Set up Service Principal mode

The path most orgs use: the app authenticates to Microsoft on its own, and no individual Salesforce user has to sign in. Follow this after Create the Salesforce credentials, because the credential you edit here does not exist until then.

1. Point the credential at your tenant

1. In Setup, Quick Find for Named Credentials. On the External Credentials tab, click into SharePoint Graph (App). Find the Authentication Parameters section.

2. Click the dropdown next to the AuthProviderUrl row, then Edit. Change its value from the deployed default https://login.microsoftonline.com/common/oauth2/v2.0/token to your tenant-scoped form, pasting your Tenant ID:

   https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/token

   The default /common/ endpoint works for multi-tenant apps. Sliick is single-tenant, so pin it to your tenant explicitly.

2. Configure the App_Only principal

1. On the same page, scroll to the Principals section. Click the dropdown next to the App_Only row, then Edit / Configure. Set:

   • Username = Microsoft app Client ID
   • Password = Microsoft app Client Secret

   The Username and Password labels are misleading: these are not a person’s credentials. They are the OAuth client_id and client_secret pair that Salesforce sends to Microsoft when requesting an access token.

2. Save.

3. Grant your users access to the credential

Because the credential is created at connect time, no packaged permission set can reference it. Add the grant on a permission set you control and assign it to anyone who will use Sliick Files, admins included.

1. Setup → Quick Find for Permission Sets → open (or create) a permission set you manage for storage users.
2. Under External Credential Principal Access, add the SharePoint Graph (App) principal (sliick__SharePoint_Graph_App-App_Only).
3. Click Manage Assignments → Add Assignment → check users → Next → Assign.

The Auth Provider SharePoint_Microsoft is not used by Service Principal mode. If you are only running this mode, you can leave it unconfigured.

Verify

In Sliick Settings, pick SharePoint, set Authentication Mode to Service Principal, paste a SharePoint Site URL you granted in Grant access to the SharePoint site, and click Discover Site and Libraries. The site and its document libraries list within a few seconds. If discovery fails, the error text tells you which step is misconfigured: a Microsoft 401 or 403 versus a Salesforce “isn’t fully configured”.

Next: Connect in Sliick Settings.