> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.deepmask.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview - SharePoint (Enterprise)

> A reference for every SharePoint action available in DeepMask — what each one does, when to use it, and what parameters it accepts.

## Overview

DeepMask exposes a set of read-only SharePoint actions that let users explore sites, browse document libraries, and retrieve file content — all scoped to what the signed-in user already has access to in your Microsoft 365 tenant.

Actions are grouped into four categories:

| Category   | Actions | Purpose                                                   |
| ---------- | ------- | --------------------------------------------------------- |
| **Sites**  | 3       | Discover and inspect SharePoint sites                     |
| **Drives** | 2       | List and inspect document libraries within a site         |
| **Files**  | 3       | Browse folders, read metadata, and download file content  |
| **Search** | 1       | Full-text search across all accessible SharePoint content |

<Info>
  All SharePoint actions are read-only. DeepMask cannot create, modify, or delete files, folders, or sites. Every action runs on behalf of the signed-in user — they can only access content they already have permission to see.
</Info>

### Sites

| Action                     | Description                                                                                       |
| -------------------------- | ------------------------------------------------------------------------------------------------- |
| `sharepoint_get_root_site` | Returns the tenant's root SharePoint site. Good starting point when you don't yet have a site ID. |
| `sharepoint_search_sites`  | Search for SharePoint sites by keyword. Returns site IDs, display names, and URLs.                |
| `sharepoint_get_site`      | Returns full metadata for a single site by its ID.                                                |

### Drives

| Action                   | Description                                                                                     |
| ------------------------ | ----------------------------------------------------------------------------------------------- |
| `sharepoint_list_drives` | Lists all document libraries (drives) within a site. Returns drive IDs for use in file actions. |
| `sharepoint_get_drive`   | Returns metadata for a specific drive, including name, type, URL, and storage quota.            |

### Files

| Action                         | Description                                                                                        |
| ------------------------------ | -------------------------------------------------------------------------------------------------- |
| `sharepoint_list_folder`       | Lists files and sub-folders inside a drive folder. Use `item_id="root"` to start at the top.       |
| `sharepoint_get_file_metadata` | Returns name, size, MIME type, and timestamps for a file or folder — without downloading content.  |
| `sharepoint_get_file_content`  | Downloads and returns the text content of a file. Best for `.txt`, `.csv`, `.json`, `.xml`, `.md`. |

### Search

| Action                    | Description                                                                                                          |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `sharepoint_search_files` | Full-text KQL search across all SharePoint files the user can access. Returns `driveId` and `itemId` for each match. |

***

## Prerequisites

Before using SharePoint actions in DeepMask, confirm the following are in place.

### Required Access

* **Microsoft 365 account (Business Basic or higher)** — Your organization must have an active Microsoft 365 or Office 365 subscription with SharePoint Online enabled.
* **User signed in via Microsoft** — Each user must sign in with their own Microsoft account through DeepMask's connector. Actions run under that user's identity and are limited to content they already have access to.

### What You Do Not Need

* No developer tools, code, or command-line experience
* No changes to existing SharePoint sites or permissions
* No service account or shared credentials

<Info>
  DeepMask uses OAuth 2.0 delegated authentication. When a user connects their account, they sign in with their own Microsoft credentials. DeepMask never stores passwords or receives broader access than the user already has in your tenant.
</Info>

***

## Common Parameters

Several parameters appear across multiple actions.

| Parameter         | Type                       | Description                                                                                                       |
| ----------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| `response_format` | `"markdown"` \| `"json"`   | Controls the output format. `"markdown"` (default) returns human-readable text; `"json"` returns structured data. |
| `limit`           | number (1–100, default 20) | Maximum number of results to return in a single call.                                                             |
| `offset`          | number (default 0)         | Number of results to skip. Use with `limit` to page through large result sets.                                    |

***

## Typical Workflows

### Browsing a site you know by name

<Steps>
  <Step title="Find the site">
    Use `sharepoint_search_sites` with the site name as the query to get its `site_id`.
  </Step>

  <Step title="List document libraries">
    Call `sharepoint_list_drives` with the `site_id` to get the available drives and their `drive_id` values.
  </Step>

  <Step title="Browse folders">
    Call `sharepoint_list_folder` with a `drive_id` and `item_id="root"` to see top-level contents. Drill into sub-folders by passing the folder's `item_id`.
  </Step>

  <Step title="Read a file">
    Call `sharepoint_get_file_content` with the `drive_id` and `item_id` of the target file.
  </Step>
</Steps>

### Finding a file by keyword

<Steps>
  <Step title="Search across all sites">
    Call `sharepoint_search_files` with your search term. The results include `driveId` and `itemId` for each match.
  </Step>

  <Step title="Inspect or read">
    Pass the `driveId` and `itemId` to `sharepoint_get_file_metadata` (for details) or `sharepoint_get_file_content` (for text content).
  </Step>
</Steps>

***

## Pagination

Actions that return lists (`sharepoint_search_sites`, `sharepoint_list_folder`, `sharepoint_search_files`) support pagination via `limit` and `offset`.

| Field in response | Description                                                 |
| ----------------- | ----------------------------------------------------------- |
| `count`           | Number of items in this page                                |
| `total_count`     | Total matching items (where available)                      |
| `has_more`        | `true` if there are more pages                              |
| `next_offset`     | Pass this as `offset` in the next call to get the next page |

***

## Security & Privacy

DeepMask is designed so that you retain full control of your data and your users' access. This section explains the key security properties of the SharePoint integration.

### Delegated Authentication

DeepMask uses OAuth 2.0 delegated permissions, not application-level (app-only) permissions. This means:

* Every action performed by DeepMask is done on behalf of the signed-in user.
* A user can only read SharePoint content they already have permission to access.
* DeepMask cannot bypass SharePoint's existing role-based access controls.
* Removing a user's SharePoint access in Microsoft 365 immediately removes their access in DeepMask.

### No Stored Credentials

DeepMask does not store your Microsoft password, your Client Secret, or raw SharePoint content. Authentication is handled entirely through short-lived OAuth access tokens and refresh tokens, which are encrypted at rest.

### No Service Account

Unlike some integrations that use a single shared service account to access all data, DeepMask authenticates each user individually. This ensures audit logs in your Microsoft 365 tenant accurately reflect which user accessed which content.

### Read-Only Permissions

All SharePoint actions are strictly read-only. DeepMask requests no write, delete, or administrative permissions — it cannot create, modify, or delete files, folders, or sites.

The delegated Microsoft Graph permissions used by these actions are:

| Permission       | Actions that use it                           |
| ---------------- | --------------------------------------------- |
| `User.Read`      | All actions (identity context)                |
| `Sites.Read.All` | All site and drive actions                    |
| `Files.Read.All` | All file and search actions                   |
| `offline_access` | Keeps the user's session active between calls |

<Info>
  If a user reports missing sites or files, confirm that admin consent has been granted for all required permissions in your Azure AD app registration. See the [Enterprise Integration Setup](/docs/enterprise-integration-setup) guide for details.
</Info>

### Revoking Access

To disconnect DeepMask from SharePoint at any time:

* In DeepMask → **Connectors** → **Microsoft (Enterprise)**, click **Disconnect**.

Either action immediately revokes all access tokens. No data is retained after disconnection.

<Info>
  Questions about data residency, compliance, or security? Contact DeepMask support at [support@deepmask.io](mailto:support@deepmask.io).
</Info>