This article only applies to your community if your Firstup contract includes this functionality. Please contact your Customer Success Manager with any questions about feature availability for your community.
This article only applies to your community if your Firstup contract includes this functionality. Please contact your Customer Success Manager with any questions about feature availability for your community.
Firstup’s Microsoft OneDrive and SharePoint integration allows users to search Microsoft work-account content from Firstup. Each user authenticates with Microsoft, and search results respect that user’s existing Microsoft permissions.
This guide explains how to configure the Microsoft OneDrive & SharePoint Search integration, complete the required Microsoft administrator setup, connect user accounts, and understand the search experience.
To find out more about the search integration, refer to Microsoft OneDrive & Sharepoint Search Integration.
Before You Start
Confirm the following before configuration begins:
- Microsoft work accounts are required. Personal Microsoft accounts are not supported.
- You must provide your Azure Tenant ID. Only users from the configured tenant can use the integration.
- An Azure/Entra admin may be required. If your tenant allows user consent for apps, users may be able to connect without admin approval. Otherwise, an Azure admin must grant tenant-wide consent to the SocialChorus Search enterprise application.
- Search respects Microsoft permissions. Users authenticate with Microsoft and can only search/open content they already have permission to access.
-
Decide what should be searched. Use
driveItemfor the standard OneDrive and SharePoint file/document search experience. Addsitewhen SharePoint site results should also appear. - Optional SharePoint site scoping requires Firstup assistance. If you want to limit results to specific SharePoint sites, collect the SharePoint site URLs/site IDs. Site-level scoping is supported, but self-service customer admin configuration and folder/document-library-level scoping are out of scope.
- Admin consent may be required for users to use the integration. Based on the Azure/Entra domain settings, admin consent may be required. These settings can be found in Enterprise applications → Consent and permissions.
Configuration Scope
During setup, your Firstup representative configures the Microsoft OneDrive and SharePoint integration. We enter your Azure Tenant ID, then enable the integration for your Firstup environment.
We also configure the name and description users will see in Firstup, and we can apply a target audience so only selected users see the integration.
This integration supports Microsoft work accounts only. Personal Microsoft accounts are not supported. Search can return any document type recognized by OneDrive and SharePoint, and Microsoft can search within supported documents.
Your Firstup representative also configures which Microsoft content types are included in search results. The recommended default is driveItem, which allows users to search files, folders, pages, news, and documents in OneDrive and SharePoint sites they already have permission to access. We can also add site when you want SharePoint site results included, such as site names, metadata, and relationships.
We also configure the integration to search specific SharePoint sites only. For example, if your organization has separate SharePoint sites for HR, Finance, and Sales, Firstup can limit search results to one or more of those sites so users see content from the relevant area.
Additional entity types are available but used less often, including drive for document libraries, list for SharePoint lists, and listItem for list items. Because files and folders can also be returned as list items, listItem may return broader results than needed.
Enabled Commands, Quick Action Commands, and Sort Order are not required for this integration.
Technical Details
Authorization and Authentication
The integration uses OAuth 2.0 authorization code grant flow for delegated access. It acts on behalf of a signed-in user with delegated permissions, which define the operations the application can perform for that user.
Both the client application and the user must be authorized to access Microsoft resources. When users sign in, they authenticate with Microsoft and grant the requested permissions, unless an Azure/Entra administrator has already granted tenant-wide consent.
When users sign into the client application, Microsoft issues an access token and a refresh token. The access token is temporary and expires. When it expires, a new access token can be issued using the refresh token.
Refresh tokens can expire, requiring users to reconnect their Microsoft account. Token lifetime may depend on Microsoft tenant policies and app configuration.
Permissions
The integration uses delegated Microsoft permissions with user consent or administrator consent. The application can only access data that the signed-in user is already authorized to access in Microsoft 365.
Search results are always limited to content users are authorized to access, regardless of which entity types are selected.
The Microsoft Graph API needs these permissions:
| Claim | Permission |
|---|---|
| offline_access | Maintain access to data you have given it access to |
| User.Read | Sign in and read user profile |
| Files.Read.All | Read all files that the user can access |
| Sites.Read.All | Read items in all sites collections |
| openid | Sign in users |
Entity Types
The scope of the Microsoft search request is defined using the Entity Types property.
The recommended default entity type is driveItem, which allows users to search files, folders, pages, news, and documents in OneDrive and SharePoint sites they already have permission to access.
Add site when you want SharePoint site results included, such as site names, metadata, and relationships.
Additional entity types are available but used less often, including:
-
drivefor document libraries -
listfor SharePoint lists -
listItemfor list items
Because files and folders can also be returned as list items, listItem may return broader results than needed.
Only OneDrive and SharePoint content search is supported at this time. Search for Microsoft Teams content, email, calendar items, tickets, tasks, projects, and Q&A content is not currently supported.
The following entity types and permission scopes apply to Firstup:
| Entity Type | Permission Scope | Available Data | Format |
|---|---|---|---|
| drive |
Files.Read.All, Sites.Read.All
|
SharePoint | Document libraries |
| driveItem |
Files.Read.All, Sites.Read.All
|
SharePoint and OneDrive | Files, folders, pages and news |
| list | Sites.Read.All |
SharePoint and OneDrive | Lists including document libraries |
| listItem | Sites.Read.All |
SharePoint and OneDrive | List items including files and folders |
| site | Sites.Read.All |
SharePoint | Sites in SharePoint |
Search results are always limited to a content user's authorized access within Microsoft 365, regardless of selected entity types.
SharePoint Site Scoping
Firstup can configure the integration to search specific SharePoint sites only.
For example, if your organization has separate SharePoint sites for HR, Finance, and Sales, Firstup can limit search results to one or more of those sites so users see content from the relevant area.
To configure SharePoint site scoping, provide Firstup with the SharePoint site URLs or site IDs.
Microsoft permissions always take precedence. Users only see content they already have permission to access.
Site-level scoping is supported. Library-level, folder-level, and document-library-level scoping are not currently supported.
Configure Microsoft OneDrive & SharePoint Search Integration
- Step 1: Share Azure Tenant ID with Firstup
- Step 2: Grant Admin Consent
- Step 3: Connecting a User Account
Step 1: Share Azure Tenant ID with Firstup
To locate your Azure Tenant ID:
- Sign in to the Azure portal.
- Navigate to Microsoft Entra ID (formerly Azure Active Directory).
- In the Overview section, copy the Tenant ID.
- Share the Tenant ID with Firstup.
Only users in the specified tenant can use the integration.
Step 2: Grant Admin Consent
Administrator consent is required. Microsoft's managed consent policy excludes Files.Read.All and Sites.Read.All from end-user consent. An administrator must consent to this application on behalf of your organization. This is a one-time action per tenant.
No change to your user consent settings is required. This integration works with your tenant's most restrictive user consent setting, including "Do not allow user consent." You are not being asked to relax your tenant's consent posture. The integration requests Microsoft's default scope, which can only return permissions that your administrator has already approved on the application. Users can never consent to anything beyond what you have approved.
Firstup recommends granting consent proactively, before your first user connects. The admin consent request workflow is turned off by default in Microsoft Entra and must be enabled by a Global Administrator; without proactive consent, your first user may be unable to continue and no request will reach an administrator.
- Navigate to Enterprise Applications in Azure/Entra Portal (direct link) and click + New Application.
Using search, find SocialChorus Search and open it.
Click on Sign up for SocialChorus Search.
Navigate to the Permissions page.
Here, you can see the list of permissions required by the app. Click on Grant admin consent for {your tenant name}.
After setup process is finished, users should be able to connect their accounts and use search.
If User consent settings for applications are set to Allow user consent for apps, then no action is required. Existing consent grants remain valid and are not affected by later changes to your consent settings.
Step 3: Connecting a User Account
After the integration is configured, users can connect their Microsoft work account from Firstup.
Users will be prompted to:
- Connect their Microsoft work account.
- Authenticate with Microsoft.
- Review and accept the requested Microsoft permissions, unless admin consent has already been granted for the tenant.
Once connected, users can search Microsoft OneDrive and SharePoint content from Firstup. Search results are limited to content that the user is already authorized to access in Microsoft. Refer to the Microsoft OneDrive & SharePoint Search Integration article for detailed guidance on the user experience.
FAQ
What fields does search look across, such as title, description, body, or tags?
See the configuration article for details on what can be configured and which items are searched.
What about fuzzy search?
See Microsoft’s Keyword Query Language (KQL) syntax reference. This applies only to the Microsoft integration.
How can I refine my results, such as by metadata, file type, year, or author?
Results can be refined by site.
Can I preview the document, or will it take me to SharePoint?
We use the Microsoft API to determine result behavior. Clicking a document downloads it. Clicking the thumbnail should preview the document.
Will search respect permissions and security?
Yes. Users authenticate with Microsoft and can only access files they have permission to view.
Can we configure which libraries this search is scoped to?
Search can be scoped to a top-level site filter.
How much can we configure the cards returned in search results?
Search result cards are not configurable today.
Can users toggle between list view and grid view?
Not at this time.
Can users search for tickets, tasks, projects, or teams in M365?
Not at this time.
What is the sort order for searches? Is it customizable?
Results are shown in creation order. Sort order is not customizable today.
Is this available in the EU data center?
Yes.
What happens if search results do not have a title (name in the API) for us to display?
We show displayName when name is not available.
Do we need to change our user consent settings?
No. Admin consent is granted once for the application; your user consent settings can remain at their most restrictive.
The "Grant admin consent" button is still showing — did it not work?
The button always remains visible; it is not a one-time button that disappears. Confirm success on the Admin consent tab, where each permission shows Granted through: Admin consent.
Does search respect permissions?
Yes. Users only see content they are authorized to access.
Can search be scoped to specific libraries?
Not currently. Search site URLs can restrict results to specific SharePoint sites.
Comments
0 comments
Article is closed for comments.