Microsoft 365

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	Yes	—	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	Network and throttle controls for Graph API requests.	—	no extra properties
optional.connection.max_retries	integer	No	Maximum retries on transient errors and 429 throttling	3	min 0, max 10
optional.connection.page_size	integer	No	Items per page for Graph API list requests	200	min 1, max 999
optional.connection.rate_limit_delay_seconds	number	No	Base delay between requests when throttled (exponential backoff applied)	1	min 0
optional.connection.request_timeout_seconds	integer	No	Socket timeout for Graph API operations	30	min 5, max 300
optional.extraction	object	No	Controls which structural assets to emit beyond files.	—	no extra properties
optional.extraction.include_drive_metadata	boolean	No	Emit drive-level assets with metadata	true	—
optional.extraction.include_permissions	boolean	No	Include file/site permission metadata (requires Sites.FullControl.All)	false	—
optional.extraction.include_site_metadata	boolean	No	Emit site-level assets with metadata	true	—
optional.scope	object	No	Ecosystem selection and content filtering.	—	no extra properties
optional.scope.drive_filter	array	No	Drive names or IDs to include (empty = all)	—	—
optional.scope.drive_filter[]	string	No	—	—	—
optional.scope.ecosystems	array	No	Microsoft 365 ecosystems to scan (select one or more)	["sharepoint_sites"]	—
optional.scope.ecosystems[]	enum	No	Microsoft 365 ecosystem to scan Allowed values: sharepoint_sites, onedrive, teams_files	—	—
optional.scope.exclude_extensions	array	No	Skip files with these extensions	—	—
optional.scope.exclude_extensions[]	string	No	—	—	—
optional.scope.include_extensions	array	No	Only include files with these extensions (e.g. .pdf, .docx)	—	—
optional.scope.include_extensions[]	string	No	—	—	—
optional.scope.max_object_bytes	integer	No	Skip files larger than this many bytes (default 100 MB)	104857600	min 0
optional.scope.path_prefix	string	No	Only scan items under this folder path (e.g. /Documents/Legal)	—	—
optional.scope.site_filter	array	No	SharePoint site hostnames or paths to include (empty = all accessible)	—	—
optional.scope.site_filter[]	string	No	—	—	—

Extracted Metadata

File

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
image_width	integer	No	Width in pixels
image_height	integer	No	Height in pixels
page_count	integer	No	Number of pages (pdf)
paragraph_count	integer	No	Number of paragraphs (docx)
table_count	integer	No	Number of tables (docx)
row_count	integer	No	Number of data rows
columns	object[]	No	Columns as {name, type} objects (type may be empty for csv/xlsx)
encoding	string	No	Detected character encoding
json_root_type	string	No	Root JSON type: object, array, or scalar
top_level_keys	integer	No	Number of top-level keys when the root is an object
array_length	integer	No	Length when the root is an array
site_name	string	No	SharePoint site display name
drive_name	string	Yes	Drive display name
item_path	string	Yes	Full path within the drive
ecosystem	string	Yes	Source ecosystem (sharepoint_sites, onedrive, teams_files)
web_url	string	No	Browser-accessible URL for the item
etag	string	No	Graph API eTag for the item
created_by	string	No	User who created the file
modified_by	string	No	User who last modified the file
permissions	string[]	No	Sharing permissions on the item: list of {role, grantee_type, grantee} entries (requires include_permissions)

Image

Field	Type	Required	Description
size_bytes	integer	Yes	Raw byte size of the content
mime_type	string	Yes	Resolved MIME type
parse_error	string	No	Set when content extraction failed
source_hash	string	Yes	Hash of the parent file asset
location	string	Yes	Location of the embedded image within the parent

Site

Field	Type	Required	Description
site_id	string	Yes	Graph API site ID
site_url	string	No	Site URL
site_name	string	Yes	Site display name
drive_count	integer	No	Number of document libraries

Drive

Field	Type	Required	Description
drive_id	string	Yes	Graph API drive ID
drive_name	string	Yes	Drive display name
drive_type	string	No	Drive type (documentLibrary, personal, etc.)
site_name	string	No	Parent site display name
quota_total	integer	No	Total storage quota in bytes
quota_used	integer	No	Used storage in bytes

Examples

SharePoint document scan with client secret

Scan all SharePoint sites and document libraries for PII and secrets using app registration with client secret

Config Payload

{
  "type": "MICROSOFT_365",
  "required": {
    "auth_mode": "CLIENT_SECRET",
    "tenant_id": "00000000-0000-0000-0000-000000000000",
    "client_id": "11111111-1111-1111-1111-111111111111"
  },
  "masked": {
    "client_secret": "your-client-secret"
  },
  "optional": {
    "scope": {
      "ecosystems": [
        "sharepoint_sites"
      ]
    },
    "extraction": {
      "include_site_metadata": true,
      "include_drive_metadata": true
    }
  },
  "sampling": {
    "strategy": "LATEST"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    },
    {
      "type": "SECRETS",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "15 1 * * *",
  "timezone": "UTC"
}

Multi-ecosystem certificate auth scan

Scan SharePoint, OneDrive, and Teams files using certificate authentication with path and extension filtering

Config Payload

{
  "type": "MICROSOFT_365",
  "required": {
    "auth_mode": "CERTIFICATE",
    "tenant_id": "00000000-0000-0000-0000-000000000000",
    "client_id": "22222222-2222-2222-2222-222222222222"
  },
  "masked": {
    "certificate_pem": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
  },
  "optional": {
    "scope": {
      "ecosystems": [
        "sharepoint_sites",
        "onedrive",
        "teams_files"
      ],
      "path_prefix": "/Documents",
      "include_extensions": [
        ".pdf",
        ".docx",
        ".xlsx",
        ".pptx"
      ]
    },
    "connection": {
      "page_size": 500,
      "max_retries": 5
    }
  },
  "sampling": {
    "strategy": "ALL",
    "enable_ocr": true
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "weekly",
  "cron": "30 2 * * 0",
  "timezone": "UTC"
}

Azure-hosted managed identity scan

Scan SharePoint and OneDrive from an Azure VM or container using managed identity — no secrets required

Config Payload

{
  "type": "MICROSOFT_365",
  "required": {
    "auth_mode": "MANAGED_IDENTITY"
  },
  "masked": {},
  "optional": {
    "scope": {
      "ecosystems": [
        "sharepoint_sites",
        "onedrive"
      ],
      "exclude_extensions": [
        ".mp4",
        ".mov",
        ".avi",
        ".wmv"
      ],
      "max_object_bytes": 52428800
    }
  },
  "sampling": {
    "strategy": "RANDOM",
    "rows_per_page": 25
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "45 7 * * 1-5",
  "timezone": "UTC"
}