Content disclaimer: This text was (partly) generated using AI. As we have not (yet) compiled and checked the content ourselves, we cannot guarantee its accuracy. Please use this information as a guideline or for knowledge transfer, but not as legal, financial, or other binding advice

SharePoint Integration in Entra: The Technical Setup

This article contains the requirements to execute a Microsoft® SharePoint integration with MKG, such as user-level licenses, access to Microsoft® Entra and MKG, the setup of SharePoint sites, and security groups. This article also includes step-by-step guides for creating an Entra app registration and setting up SharePoint sites.

Let your IT provider handle the technical setup
Activating an integration with Microsoft® SharePoint requires technical and functional knowledge of SharePoint and Entra. Therefore, let your IT provider handle this setup. Should there still be questions, MKG can of course provide support.

Requirements

Licenses

To use a SharePoint integration with MKG, an Entra environment with the appropriate user-level licenses is required.

License	Entra App Registration	SP Online Storage	Works with MKG
Microsoft Entra ID Free
M365 Business Basic		(1 TB org + 10 GB/user)
M365 Business Standard
M365 Business Premium
Office 365 E1
Office 365 E3
Office 365 E5
SharePoint Online Plan 1 (standalone)
SharePoint Online Plan 2 (standalone)

Access Rights to Entra Environment

Specific rights are required to create an app registration in Entra. An administrator must have at least the 'Application Developer' role to perform an app registration. This role provides sufficient rights to create an app and add API permissions. However, for granting admin consent at the tenant level - which is necessary for certain permissions, such as Microsoft® Graph - the 'Global Administrator' role is required. Therefore, it is advisable that a Global Administrator performs the app registration or is at least available to grant the required consent.

SharePoint Site for Document Storage

To use the SharePoint integration within MKG, a SharePoint site must be available that is used for document storage. This site must be pre-configured with a stable structure and a clear rights configuration. The site must be accessible to users who wish to save or consult documents via MKG.

Note!
Changes to the configuration of this site (such as structure or rights) should be avoided as much as possible afterward, to ensure the reliability and continuity of the connection.

Security Groups and User Membership

Within Entra, security groups must be configured that will eventually be linked to document categories in MKG. Only groups configured as security groups in Microsoft Entra with Security enabled are recognized and displayed by MKG.

The document category in MKG determines which documents a user sees in the MKG interface. The actual access to the document is determined by the membership of the linked security group.

It is possible for a user to see a document as a record in MKG but not be able to open it due to missing membership. Conversely, it may also occur that a user has access to a document via SharePoint, but it is not visible in MKG.

Note!
Changes in group composition should be avoided as much as possible afterward, to ensure the stability of document access.

App Registration in Entra

Follow the steps below to create an app registration that allows MKG users to save or consult documents via the UI (user interface) in combination with SharePoint.

Step 1: Sign In

Go to the Microsoft Entra Portal and sign in with a user (it is recommended to use a user with the 'Global Administrator' role).

Step 2: New Registration

In the menu, choose ‘App registrations’ and then the action New registration.

Step 3: Enter the App Registration Name

For the app registration, enter the name "MKG ERP Sharepoint" at Name. Select the (default) option 'Accounts in this organizational directory only (Single tenant)' at 'Supported account types' and choose the action Register.

Step 4: Create a Client Secret

In the created app registration, go to ‘Certificates & secrets’ and choose New client secret.

Then enter "MKG ERP SharePoint" at Description, select the option ‘Recommended: 180 days (6 months)’ at Expires, and click Add.

Note!
After creating a client secret, the ‘Secret Value’ is only shown once in the current session. Note this value immediately, along with the ‘Secret ID’ and the expiration date (‘Expiry date’), so you can safely store it for further configuration. Once the session is closed, this newly created ‘Secret Value’ can no longer be retrieved.

Step 5: Execute the API Permissions

In the created app registration, go to ‘API permissions’ and choose Add a permission and add the following Microsoft Graph permissions (type ‘Delegated’ or Application’).

Permission	Description	Type	Admin consent required
Group.Read.All	Read Microsoft 365 groups	Application
Sites.FullControl.All	Full access to all SharePoint sites	Application
Sites.Manage.All	Manage SharePoint sites and document libraries	Application
Sites.Selected	Restricted access to specific SharePoint sites	Application
User.Read	Read profile of signed-in user	Delegated

For the permissions ‘Group.Read.All’, ‘Sites.FullControl.All’, ‘Sites.Manage.All’, and ‘Sites.selected’, additional approval is required. Execute the action Grant admin consent for this.
The permission ‘Sites.FullControl.All’ is only needed during the setup for setting rights (Sites.selected) on a specific SP site. After executing the Sites.selected setup (in step 6), it must be removed again.

Step 6: Note the Client ID and Tenant ID

In the created app registration, go to the ‘Overview’ tab. Copy the values of both the ‘Application (client) ID’ and the ‘Directory (tenant) ID’. Note these details, along with the information from step 4, for the next steps.

Sites.selected Setup in SharePoint

With Sites.Selected, an app registration does not automatically gain access to all SharePoint sites in the tenant, but only to those sites for which explicit permission has been granted by a SharePoint administrator. This prevents sensitive or internal information from being inadvertently accessible to applications.

Step 1: Sign In

Go to the Microsoft 365 Admin Center and sign in with a user (it is recommended to use a user with the 'Global Administrator' role).

Step 2: Select the Admin Center

In the menu, choose ‘Admin Centers’ and then ‘Sharepoint’. You will automatically be in the correct Admin Center for your tenant, for example, https://contoso-admin.sharepoint.com.

Step 3: Note the Site ID

Select the site to be used for the integration with MKG and retrieve the ‘siteId’ from the URL in the address bar. Note this value for the next step. For example:

URL https://contoso-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/siteManagement/:/SiteDetails/b8df588c-ff95-44b3-bf3b-8d498c712345a

SiteID b8df588c-ff95-44b3-bf3b-8d498c712345a

Step 4: Download the Sites.Selected Script

The Sites.selected item cannot be configured via a UI/web page. A template has been prepared for this; download the 'MKG_Sites.Selected.ps1' script and open it with a text editor of your choice. In the ‘Config’ section, fill in the items tenantId, appId, clientSecret, and siteId with the previously noted values and save the changes.

Step 5: Execute the Sites.Selected Script

Run the script via 'Powershell' (right-click on the file and choose 'Run with Powershell'). On successful execution, the message "Write permission has been successfully granted to the application for the site." will be displayed.

Step 6: Remove the API Permission

If step 5 was successfully executed, it is highly recommended to remove the permission ‘Sites.FullControl.All’ from the app registration.

Storage Structure in SharePoint

The SharePoint integration stores documents in document libraries that are automatically managed by the integration.

With each document upload, unique permissions are assigned at the file level, so that the authorizations from MKG are also applied within SharePoint. To ensure the scalability and performance of SharePoint, documents are distributed across multiple document libraries. For this, the integration automatically creates a new document library monthly, for example:

MKGDocs 2026-08
MKGDocs 2026-09
MKGDocs 2026-10

Within each document library, the existing folder structure remains unchanged: YYYY/MM/DD/HHMMSS/.

This way, existing links and the document structure are preserved, while the number of documents and unique permissions per document library remain within the limits recommended by SharePoint.

Note!
The technical setup of the SharePoint integration is now complete. Please refer to the article Configure SharePoint Integration in MKG for the next steps.

license administrator user api document microsoft office mkg client tenant microsoft sharepoint microsoft entra

Published:19 aug 2026 12:29
TypeHandleidingen
Category
Technics, Cloud
Product
MKG5 MKG3
Availability
Openbaar