Set up Delegated mode

Delegated mode attributes uploads to the signed-in Salesforce user instead of an anonymous app principal. Follow this after Create the Salesforce credentials.

Start there, not here. The SharePoint_Graph_User External Credential and the SharePoint_Microsoft Auth Provider below do not exist until Create SharePoint Credentials has been run with the Authentication Mode set to User Sign-In. The Integration User prerequisites apply to this mode too.

Delegated mode requests Sites.Selected and offline_access, with no tenant-wide Sites.Read.All or Files.ReadWrite.All. It relies on the per-site write grant for access, the same way Service Principal mode reaches files. The delegated token is then intersected with the signed-in user’s own SharePoint permissions, so access is the narrowest of the two modes.

1. Configure the Auth Provider

1. Setup → Auth. Providers → SharePoint (Microsoft Graph) → Edit.
2. Set:
   • Consumer Key = Microsoft app Client ID
   • Consumer Secret = Microsoft app Client Secret
   • Authorize Endpoint URL = https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/authorize
   • Token Endpoint URL = https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/token
3. Save.
4. The Auth Provider detail page now shows a Callback URL, for example https://<orgDomain>/services/authcallback/SharePoint_Microsoft. Copy it.

2. Register the callback in Microsoft

You now hand the Salesforce Callback URL back to Microsoft so Entra will accept the sign-in redirect. The thing to know up front: Microsoft calls this a “Redirect URI”, Salesforce calls it a “Callback URL”, and they are the same value. There is no field literally labelled “Callback URL” in Azure, which is what trips most people up. You are looking for Redirect URI.

1. In the Azure Portal, open Microsoft Entra ID → App registrations and click into your Sliick app registration.
2. In the left sidebar, click Authentication.
3. Add the redirect URI:
   • If the page shows no platforms yet: click + Add a platform, choose the Web tile, paste the Salesforce Callback URL into the Redirect URIs box, and click Configure.
   • If a “Web” platform already exists: find the Web → Redirect URIs section, click Add URI, paste the Callback URL, and click Save at the top.

Pick the “Web” platform, not the others. Azure offers “Single-page application (SPA)” and “Mobile and desktop applications” tiles too. Salesforce signs in with a server-side flow that uses a client secret, which is the Web type. Choosing SPA changes how tokens are issued and the sign-in will fail.

The URL must match exactly. Same https://, same host, same casing, and no trailing slash. Paste it, do not retype it. A mismatch shows up at sign-in as AADSTS50011: The redirect URI ... does not match the redirect URIs configured.

3. Per-user sign-in

Each Salesforce user who needs SharePoint access does this once:

1. From the user’s avatar menu → Settings → My Personal Information → Advanced User Details.
2. Scroll to Authentication Settings for External Systems → New.
3. Choose:
   • External System Definition Type = External Credential
   • External System Definition = SharePoint_Graph_User
   • Per-User Principal = the Per_User principal
4. Save. Salesforce redirects to Microsoft sign-in. Complete the prompt and grant the listed permissions.
5. After the redirect back to Salesforce, the row shows status Configured / Authenticated.

The Sliick Files setup app has an Open Microsoft Sign-In (Personal Settings) button that opens the Personal Settings page directly, to shortcut steps 1 to 3.

Verify

Switch the Sliick Settings auth mode to User Sign-In. Click Open Microsoft Sign-In, complete sign-in for your own user if you have not already, then click Discover Site and Libraries.

With Sites.Selected, access is the intersection of the app’s per-site grant and your own SharePoint access. Enter the single granted Site URL, and it resolves only if you can also reach it in SharePoint. An ungranted site, or one you personally cannot reach, returns access-denied.

How Delegated mode behaves day to day

Delegated mode is a per-user product, and that changes several things your users will notice:

• Every file operation runs under the viewing user’s own SharePoint access. The file list, the gallery and the attach picker only show files that person’s sign-in can actually see. Someone who has not completed the Microsoft sign-in gets a “Sign in to Microsoft” instruction instead of a file list.
• Viewing a record is the pull. Opening the file list or gallery reconciles that record’s folder under the viewing user’s identity, at most about once every five minutes per record. The Refresh button forces it immediately.
• The pull never deletes. A file missing from one person’s view may simply be invisible to them, so deletions made directly in SharePoint do not propagate in this mode. Remove the row in Salesforce instead, or have an administrator reconcile it.
• Two-way sync is unavailable. The toggle is disabled with an explanation, and sync is treated as off even if it was left on by an earlier Service Principal configuration.
• Internal org only. Experience Cloud users cannot complete the per-user sign-in flow.

Next: Connect in Sliick Settings.