Agentic Data Plane
Preview

SharePoint Managed MCP Server

The SharePoint managed MCP server lets agents read SharePoint sites, document libraries, lists, and files, upload files, and search content through the Microsoft Graph API. Each agent caller authenticates against Microsoft with their own identity through user-delegated OAuth, so every call stays bounded by the signed-in user’s own SharePoint permissions. The server never holds workspace-wide access.

After reading this page, you will be able to:

  • Register a Microsoft Entra app and an OAuth provider for the SharePoint managed MCP server

  • Create the SharePoint managed MCP server with the correct Microsoft Graph scopes

  • Authorize a user and run the SharePoint tools from the Inspector or an agent

The SharePoint managed MCP server is in Preview. If you don’t see SharePoint in the picker, contact Redpanda Support.

What this MCP server does

The SharePoint managed type wraps the Microsoft Graph API (https://graph.microsoft.com/v1.0) and authenticates per user through the gateway’s token vault. Per-user OAuth is the only authentication mode this type supports. It exposes these tools:

Tool What it does

list_sites

Search for SharePoint sites. The search term passes straight to Graph’s /sites?search= endpoint. Pass * to list every site, or a name fragment to narrow the search. Always pass a search term. Without one, the tool calls Graph’s list-all-sites endpoint, which Microsoft supports only with application permissions, not the delegated permissions this server uses.

get_site

Fetch a single site by composite ID (contoso.sharepoint.com,<guid>,<guid>) or hostname path (contoso.sharepoint.com:/sites/team).

list_drive_items

Browse a site’s default document library. Lists the library root by default. Pass folder_id to descend into a folder.

get_file_content

Read a file from a site’s document library as UTF-8 text, with its filename, MIME type, and size.

upload_file

Upload a text file to a site’s document library, into the root or a folder. Requires the Sites.ReadWrite.All scope.

search_content

Search across all SharePoint sites, files, and list items the user can see. The query supports Keyword Query Language (KQL).

list_lists

List the SharePoint lists on a site. Hidden lists are excluded.

list_list_items

List the items in a SharePoint list, with each item’s column values returned as JSON in fields_json.

The file tools operate on the site’s own default document library (/sites/<site-id>/drive/…​), never on a user’s personal OneDrive. File content travels as UTF-8 text in both directions. The server caps downloads through get_file_content at 10 MiB and uploads through upload_file at 4 MiB.

Reading a file that isn’t UTF-8 text, such as a PDF, an Office document, or an image, returns an error rather than garbled content, and the error carries the file’s SharePoint link so an agent can point a person at it. The server refuses a file it can recognize as binary from its type or size before it downloads anything, and refuses the rest after the download when the content turns out not to be text.

The list_sites, list_drive_items, and list_list_items tools return up to 100 items by default and accept a page_size of up to 999. The search_content tool returns up to 25 hits by default and accepts a page_size of up to 500. The list_lists tool takes no page_size.

Prerequisites

Before you create the server, make sure you have:

  • Access to a Microsoft SharePoint tenant.

  • Permission to register an app in the Microsoft Entra admin center (or an Entra admin who can register one for you).

  • A way to write the OAuth client secret into the Redpanda Agentic Data Plane secret store.

  • For most tenants, a tenant admin who can grant admin consent for the Microsoft Graph scopes. See Grant admin consent.

  • Familiarity with user-delegated OAuth.

Register the Microsoft Entra app

In the Microsoft Entra admin center, go to App registrations > New registration and create an app:

  1. Give the app a descriptive name, for example, Redpanda AI Gateway - SharePoint MCP.

  2. Set Supported account types to single tenant.

  3. Set the Redirect URI to platform Web with the gateway’s OAuth callback for your environment:

    https://aigw.<cluster-id>.clusters.rdpa.co/oauth/v1/callback

    The callback path is /oauth/v1/callback. To copy the exact URL for your environment, create the OAuth provider first and use the Authorization Callback URL shown on its detail page.

  4. After registering, note the Application (client) ID and Directory (tenant) ID from the app’s Overview page. You need both when you configure the OAuth provider.

Single-tenant apps must use the tenant-specific Microsoft OAuth endpoints (https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/…​;), not the /common/ endpoints, which can return AADSTS errors for single-tenant apps. Replace <tenant-id> with the Directory (tenant) ID from the app’s Overview page.

Add Microsoft Graph permissions

In the Microsoft Entra admin center, open the app’s Manage > API permissions, click Add a permission > Microsoft Graph > Delegated permissions, then add:

Scope Why

Sites.ReadWrite.All

Read and write everything the server touches: sites, document libraries, files, lists, and upload_file. For read-only deployments, use Sites.Read.All instead, which drops upload_file. Use the same scope in the Entra app, the OAuth provider, and the server’s Required Scopes.

offline_access

Issues refresh tokens so connections stay valid over time.

The openid, profile, email, and User.Read scopes come from the OAuth provider’s standard scopes.

Use the Microsoft Graph permissions, not the legacy Office 365 SharePoint Online API in the picker. The server calls Microsoft Graph only.

Use the Sites. scopes, not Files.. The server’s file and list endpoints all live under /sites/<site-id>/…​, and its site lookups and content search are also authorized by the Sites.* scopes. The Files.ReadWrite.All scope additionally grants access to users' personal OneDrive, which the server never uses.

Create a client secret

In the Microsoft Entra admin center, open the app’s Manage > Certificates & secrets and click New client secret. Give it a description, choose an expiry, and click Add. Copy the secret value immediately. Microsoft never shows it again.

Store the secret in the Agentic Data Plane secret store under an UPPER_SNAKE_CASE key, for example, SHAREPOINT_CLIENT_SECRET. The OAuth provider references the secret by name, so the plaintext never enters the MCP server configuration.

The SharePoint Graph scopes are high-privilege delegated scopes, so most tenants require a tenant admin to consent before any user can connect. A Global Administrator, Privileged Role Administrator, or Cloud Application Administrator opens the app, clicks Manage > API permissions, then clicks Grant admin consent for <org>.

Admin consent does not escalate access. Delegated scopes always stay bounded by the signed-in user’s own SharePoint permissions. Admin consent approves the app to request the scopes so that individual users aren’t each prompted. Without it, a non-admin user sees the Need admin approval message on the consent screen.

Configure the OAuth provider

Register an OAuth provider in Agentic Data Plane that points at Microsoft’s tenant-specific endpoints and references the client secret. See Configure an OAuth Provider. The Microsoft / Azure AD preset in the provider catalog fills in the endpoints, standard scopes, PKCE, and the token endpoint authentication method. For a single-tenant app, replace its /common/ endpoints with the tenant-specific ones. Use these values:

The provider page also shows the Authorization Callback URL to register as the Entra app’s redirect URI.

Create the server

Create a new SharePoint MCP server in Agentic Data Plane:

  1. Open MCP servers in the sidebar.

  2. Click Add MCP server.

  3. Click the SharePoint card in the marketplace picker.

  4. Replace the suggested Name, and optionally add a Description.

  5. Under Auth, select User OAuth (the only option for this type), then set Provider Name to the SharePoint OAuth provider you configured.

  6. Under Required Scopes, add Sites.ReadWrite.All (or Sites.Read.All for a read-only server).

  7. If the form shows Queryable, Enabled is on. Turn it off unless your agents need the two SQL tools. See Expose SharePoint data as SQL tables.

  8. Click Create server.

The required scopes are checked against each user’s connection by exact scope name. A connection with insufficient scopes returns scope_upgrade_required, and the user reconnects to grant the missing scope. Every required scope must also be in the OAuth provider’s scope list. If the Entra app isn’t granted a required scope, every call keeps failing.

The create form turns Enable code mode on by default for this server type. The rpk ai mcp-server create command has no code-mode flag. To add code mode from the CLI, create a Code MCP server named <server-name>-code with --code.mcp-servers <server-name>. See Code Mode.

Configure from the CLI

Use rpk ai to create the server with a managed configuration. Set the OAuth provider inside the --managed.config JSON. The --remote.user-oauth.* flags belong to the remote flag group and apply to remote servers only.

rpk ai mcp-server create sharepoint \
  --enabled \
  --description "SharePoint MCP over Microsoft Graph with per-user OAuth" \
  --managed.config '{
    "@type": "type.googleapis.com/redpanda.mcps.sharepoint.v1.SharePointMCPConfig",
    "userOauth": {
      "providerName": "sharepoint",
      "requiredScopes": ["Sites.ReadWrite.All"]
    }
  }'

Authorize a user and test

The SharePoint server uses per-user OAuth, so each user connects their Microsoft identity before tools work for them:

  1. Open the server in Agentic Data Plane. If you haven’t connected to the SharePoint OAuth provider yet, a connection banner with a Connect button appears on the server page. Click Connect, sign in to Microsoft, and approve the consent screen. The token lands in the vault keyed to your identity.

    If you call a tool before connecting, the call fails with a connection-required result that carries an authorization URL on the gateway’s /oauth/v1/authorize endpoint. Opening that URL in a browser starts the same Microsoft consent flow.

  2. Open the server’s Inspector tab and run list_sites with the argument {"search": "*"}. It returns the sites you can see. See Test an MCP Server’s Tools with the Inspector.

Expose SharePoint data as SQL tables

The SharePoint server can also present its read operations as read-only SQL tables, so an agent can filter records the way it would query a database. SQL exposure is the Enabled toggle under Queryable in the server’s configuration. If SQL tools are available in your organization, the create form shows Queryable with Enabled on, so a server you create there is queryable unless you turn it off. Otherwise the form doesn’t show Queryable, and the server starts with SQL exposure off. Creating a server with rpk ai leaves SQL exposure off unless the managed configuration sets it. An existing server keeps the setting it was saved with. To change it, open the server’s edit form, which shows Queryable if SQL tools are available in your organization or if the server was saved with SQL exposure on. SQL exposure adds two tools:

  • list_tables: Return the table catalog. For each table, the catalog lists its columns and their types, which columns can be filtered and with which operators, whether each filter is exact, the page-size limit, and a schema fingerprint that every query response repeats so a caller can tell when the catalog changed.

  • execute_query: Run one query against a table and return a page of rows plus a cursor for the next page.

The tables are:

Table Contents

drive_items

The files and folders directly inside the root folder of one site’s default document library. Sub-folder contents aren’t included, so use list_drive_items with a folder_id to read deeper. Every query has to filter on site_id.

lists

The lists and document libraries on one site, except hidden lists. Every query has to filter on site_id.

list_items

The items in one SharePoint list, with each item’s column values as a JSON string in fields_json. Every query has to filter on both site_id and list_id.

Each table returns only what the signed-in user can see, as the other tools do. The required filters are exact. A page holds at most 200 rows on drive_items and list_items, and 100 on lists.

The list_sites and search_content tools stay plain tools, because both are searches rather than lists of records, and so do the tools that read or write a single file or site.

With SQL exposure on, the two tools are available to every caller of the server, including agents. Turn off Enabled on a server whose agents should only reach the curated SharePoint tools.

To trim the catalog table by table, hide columns, require filters, retype a column, or serve a table under another name, use the SQL exposure tab on the server’s page. That tab works the same way for every managed type that offers SQL tables. See Narrow what the SQL tools expose. If the server’s page has no SQL exposure tab, narrowing isn’t enabled for your organization. The Enabled setting on the server’s configuration still turns the two SQL tools on and off.

Troubleshooting

Symptom What to check

connection_required

First call from a user with no stored token. The user completes Microsoft’s OAuth consent flow, the token lands in the vault, and subsequent calls reuse it. See User-delegated OAuth.

Need admin approval on the Microsoft consent screen

A tenant admin hasn’t granted admin consent for the Graph scopes. See Grant admin consent.

scope_upgrade_required

The user’s connection has fewer scopes than the server requires, either because the server’s required scopes grew or because the user originally consented with fewer. The user re-consents to grant the missing scope.

AADSTS errors during authorization

A single-tenant app is using the /common/ OAuth endpoints. Switch the OAuth provider to the tenant-specific endpoints (https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/…​;).

SharePoint API error (status 403, code: accessDenied)

The signed-in user lacks permission on that site, file, or list. Graph errors surface only the HTTP status and Graph error code. The upstream error message is withheld.

list_sites returns no sites

Pass * to list every site, or a name fragment. If a search still returns nothing, the signed-in user might not have access to any matching site.

upload_file fails

The upload_file tool requires the Sites.ReadWrite.All scope. A read-only server configured with Sites.Read.All cannot upload. Content is also capped at 4 MiB and must be UTF-8 text.

get_file_content reports that a file can’t be read as UTF-8 text

The file isn’t text, such as a PDF, an Office document, or an image. Open the SharePoint link in the error, or the file’s web_url, to read it directly.

get_file_content reports that a file is larger than the 10 MiB limit for reading

Downloads are capped at 10 MiB. Open the SharePoint link in the error, or the file’s web_url, to read it directly.

Token expired and no refresh token available

The stored token expired and couldn’t be refreshed. Confirm offline_access is in the OAuth provider’s scopes, then have the user reconnect through the same consent flow.

Next steps