Overview
Legora's SharePoint integration allows your users to pull in documents directly from SharePoint. You can connect multiple SharePoint instances so organisations with regional SharePoint environments can manage each independently.
Key features
File and folder selection
The integration includes a file and folder picker, enabling users to upload documents or entire folders from SharePoint into Legora. When multiple SharePoint connectors are configured, users can select the correct instance from the upload menu.
Secure Authentication and Connectivity
Legora uses SharePoint's native authentication system. No user credentials are passed through Legora. When a user connects, Microsoft issues an access token that Legora uses to fetch and parse documents the user has permission to access. Each SharePoint connector has its own independent authentication token. Connecting to one instance never involves using another instance credentials.
Allowed Sites
Admins can restrict which SharePoint sites users can access via Legora. If no sites are specified, there are no restrictions. Even if only one site is added, only that site is accessible. Allowed sites are scoped per connector with each SharePoint instance maintaining its own list, and site URLs belonging to that connector's configured host.
Setup
Before you begin
You have admin access to the Azure portal.
You have your Directory (tenant) ID, Application (client) ID (must be a valid UUID), and SharePoint base URL ready.
Create and configure the Azure AD app registration
Sign in to the Azure portal and go to Azure Active Directory > App registrations > New registration.
Under Authentication:
Create a Single-page application platform and set the redirect URI to your region:
EU:
https://app.eu.legora.comUS:
https://app.us.legora.comAP:
https://app.ap.legora.comAuthentication:
https://app.legora.com/sharepoint
Select the Access tokens and ID tokens checkboxes.
Under API permissions, add the permissions below, then select Grant admin consent:
Microsoft Graph (delegated):
Files.Read.All,Sites.Read.All,User.ReadSharePoint (delegated):
AllSites.Read,MyFiles.Read
From the Overview tab, copy your Directory (tenant) ID and Application (client) ID.
Configure the integration in Legora
Legora supports connecting multiple SharePoint instances. If your organisation uses SharePoint across multiple regions, note that:
Each connector operates independently with its own authentication, allowed sites, and sync.
Users will see each connector listed separately in the upload menu by the name you give it.
Add a separate Sharepoint connector by following the steps below for each instance:
From your name on the sidebar, select Settings > Integrations.
In the Available section, click Add next to SharePoint.
If you already have a SharePoint connector and are adding another instance:
Your existing connector will appear under Connected.
A new Add option will remain available for you to configure the next instance.
Paste the Directory (tenant) ID and Application (client) ID you copied in step 4, when configuring the Azure AD app registration.
Enter your SharePoint site URL:
Use the main tenant URL, e.g.
https://tenant.sharepoint.comDon't use OneDrive (
https://tenant-my.sharepoint.com) or the admin center (https://tenant-admin.sharepoint.com).
Give the connector a name that identifies the instance (e.g. "SharePoint EU" or "SharePoint US"). This name appears in the upload menu so users know which instance they are selecting.
(Optional) Run the validation wizard to confirm your app registration and permissions are set up correctly. Any missing permissions will be highlighted in red.
Click Create. You will now see the connector listed under Connected. Repeat these steps for any additional SharePoint instances.
Configure allowed sites (optional)
Once enabled, click Configure on the SharePoint connector you want to restrict.
Open the Allowed sites tab.
Add any sites you want to restrict access to. If left empty, all sites are accessible.
Added URLs must belong to the same host as that connector's configured SharePoint site URL.
If you have multiple SharePoint connectors, configure allowed sites separately for each one. Sites added to one connector's list have no effect on another connector.
Troubleshooting
Failed to validate tenant ID
Verify the Directory (tenant) ID is correct.
Failed to validate application
Verify the Application (client) ID and that it is correctly configured in Azure AD.
The redirect URI platform was not set to 'Single-page application (SPA)'
In the Azure AD app registration, ensure the redirect URI is configured as SPA, not Web.
The application is missing the required permissions
Grant the missing permissions shown in red in the validation step.
Failed to validate the Application, please see the Microsoft screen for detailed error description.
The OAuth popup was cancelled or returned an error. Check the Microsoft error screen for details.
Authentication succeeds but nothing renders in the popup
This is typically caused by the app registration not being set as a Single-page application. Double-check the platform type in the Azure AD app registration.
The URL must belong to {host}
When adding an allowed site, the URL must match the host of the SharePoint site URL configured for that specific connector. Each connector enforces this check independently. A URL valid for your EU connector will be rejected if added to your US connector.
I can see one SharePoint connector in the upload menu but not the other
Check that the second connector was created successfully under Settings > Integrations. Each connector only appears in the upload menu once it has been fully configured and is listed under Connected.
Users are being authenticated against the wrong SharePoint instance
Each connector uses its own independent authentication token. If users are seeing files or sites from the wrong instance, check that each connector is configured with the correct tenant ID, client ID, and base URL for its respective instance.
Custom SharePoint domains (e.g. sites.company.com)
Legora allows Microsoft-hosted SharePoint domains (e.g. *.sharepoint.com) by default. If your SharePoint is on a custom domain, it may require an additional firewall allowlist rule on Legora's side. Contact Legora support and share the SharePoint base URL/domain to allowlist. If you have multiple connectors on custom domains, share all base URLs when contacting support.
FAQ
Can admins restrict which sites users can browse?
Yes. Use the Allowed sites tab in each SharePoint connector's configuration to restrict access to specific SharePoint sites. Each connector has its own allowed sites list.
Can we connect more than one SharePoint environment?
Yes. You can add one connector per SharePoint instance. Each connector is fully independent — it has its own login credentials, allowed sites, and sync. Users see each connector listed separately by name in the upload menu.
Will adding a second SharePoint connector affect our existing one?
No. Your existing setup continues to work exactly as before. The second connector is fully separate and does not share authentication, allowed sites, or sync with the first.
How do users know which SharePoint connector to pick when uploading?
When uploading a file, users will see each SharePoint connector listed by the name you gave it during setup (e.g. "SharePoint EU", "SharePoint US"). Make sure to use clear, descriptive names when configuring each connector.
Can I configure different allowed sites for each SharePoint instance?
Yes. Allowed sites are scoped per connector. Each instance has its own list, and the URLs must match that connector's host. A site added to one connector's list has no effect on another.
What happens if I add the same SharePoint instance twice?
Each connector should point to a distinct SharePoint instance. Adding the same base URL to two connectors is not recommended — it will result in duplicate entries in the upload menu and may cause unexpected behaviour with allowed sites and sync.
Why is my authentication successful, but nothing renders in the popup?
Example:
This is often caused by a misconfiguration on the client side, ask the customer to double check the app registration, especially, that it is registered as a Single Page Application.
