Choosing an authentication mode
SharePoint is the only storage provider where you also choose how Sliick signs in to Microsoft. Decide this before you start, because the Microsoft setup and the Salesforce setup both branch on it.
The two modes
Section titled “The two modes”| Service Principal | Delegated | |
|---|---|---|
| Who signs in | The app signs in as itself, with no user context | Each Salesforce user signs in to Microsoft once |
| Microsoft Graph permission | Sites.Selected, Application type | Sites.Selected and offline_access, Delegated type |
| Who SharePoint records as the author | The app | The signed-in person |
| Access scope | The per-site grant you make in Microsoft | The per-site grant, narrowed further to what that person can already reach in SharePoint |
| Adding another SharePoint site | Needs a per-site grant in Microsoft Graph | Needs the same per-site grant, and the person also has to be able to reach the site themselves |
| Per-user setup in Salesforce | None | Each user signs in once from their personal settings |
| Two-way sync | Available | Not available. The toggle is disabled |
Which one to pick
Section titled “Which one to pick”Service Principal is the path most orgs use. The app authenticates to Microsoft on its own, so no individual Salesforce user has to sign in and there is nothing for your users to do.
Delegated mode is right when you need uploads attributed to the signed-in Salesforce user instead of an anonymous app principal, for example when SharePoint audit trails have to show the human.
Both modes use per-app, per-site Sites.Selected grants, so the choice is about
attribution, not about how much SharePoint the app can reach.
Two things rule Delegated mode out. It cannot use two-way sync, because org-wide sync needs one fully privileged identity that per-user sign-ins cannot provide. And it is internal org only: Experience Cloud users cannot complete the Microsoft sign-in.
What the choice changes
Section titled “What the choice changes”The Microsoft app registration is nearly identical for both. The permission type you add differs (Application versus Delegated), and Delegated mode also needs a redirect URI registered in Microsoft.
On the Salesforce side, the mode you select before clicking Create SharePoint Credentials decides which credentials get created, so pick it first.
Next: Register the app in Entra ID.