Sharepoint File Store

Description	A SharePoint document library (drive) accessed through Microsoft Graph
Type	sharepoint
Category	File

This store allows listing, reading, writing, and deleting files in a SharePoint document library. Authentication uses an Azure AD application (client credentials).

Therefore, it is not possible with this filestore to:

Append to an existing file (write always replaces the full file)

ℹ️ Note: When a file already exists, it is updated in place so that existing sharing links are preserved.

Configuration in States

The SharePoint File Store can be configured directly in the States interface via the Data Stores module. The following configuration mode is available:

Parameters

Name	Description	Mandatory	Default	Comment
Tenant Id	The Azure AD tenant identifier	Yes	—	Directory (tenant) ID of the Azure AD application
Client Id	The Azure AD application (client) ID	Yes	—
Client Secret	The Azure AD application client secret	Yes	—	Value is hidden
Site Url	The SharePoint site identifier used by Microsoft Graph	Yes	—	Format: `hostname:/sites/siteName` (e.g. `contoso.sharepoint.com:/sites/Finance`)
Drive Name	The name of the document library (drive) in the site	Yes	—	Matched case-insensitively. For the default library this is often `Documents`
Check Health Write Access	When enabled, the health check also creates and deletes a temporary file	No	false	Requires write permission on the drive

ℹ️ Note: The Azure AD application must be granted Microsoft Graph application permissions to the site and drive (for example Sites.Read.All / Sites.ReadWrite.All, or Sites.Selected with the site granted to the app). The Worker authenticates with the <https://graph.microsoft.com/.default> scope.

Local Configuration

The local configuration is defined in a JSON file (stores.json) deployed directly on the Workers' server. A locally configured store takes priority over a store with the same name configured in the States interface.

Name	Description	Type	Mandatory	Comment
TenantId	Azure AD tenant identifier	string	True	Directory (tenant) ID of the Azure AD application
ClientId	Azure AD application (client) ID	string	True
ClientSecret	Azure AD application client secret	string	True
SiteUrl	SharePoint site identifier used by Microsoft Graph	string	True	Format: `hostname:/sites/siteName`
DriveName	Name of the document library (drive)	string	True	Matched case-insensitively
CheckHealthWriteAccess	Include a write/delete test in the health check	bool	False	Default: `false`

JSON

{
    "Name": "sharepoint-finance",
    "Type": "sharepoint",
    "HealthCheck": true,
    "Config": {
        "TenantId": "00000000-0000-0000-0000-000000000000",
        "ClientId": "11111111-1111-1111-1111-111111111111",
        "ClientSecret": "your-client-secret",
        "SiteUrl": "contoso.sharepoint.com:/sites/Finance",
        "DriveName": "Documents",
        "CheckHealthWriteAccess": false
    }
}

SiteUrl is the Graph hostname + site-relative path (Sites[{SiteUrl}] in code), not a full https://… URL.
DriveName is the library display name (often Documents), not a drive id.
Client secret is the only secret; there is no username/password or certificate path on this store.