This article only applies to your community if your Firstup contract includes this functionality. Please contact your Customer Success Manager with any questions about feature availability for your community.

This article only applies to your community if your Firstup contract includes this functionality. Please contact your Customer Success Manager with any questions about feature availability for your community.

Firstup’s Microsoft OneDrive and SharePoint integration allows users to search Microsoft work-account content from Firstup. Each user authenticates with Microsoft, and search results respect that user’s existing Microsoft permissions.

This guide explains how to configure the Microsoft OneDrive & SharePoint Search integration, complete the required Microsoft administrator setup, connect user accounts, and understand the search experience.

To find out more about the search integration, refer to Microsoft OneDrive & Sharepoint Search Integration.

Before You Start

Confirm the following before configuration begins:

• Microsoft work accounts are required. Personal Microsoft accounts are not supported.
• You must provide your Azure Tenant ID. Only users from the configured tenant can use the integration.
• An Azure/Entra admin may be required. If your tenant allows user consent for apps, users may be able to connect without admin approval. Otherwise, an Azure admin must grant tenant-wide consent to the SocialChorus Search enterprise application.
• Search respects Microsoft permissions. Users authenticate with Microsoft and can only search/open content they already have permission to access.
• Decide what should be searched. Use driveItem for the standard OneDrive and SharePoint file/document search experience. Add site when SharePoint site results should also appear.
• Optional SharePoint site scoping requires Firstup assistance. If you want to limit results to specific SharePoint sites, collect the SharePoint site URLs/site IDs. Site-level scoping is supported, but self-service customer admin configuration and folder/document-library-level scoping are out of scope.
• Admin consent may be required for users to use the integration. Based on the Azure/Entra domain settings, admin consent may be required. These settings can be found in Enterprise applications → Consent and permissions.

Configuration Scope

During setup, your Firstup representative configures the Microsoft OneDrive and SharePoint integration. We enter your Azure Tenant ID, then enable the integration for your Firstup environment.

We also configure the name and description users will see in Firstup, and we can apply a target audience so only selected users see the integration.

This integration supports Microsoft work accounts only. Personal Microsoft accounts are not supported. Search can return any document type recognized by OneDrive and SharePoint, and Microsoft can search within supported documents.

Your Firstup representative also configures which Microsoft content types are included in search results. The recommended default is driveItem, which allows users to search files, folders, pages, news, and documents in OneDrive and SharePoint sites they already have permission to access. We can also add site when you want SharePoint site results included, such as site names, metadata, and relationships.

We also configure the integration to search specific SharePoint sites only. For example, if your organization has separate SharePoint sites for HR, Finance, and Sales, Firstup can limit search results to one or more of those sites so users see content from the relevant area.

Additional entity types are available but used less often, including drive for document libraries, list for SharePoint lists, and listItem for list items. Because files and folders can also be returned as list items, listItem may return broader results than needed.

Enabled Commands, Quick Action Commands, and Sort Order are not required for this integration.

Technical Details

Authorization and Authentication

The integration uses OAuth 2.0 authorization code grant flow for delegated access. It acts on behalf of a signed-in user with delegated permissions, which define the operations the application can perform for that user.

Both the client application and the user must be authorized to access Microsoft resources. When users sign in, they authenticate with Microsoft and grant the requested permissions, unless an Azure/Entra administrator has already granted tenant-wide consent.

When users sign into the client application, Microsoft issues an access token and a refresh token. The access token is temporary and expires. When it expires, a new access token can be issued using the refresh token.

Refresh tokens can expire, requiring users to reconnect their Microsoft account. Token lifetime may depend on Microsoft tenant policies and app configuration.

Permissions

The integration uses delegated Microsoft permissions with user consent or administrator consent. The application can only access data that the signed-in user is already authorized to access in Microsoft 365.

Search results are always limited to content users are authorized to access, regardless of which entity types are selected.

The Microsoft Graph API needs these permissions:

Entity Types

The scope of the Microsoft search request is defined using the Entity Types property.

The recommended default entity type is driveItem, which allows users to search files, folders, pages, news, and documents in OneDrive and SharePoint sites they already have permission to access.

Add site when you want SharePoint site results included, such as site names, metadata, and relationships.

Additional entity types are available but used less often, including:

• drive for document libraries
• list for SharePoint lists
• listItem for list items

Because files and folders can also be returned as list items, listItem may return broader results than needed.

Only OneDrive and SharePoint content search is supported at this time. Search for Microsoft Teams content, email, calendar items, tickets, tasks, projects, and Q&A content is not currently supported.

SharePoint Site Scoping

Firstup can configure the integration to search specific SharePoint sites only.

For example, if your organization has separate SharePoint sites for HR, Finance, and Sales, Firstup can limit search results to one or more of those sites so users see content from the relevant area.

To configure SharePoint site scoping, provide Firstup with the SharePoint site URLs or site IDs.

Microsoft permissions always take precedence. Users only see content they already have permission to access.

Site-level scoping is supported. Library-level, folder-level, and document-library-level scoping are not currently supported.

Configure Microsoft OneDrive & SharePoint Search Integration

Before configuring the search integration on the Microsoft side, based on Azure/Entra domain settings, admin consent may be required for users to use the integration. These settings can be found in Enterprise applications → Consent and permissions.

If User consent settings for applications are set to Allow user consent for apps, then no further action is required.

In other cases, the Azure/Entra Admin needs to provide consent to our app:

Customer Azure/Entra admin grants consent

1. Navigate to Enterprise Applications in Azure/Entra Portal (direct link) and click + New Application.
   
   
    

2. Using search, find SocialChorus Search and open it, click on Sign up for SocialChorus Search.

3. In All Applications list, locate SocialChorus Search and open it, navigate to Permissions page. Here you can see list of permissions required by app. Click on Grant admin consent for …
   
   

After setup process is finished, users should be able to connect their accounts and use search.

Share Azure Tenant ID with Firstup

To locate your Azure Tenant ID:

1. Sign in to the Azure portal.
2. Navigate to Microsoft Entra ID.
3. In the Overview section, copy the Tenant ID.
4. Share the Tenant ID with Firstup.

Only users who belong to the specified tenant can use the integration.

Connecting a User Account

After the integration is configured, users can connect their Microsoft work account from Firstup.

Users will be prompted to:

1. Connect their Microsoft work account.
2. Authenticate with Microsoft.
3. Review and accept the requested Microsoft permissions, unless admin consent has already been granted for the tenant.

Once connected, users can search Microsoft OneDrive and SharePoint content from Firstup. Search results are limited to content that the user is already authorized to access in Microsoft.

FAQ

What fields does search look across, such as title, description, body, or tags?

See the configuration article for details on what can be configured and which items are searched.

What about fuzzy search?

See Microsoft’s Keyword Query Language (KQL) syntax reference. This applies only to the Microsoft integration.

How can I refine my results, such as by metadata, file type, year, or author?

Results can be refined by site. 

Can I preview the document, or will it take me to SharePoint?

We use the Microsoft API to determine result behavior. Clicking a document downloads it. Clicking the thumbnail should preview the document.

Will search respect permissions and security?

Yes. Users authenticate with Microsoft and can only access files they have permission to view.

Can we configure which libraries this search is scoped to?

Search can be scoped to a top-level site filter. 

How much can we configure the cards returned in search results?

Search result cards are not configurable today.

Can users toggle between list view and grid view?

Not at this time.

Can users search for tickets, tasks, projects, or teams in M365?

Not at this time.

What is the sort order for searches? Is it customizable?

Results are shown in creation order. Sort order is not customizable today.

Is this available in the EU data center?

Yes.

What happens if search results do not have a title (name in the API) for us to display?

We show displayName when name is not available.