secret: The client secret value copied earlier
4. Select where users can access the SharePoint and OneDrive integration. You may enable multiple options:
   • Available in top level community: Users can access external drives by navigating to Browse > Files
   • Available in Spaces: Space administrators can add SharePoint or OneDrive drives from within any space they manage
   • Available in Personal Connect: Individual users can connect their own SharePoint or OneDrive accounts through My Content > Files
5. Select Save Settings to complete the integration configuration.

Step 3: Configure External Drive Connections

Option 1: Platform-Wide or Space-Specific Access

1. Navigate to Control Panel > System > External Drives (platform-wide) or Manage Space > External Drives (space-specific).
2. Select Add External Drives.
3. Select either SharePoint or OneDrive, depending on which one you're connecting.
4. Enter a Display Name that users will see when accessing the external drive (e.g., "Company SharePoint" or "Team OneDrive").
5. Under Connected Account, select the Office 365 integration you configured in Step 2.
6. Select Connect to start the Microsoft sign-in.
7. A new browser tab opens for the Microsoft sign-in:
   • Sign in with an account that has access to the target SharePoint site or OneDrive. The drive connection gets the same access as the account you sign in with. Only content that account can open is available through the connection.
   • For shared drives, use a service account (one that doesn't belong to a single person) or a shared mailbox rather than an individual's account. If the signed-in user's access is revoked (e.g., they leave the organization), the drive connection stops working.
   • Review the requested permissions and select Accept.
   • Microsoft then sends you back to Axero automatically.

Complete the section below that matches the drive type you selected when adding the external drive:

For SharePoint Sites

1. Configure your SharePoint site connection:
   • Method 1: Select the folder icon to load available SharePoint sites, then select your desired site from the dropdown menu
   • Method 2: Paste the SharePoint site URL directly and select the refresh icon to validate the connection
2. Under Drives, select the specific document library you want to sync (typically "Documents" or a custom library name).
3. Select Save Settings to complete the configuration.

For OneDrive

You don't need to pick a site. The drive connects directly to the OneDrive storage of the account you signed in with.

Option 2: Personal My Files Access

To enable personal My Files access, configure the following system property:

1. Navigate to Control Panel > System > System Properties.
2. Locate the ShowNewMyAccountFilesView property (default: false).
3. Set the value to true.
4. Select Save.

Once enabled, users can connect to SharePoint or OneDrive through My Content > Files.

Step 4: Configure File Download Permissions (Optional)

By default, users cannot download files from external drives to their local devices. To let users download SharePoint and OneDrive files, turn on this setting:

1. Navigate to Control Panel > System > System Properties.
2. Locate the EnableDownloadExternalFile property (default: false).
3. Set the value to true to allow users to download external drive files to their local devices. Users can always view and upload files through the web interface regardless of this setting.
4. Select Save.

Verify Your Setup

After setup, check that the integration works:

1. Navigate to the location where you configured the external drive (e.g., Browse > Files for platform-wide access, or the specific space).
2. Confirm the external drive appears in the file list with the display name you configured.
3. Open the drive and select Connect to verify that SharePoint or OneDrive files sync successfully.
4. Test uploading a small file from Axero and confirm it appears in the corresponding SharePoint document library or OneDrive folder.

If the drive does not appear or files fail to load, see the Troubleshooting section below.

Troubleshooting

Authentication Issues

"Invalid redirect URI" error

Verify the redirect URI in Entra exactly matches your Axero site URL with the /oauth2/sharepoint/callback path.

"Insufficient permissions" error

Confirm admin consent was granted for all required Microsoft Graph permissions.

"Application not found" error

Verify the Application (client) ID is correct and the app registration exists.

Authentication suddenly stopped working

Check whether the client secret has expired in Entra. See the Rotating Client Secrets section for renewal steps.

Connection Issues

Unable to connect to SharePoint sites

Verify the connecting user has at least read access to the SharePoint site.

Drive stopped working after staff change

If the account used to authenticate the drive connection has been disabled or lost access, the connection fails silently. Re-authenticate with an active account under Control Panel > System > External Drives.

Files disappear from search and from Content widgets while the drive still appears connected

The drive still appears and its files still list, but a homepage widget goes empty. Axero reads synced file contents in the background through the integration's credentials. When that credential stops working, the files drop out of the search index and out of every Content List widget pointed at them, while the drive listing stays as it was. Check the exception log (Axero's record of errors) and the client secret's expiry in Entra, not the drive view. Then rebuild the search index. That is what brings the files back into results and refills the widgets. Reconnecting the drive is not the repair. Removing and re-adding one creates fresh file records that break anything pointing at the old ones, as described under Email Integration Conflicts below.

Files not syncing

Check for file name restrictions (special characters, path length) and verify file sizes are within supported limits. Axero sends every file to Microsoft in pieces through an upload session, so a file can be up to Microsoft's 250 GB limit, subject to your organization's tenant policy.

Integration not appearing in Axero

Verify the Office 365 integration shows a connected status under Control Panel > System > Integrations. If it shows as disconnected, re-enter the Tenant ID, Client ID, and Client Secret values from your Entra app registration.

Email Integration Conflicts

SharePoint drives disconnect after saving Office 365 email settings

This occurs when the SharePoint integration and the Office 365 email integration share the same connected account. Saving email settings (even without changes) or forced reauthentication after a password expiration refreshes the cached token for that connected account, overwriting the token SharePoint uses. To restore access, reconnect the affected external drives under Control Panel > System > External Drives. To stop it happening again, give email and SharePoint each their own Entra app registration and connected account (see Step 1: Configure Entra App Registration).

SharePoint drives disconnect after email user's password expires

When the Microsoft account used for the Office 365 email integration has a temporary or expiring password, the next required reauthentication refreshes the cached token for the shared connected account and invalidates the token SharePoint uses. Use a dedicated service mailbox with a permanent password and exclude it from password expiration policies.

Maintenance

Rotating Client Secrets

A client secret expires after the period you chose when you created it. To rotate (replace) a secret without interrupting service:

1. In the Entra admin center, navigate to Entra ID > App registrations and open your Axero integration app.
2. Under Certificates & secrets, select New client secret to create a replacement secret before the current one expires.
3. Copy the new secret value immediately.
4. In Axero, navigate to Control Panel > System > Integrations, open the Office 365 connection, and update the App Client Secret field with the new value.
5. Verify the connection is working, then delete the old secret from Entra.

Security Best Practices

• Set a calendar reminder to rotate client secrets at least two weeks before expiration.
• Periodically review which users have connected accounts and their access levels.
• Monitor API permission usage through Microsoft Entra audit logs.
• If your organization uses Conditional Access policies, make sure they don't block the OAuth callback flow (the step where Microsoft sends the sign-in back) to your Axero domain.

Sync Behavior

• Files sync automatically on a recurring schedule; users can trigger manual sync from the drive view.
• Only changed files are synchronized after the initial setup.
• Axero sends every file to Microsoft in pieces through an upload session, so a file can be up to Microsoft's 250 GB limit, subject to your organization's tenant policy.

Removing the Integration

To fully remove the SharePoint and OneDrive integration:

1. In Axero: Navigate to Control Panel > System > External Drives and delete all SharePoint and OneDrive drive connections.
2. In Axero: Navigate to Control Panel > System > Integrations and disconnect the Office 365 integration.
3. In Entra: Navigate to Entra ID > App registrations, open the Axero integration app, and select Delete. This revokes all permissions and invalidates the client secret.

Microsoft documentation and user setup

• SharePoint and OneDrive Sync User Setup: End-user instructions for connecting accounts
• Microsoft Graph Permissions Reference: Full list of available Graph API permissions
• Microsoft Entra App Registration Best Practices

Support and Feedback

If you hit an issue not covered here, or a step could be clearer, let us know through a Support Case so we can help you and improve this guide.

Related pages

• SharePoint and OneDrive Sync User Setup (what each person does to connect their own account)
• Box Integration Administrator Setup (the same setup for Box)
• Google Drive Integration Administrator Setup (the same setup for Google Drive)
• Files (where the connected drive appears)
• My Files (where personal drives appear)
• Third-Party Integrations (the other services Axero connects to)
• Content List Widget (the widget that goes empty when synced files drop out of search)