Skip to main content

​
Overview

DeepMask exposes a set of read-only SharePoint actions that let users explore sites, browse document libraries, and retrieve file content — all scoped to what the signed-in user already has access to in your Microsoft 365 tenant. Actions are grouped into four categories:
All SharePoint actions are read-only. DeepMask cannot create, modify, or delete files, folders, or sites. Every action runs on behalf of the signed-in user — they can only access content they already have permission to see.

​
Sites

​
Drives

​
Files

​
Prerequisites

Before using SharePoint actions in DeepMask, confirm the following are in place.

​
Required Access

  • Microsoft 365 account (Business Basic or higher) — Your organization must have an active Microsoft 365 or Office 365 subscription with SharePoint Online enabled.
  • User signed in via Microsoft — Each user must sign in with their own Microsoft account through DeepMask’s connector. Actions run under that user’s identity and are limited to content they already have access to.

​
What You Do Not Need

  • No developer tools, code, or command-line experience
  • No changes to existing SharePoint sites or permissions
  • No service account or shared credentials
DeepMask uses OAuth 2.0 delegated authentication. When a user connects their account, they sign in with their own Microsoft credentials. DeepMask never stores passwords or receives broader access than the user already has in your tenant.

​
Common Parameters

Several parameters appear across multiple actions.

​
Typical Workflows

​
Browsing a site you know by name

1

Find the site

Use sharepoint_search_sites with the site name as the query to get its site_id.
2

List document libraries

Call sharepoint_list_drives with the site_id to get the available drives and their drive_id values.
3

Browse folders

Call sharepoint_list_folder with a drive_id and item_id="root" to see top-level contents. Drill into sub-folders by passing the folder’s item_id.
4

Read a file

Call sharepoint_get_file_content with the drive_id and item_id of the target file.

​
Finding a file by keyword

1

Search across all sites

Call sharepoint_search_files with your search term. The results include driveId and itemId for each match.
2

Inspect or read

Pass the driveId and itemId to sharepoint_get_file_metadata (for details) or sharepoint_get_file_content (for text content).

​
Pagination

Actions that return lists (sharepoint_search_sites, sharepoint_list_folder, sharepoint_search_files) support pagination via limit and offset.

​
Security & Privacy

DeepMask is designed so that you retain full control of your data and your users’ access. This section explains the key security properties of the SharePoint integration.

​
Delegated Authentication

DeepMask uses OAuth 2.0 delegated permissions, not application-level (app-only) permissions. This means:
  • Every action performed by DeepMask is done on behalf of the signed-in user.
  • A user can only read SharePoint content they already have permission to access.
  • DeepMask cannot bypass SharePoint’s existing role-based access controls.
  • Removing a user’s SharePoint access in Microsoft 365 immediately removes their access in DeepMask.

​
No Stored Credentials

DeepMask does not store your Microsoft password, your Client Secret, or raw SharePoint content. Authentication is handled entirely through short-lived OAuth access tokens and refresh tokens, which are encrypted at rest.

​
No Service Account

Unlike some integrations that use a single shared service account to access all data, DeepMask authenticates each user individually. This ensures audit logs in your Microsoft 365 tenant accurately reflect which user accessed which content.

​
Read-Only Permissions

All SharePoint actions are strictly read-only. DeepMask requests no write, delete, or administrative permissions — it cannot create, modify, or delete files, folders, or sites. The delegated Microsoft Graph permissions used by these actions are:
If a user reports missing sites or files, confirm that admin consent has been granted for all required permissions in your Azure AD app registration. See the Enterprise Integration Setup guide for details.

​
Revoking Access

To disconnect DeepMask from SharePoint at any time:
  • In DeepMask → Connectors → Microsoft (Enterprise), click Disconnect.
Either action immediately revokes all access tokens. No data is retained after disconnection.
Questions about data residency, compliance, or security? Contact DeepMask support at support@deepmask.io.