Content disclaimer: This text was (partly) generated using AI. As we have not (yet) compiled and checked the content ourselves, we cannot guarantee its accuracy. Please use this information as a guideline or for knowledge transfer, but not as legal, financial, or other binding advice

SharePoint Integration in Entra: The Technical Setup

This article outlines the requirements for executing a Microsoft® SharePoint integration with MKG, such as user-level licenses, access to Microsoft® Entra and MKG, the setup of SharePoint sites, and security groups. This article also includes step-by-step guides for creating an Entra app registration and setting up SharePoint sites.

Let your IT provider handle the technical setup
Activating an integration with Microsoft® SharePoint requires technical and functional knowledge of SharePoint and Entra. Therefore, let your IT provider handle this setup. Should there be any questions, MKG can, of course, provide support.

Requirements

Licenses

To utilize a SharePoint integration with MKG, an Entra environment equipped with the correct user-level licenses is required.

License	Entra App Registration	SP Online Storage	Works with MKG
Microsoft Entra ID Free
M365 Business Basic		(1 TB org + 10 GB/user)
M365 Business Standard
M365 Business Premium
Office 365 E1
Office 365 E3
Office 365 E5
SharePoint Online Plan 1 (standalone)
SharePoint Online Plan 2 (standalone)

Access Rights to Entra Environment

Creating an app registration in Entra requires specific rights. An administrator must have at least the 'Application Developer' role to perform an app registration. This role provides sufficient rights to create an app and add API permissions. However, to grant admin consent at the tenant level - necessary for certain permissions, such as Microsoft® Graph - the 'Global Administrator' role is required. Therefore, it is advisable for a Global Administrator to perform the app registration or at least be available to grant the necessary consent.

SharePoint Site for Document Storage

For using the SharePoint integration within MKG, it is necessary to have a SharePoint site available for storing documents. This site must be pre-configured with a stable structure and a clear rights configuration. The site must be accessible to users who wish to store or access documents via MKG.

Note!
Changes in the setup of this site (such as structure or rights) should be avoided as much as possible afterward to ensure the reliability and continuity of the connection.

Security Groups and User Membership

Within Entra, security groups must be configured that will eventually be linked to document categories in MKG. Only groups configured as security groups in Microsoft Entra with Security enabled are recognized and displayed by MKG.

The document category in MKG determines which documents a user sees in the MKG interface. Actual access to the document is determined by membership of the linked security group.

A user may see a document as a record in MKG but may not be able to open it due to missing membership. Conversely, a user may have access to a document via SharePoint, but it may not be visible in MKG.

Note!
Changes in group composition should be avoided as much as possible afterward to ensure the stability of document access.

App Registration in Entra

Follow the steps below to create an app registration that allows MKG users to store or access documents via the UI (user interface) in combination with SharePoint.

Step 1: Sign In

Go to the Microsoft Entra Portal and sign in with a user (it is recommended to use a user with the 'Global Administrator' role).

Step 2: New Registration

In the menu, choose ‘App registrations’ and then select the action New registration.

Step 3: Enter the App Registration Name

For the app registration, enter the name "MKG ERP Sharepoint" at Name. Select the (default) option 'Accounts in this organizational directory only (Single tenant)' under 'Supported account types' and choose the action Register.

Step 4: Create a Client Secret

In the created app registration, go to ‘Certificates & secrets’ and choose New client secret.

Then enter "MKG ERP SharePoint" at Description, select the option ‘Recommended: 180 days (6 months)’ under Expires, and click Add.

Note!
After creating a client secret, the ‘Secret Value’ is only shown once in the current session. Record this value immediately, along with the ‘Secret ID’ and the expiration date (‘Expiry date’), so you can securely store it for further setup. After closing the session, this newly created ‘Secret Value’ cannot be retrieved.

Step 5: Execute the API Permissions

In the created app registration, go to ‘API permissions’ and choose Add a permission and add the following Microsoft Graph permissions (type ‘Delegated’ or ‘Application’).

Permission	Description	Type	Admin consent required
Files.ReadWrite.AppFolder	Read/write in sandbox folder per user	Delegated
Group.Read.All	Read Microsoft 365 groups	Application
Sites.FullControl.All	Full access to all SharePoint sites	Application
Sites.Selected	Restricted access to specific SharePoint sites	Application
User.Read	Read profile of signed-in user	Delegated

For the permissions ‘Group.Read.All’, ‘Sites.FullControl.All’, and ‘Sites.selected’, additional approval is required. Execute the action Grant admin consent for this.
The permission ‘Sites.FullControl.All’ is only needed during setup for setting the rights (Sites.selected) on a specific SP site.

Step 6: Record the Client ID and Tenant ID

In the created app registration, go to the ‘Overview’ tab. Record the values of both the ‘Application (client) ID’ and the ‘Directory (tenant) ID’. Note these details, along with the information from step 4, for the subsequent steps.

Sites.selected Setup in SharePoint

With Sites.Selected, an app registration does not automatically gain access to all SharePoint sites in the tenant, but only to those sites for which explicit permission has been granted by a SharePoint administrator. This prevents sensitive or internal information from being unintentionally accessible to applications.

Step 1: Sign In

Go to the Microsoft 365 Admin Center and sign in with a user (it is recommended to use a user with the 'Global Administrator' role).

Step 2: Select the Admin Center

In the menu, choose ‘Admin Centers’ and then ‘Sharepoint’. You will automatically enter the correct Admin Center for your tenant, for example, https://contoso-admin.sharepoint.com.

Step 3: Record the siteID

Select the site that should be used for the integration with MKG and extract the ‘siteId’ from the URL in the address bar. Record this value for the subsequent step. For example:

URL https://contoso-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/siteManagement/:/SiteDetails/b8df588c-ff95-44b3-bf3b-8d498c712345a

SiteID b8df588c-ff95-44b3-bf3b-8d498c712345a

Step 4: Download the Sites.Selected Script

Unfortunately, the Sites.selected item cannot be configured via a UI/webpage. A template has been provided for this, download the script 'MKG_Sites.Selected.ps1' and open it with a text editor of your choice. Fill in the ‘Config’ section with the previously recorded values for tenantId, appId, clientSecret, and siteId, and save the changes.

Step 5: Execute the Sites.Selected Script

Execute the script via 'Powershell' (right-click on the file and choose 'Run with Powershell'). Upon successful execution, the message "Write permission has been successfully granted to the application for the site." will be displayed.

Step 6: Remove the API Permission

If step 5 was successfully executed, it is highly recommended to remove the permission ‘Sites.FullControl.All’ from the app registration.

Storage Structure in SharePoint

The SharePoint integration stores documents in document libraries that are automatically managed by the integration.

For each document upload, unique permissions are assigned at the file level, so that authorizations from MKG are also applied within SharePoint. To ensure the scalability and performance of SharePoint, documents are distributed across multiple document libraries. The integration automatically creates a new document library each month, for example:

MKGDocs 2026-08
MKGDocs 2026-09
MKGDocs 2026-10

Within each document library, the existing folder structure remains unchanged: YYYY/MM/DD/HHMMSS/.

This ensures that existing links and the document structure are preserved, while the number of documents and unique permissions per document library remain within the limits recommended by SharePoint.

Note!
The technical setup of the SharePoint integration is now complete. Refer to the article Configure SharePoint Integration in MKG for the next steps.

license administrator user api document microsoft office mkg client tenant microsoft sharepoint microsoft entra

Published:12 aug 2026 13:48
TypeHandleidingen
Category
Technics, Cloud
Product
MKG5 MKG3
Availability
Openbaar