Keep a SharePoint document library in sync with your knowledge base. Files your team adds there are embedded automatically and become answerable; files they remove stop being used.

Before You Start

You need four things, and the third is the one that stalls setups:

• Permission to register an application in Microsoft Entra ID.
• An admin who can grant admin consent for an application permission.
• Someone who can grant the app access to a specific site — this is a Graph API call, not a portal click. See Step 3.
• The address of the SharePoint site holding the library.

Step 1 — Register an application

1. Create it. In the Azure portal → Microsoft Entra ID → App registrations → New registration. Name it something recognisable, e.g. "Aimy SharePoint Sync". Single tenant is fine. No redirect URI is needed.

2. Copy two values from the Overview page: Directory (tenant) ID and Application (client) ID.

3. Create a client secret. Certificates & secrets → New client secret → choose an expiry → Add. Copy the Value column straight away — Azure hides it permanently once you leave the page.

Step 2 — Add the Sites.Selected permission

4. Add it. API permissions → Add a permission → Microsoft Graph → Application permissions → search Sites.Selected → tick it → Add permissions.

5. Grant admin consent. Click Grant admin consent for <tenant> and confirm. The status should turn green.

Step 3 — Grant access to the specific library

This step is a Graph API call. There is no portal screen for it.

6. Find the site ID. Easiest route: in Aimy, do Step 4 below first and click Test connection. Even without site access, that resolves and shows the site. Alternatively call:

GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/Sales

7. Grant the app read access. Using Graph Explorer, signed in as someone with SharePoint admin rights:

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

{
  "roles": ["read"],
  "grantedToIdentities": [{
    "application": {
      "id": "<your Application (client) ID>",
      "displayName": "Aimy SharePoint Sync"
    }
  }]
}

Verify: a 201 response with a permission object. Read access is enough — Aimy never writes to SharePoint.

Step 4 — Connect in Aimy

8. Open the integration. Integrations → the SharePoint card, under Knowledge base.

9. Fill in four fields: Directory (tenant) ID, Application (client) ID, Client secret, and the Site address (e.g. https://contoso.sharepoint.com/sites/Sales).

You can paste the address straight from your browser while looking at the site — Aimy strips the extra path and sharing-link parts.

10. Click Test connection. This signs in, resolves the site, and lists the libraries it can see.

Verify: a dropdown of document libraries appears. If you get "The app isn't allowed to read that site", Step 3 was not done or targeted the wrong site.

11. Pick the library and save.

Step 5 — Test the sync

12. Wait or trigger it. The sync runs every ten minutes. Use Sync now to avoid waiting.

Verify, in order:

• The file list on the SharePoint panel fills in, showing what synced and what was skipped and why.
• The same documents appear under Knowledge Base, moving from Processing to Ready.
• Ask a chatbot a question only those documents can answer.

13. Test a deletion. Remove a file in SharePoint and sync again. It should disappear from the Knowledge Base. This matters more than it sounds: if a withdrawn price list keeps answering questions, the chatbot quotes prices you no longer offer.

How it works

Aimy uses app-only authentication rather than signing a person in. That is deliberate: the connection keeps working after whoever set it up leaves, and needs no re-consent. It also means access is scoped by an admin to exactly one library rather than to whatever one user can see.

Every ten minutes the sync walks the library's change feed. New and changed files are downloaded, malware-scanned and embedded; unchanged files are skipped by comparing an etag, so a steady library costs one cheap API call. Deleted files have their vectors removed.

Documents land under one owning account so retrieval sees a single coherent library. Entitlement is re-checked every pass — if the plan changes, the sync stops.

Troubleshooting

• "No SharePoint site found at that address." Check the URL, and that Step 3 targeted this site.
• "The app isn't allowed to read that site." Step 3 was skipped, or the site ID was wrong.
• "That site has no document libraries the app can see." The grant landed on a different site.
• "Stored credentials are unreadable." Reconnect — the secret can no longer be decrypted.
• Files skipped. The file list shows a reason per file, usually an unsupported type or a size over the limit.
• Worked, then stopped. Check the client secret's expiry date. This is the usual cause.