Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-11-13
Configure a Custom OAuth App for Self-Service Agent Sharepoint Connector

Configure a Custom OAuth App for Self-Service Agent Sharepoint Connector

Security: Set up and enable Agent System of Record and Self-Service Agent:
People and Roles:
  • Registering the app: A Microsoft Entra user who can register applications, such as an Application Administrator, Application Developer, or Global Administrator role.
  • Granting admin consent: A Microsoft Entra Global Administrator or Privileged Role Administrator who is available on standby during setup
  • Workday: A Workday account with access to the
    Agent Management Hub
     and
    Agent Documents
     security domains in the Agent System of Record functional area.
Accounts: A designated SharePoint service account, not an individual’s account, with read access to the sites and libraries holding your policy documents. If you connect a personal account and that person leaves your organisation, the connector breaks.
Values to collect before you start:
  • Redirect URL: In Workday, access
    Agent Management Hub
    Agent Registry
    Self-Service Agent
    Documents
    Manage Connectors
    Add Connector
    Microsoft SharePoint
    Provide Your Own SharePoint App
    . Click
    Copy
     beside the
    Your SharePoint App Redirect URL
     field and save the value. Close the dialog without submitting. You need this value for step 1.
  • Directory (tenant) ID: In the Microsoft Entra admin center, open the Overview page. Copy and save the ID. You need this value for step 5.
You can enable the Self-Service Agent to use documents in your Microsoft SharePoint account to answer your employees' policy-related questions. This increases the relevancy of Self-Service Agent responses without the need to manually upload your existing documents to Workday.
When you don't have the Help SKU, ensure you connect to SharePoint before enabling the Policy Intelligence skill on the Self-Service Agent so that you don't encounter an error.
To configure your connector using the Workday-managed OAuth app, see Connect a Microsoft SharePoint Account to Self-Service Agent.
  1. Register the app in Microsoft Entra.
    • Go to
      Entra ID
      App registrations
       and click
      New registration
      . In some tenants, this is under
      Identity
      Applications
      App registrations
      .
    Enter these values:
    Option Description
    Name
    Workday - Sharepoint
    Support Accounted Types
    Accounts in this organizational directory only (Single tenant).
    Redirect URI
    1. Platform: Web.
    2. Enter the redirect URL you copied in the prerequisites. It must match exactly, including any trailing path.
    • Click
      Register
      .
    • On the app’s Overview page, copy the
      Application (client) ID
      . This is your Client ID for step 4.
  2. Add application permissions.
    1. In the app registration, navigate to API permissions in the sidebar.
    2. Select
      Add a permission
      Microsoft Graph
      Application permissions
      .
    3. Add these scopes:
      1. Sites.Read.All
      2. Files.Read.All
      3. User.ReadBasic.All
      4. GroupMember.Read.All
    4. Click
      Add a permission
      SharePoint
      Application permissions
      . Add Sites.Read.All, and then click
      Add Permissions
      . This permission displays in the list as
      Office 365 SharePoint Online
      .
    5. Click
      Add a permission
      Microsoft Graph
      Delegated permissions
      . Add these permissions and click
      Add permissions
      :
      • offline_access
      • Files.Read.All
      • GroupMember.Read.All
      • Sites.Read.All
      • User.ReadBasic.All
    6. Remove the default delegated permission. In the permissions list, find
      Microsoft Graph
      User.Read (Delegated)
      . Click
      ...
      Remove permission
       and confirm.
  3. Add a certificate.
    1. Create a certificate with a validity period your organization allows (we recommend 12 months). Save the public certificate (.cer, .crt, or .pem) and the private key separately. A self-signed certificate is acceptable.
    2. In the app registration, select
      Certificates & secrets
      Certificates
      Upload certificate
      .
    3. Select the public certificate file, enter a meaningful description. Example:
      Workday SharePoint Agent Integrations
      , and click
      Add
      .
    4. Record the certificate’s
      Thumbprint
      and
      Expires
      date, and assign an owner for renewal. The connector stops working when the certificate expires.
      Upload only the public certificate to Entra. Never upload the private key, and never share it in email, chat, or a ticket.
  4. Provide your own SharePoint App in Workday.
    1. Access the
      Agent Management Hub
      .
    2. On the
      Agent Registry
       tab, click
      Self-Service Agent
      .
    3. On the
      Documents
      tab, click
      Manage Connectors
      .
    4. Click
      Provide Your Own Sharepoint App
      .
    5. Enter your Client ID and Client Secret from step 1.
    6. Click
      Continue
      to sign into your SharePoint user account.
The Self-Service Agent can now access your SharePoint policy documents and use them to answer questions. Self-Service Agent enforces the SharePoint file security when providing answers.
Test the Self-Service Agent to verify the accuracy of its responses related to the information in your SharePoint policy documents.