Connect SharePoint

Connecting SharePoint lets Contextflo read CSV files from one of your SharePoint sites and make them queryable with natural language. You connect a site once for your whole organization; after that, anyone on your team can use those files.

The model, up front:

• Read-only, one site. Contextflo uses Microsoft's Sites.Selected permission, so it can read only the single site you grant, nothing else in your tenant.
• No credentials shared. You never give Contextflo a login or password. Access is an app permission you grant inside your own Microsoft tenant, and you can revoke it any time.

Who does what

Two roles, which may be the same person:

• The person connecting in Contextflo starts and finishes the flow (Parts 1 and 4).
• A Microsoft 365 / SharePoint admin does the one-time grant (Parts 2 and 3). If that is not you, send them this page, they can do it whenever, and you finish afterward.

Parts 2 and 3 are not time-bound: IT can do them minutes or days later and the final Verify still works, with nothing to repeat.

Prerequisites

• A Microsoft 365 tenant admin (to approve the app) and someone with site-owner / SharePoint-admin rights (to grant the site).
• The SharePoint site URL you want to connect, for example https://contoso.sharepoint.com/sites/DataTeam.

Part 1: Start the connection (in Contextflo)

1. Go to Data Sources → Files → Add from SharePoint.
2. Paste your site URL (we work out your Microsoft tenant from it, no separate tenant ID needed).
3. Click Continue to Microsoft. An admin signs in and approves Contextflo for your tenant.

What this does: admin consent gives the Contextflo app the ability to be granted sites (Sites.Selected). It grants access to no sites yet, that happens in Part 3.

You return to Contextflo, which now shows a pending "grant access" step.

Part 2: Set up PnP PowerShell (IT, one-time)

PnP PowerShell is a standard Microsoft-community admin tool. To use it, you register a small sign-in app in your own tenant so PowerShell can act as an admin. This app is yours (not Contextflo's) and is reusable for future admin tasks.

Loading code sample...

The last command prints an AzureAppId / ClientId (a GUID). Copy it, you will use it in Part 3.

What this does: creates a "PnP Management Shell" app in your tenant and authenticates you, so PowerShell can manage SharePoint as an admin. This step has nothing to do with Contextflo yet.

Part 3: Grant Contextflo read access to the site (IT, one-time)

This grants the Contextflo application read-only access to just this one site.

Loading code sample...

What this does: binds Contextflo's app to that one site with Read permission. Contextflo can now read files there, and only there. 69122bcc-520d-453b-9316-77ed9ae9e038 is Contextflo's connector application ID (the same for every customer).

Part 4: Verify (in Contextflo)

Back in the Contextflo modal, click Verify access. Contextflo confirms it can read the site and the connection flips to Connected.

You can close Contextflo and come back to Verify any time after IT finishes Part 3, the grant does not expire and IT never has to repeat it.

Security and scope

• Scope: limited to the single site you grant (Sites.Selected). Contextflo cannot see any other SharePoint site.
• Read-only: -Permissions Read. Contextflo never writes to your SharePoint.
• No shared credentials: the grant is an app permission in your tenant, not a login.
• Revoke any time with Revoke-PnPAzureADAppSitePermission, or remove the permission from the site in your tenant.
• Contextflo connector app ID: 69122bcc-520d-453b-9316-77ed9ae9e038.

Troubleshooting

• A parameter cannot be found that matches parameter name 'Interactive' on Register-PnPEntraIDAppForInteractiveLogin: remove -Interactive, that command logs in interactively by default.
• Connect-PnPOnline says the app cannot be found: the sign-in app from Part 2 needs a moment to propagate. Wait about 30 seconds and retry.
• Verify says "No access to the site yet": Part 3 is not complete or has not propagated. Wait a few seconds and Verify again; IT does not need to repeat anything.
• Grant-PnPAzureADAppSitePermission fails with insufficient privileges: the "PnP Management Shell" app needs admin consent for its own permissions. A Global Admin consents to it once in Microsoft Entra, then re-run the grant.