Set up Microsoft 365: SharePoint filing and Microsoft accounts, step by step

1. Before you start

2. In Microsoft Entra: register your app

Sign in to the Microsoft Entra admin center (Microsoft Learn: register an application).

1. Go to Entra ID → App registrations → New registration.
2. Name: for example AhlanHamad HR. Supported account types: Single tenant only (your own organisation). Click Register.
3. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID. You paste both into AhlanHamad (find your tenant ID).
4. Add the redirect URI: Manage → Authentication → Add Redirect URI → Web, enter https://ahlanhamad.com/auth/microsoft-365/callback exactly as written, and click Configure (Microsoft Learn: add a redirect URI). Older screens show this as Add a platform → Web.
5. Create the secret: Certificates & secrets → Client secrets → New client secret, add a description, pick an expiry (Microsoft allows at most 24 months) and click Add. Copy the Value straight away: Microsoft never shows it again (Microsoft Learn: add credentials). Note the expiry date in your calendar: when it passes, the connection stops until you enter a new secret.

3. Give the app its SharePoint permissions

1. In the app, open API permissions → Add a permission → Microsoft Graph → Delegated permissions.
2. Tick Sites.ReadWrite.All and Files.ReadWrite.All, and under OpenId permissions offline_access, openid and profile. Click Add permissions.
3. Click Grant admin consent for <your organisation> and confirm, so nobody is asked to consent alone and the Status shows Granted (Microsoft Learn: grant admin consent).

4. In AhlanHamad: connect Microsoft 365

1. Go to Integrations and open Microsoft 365 / SharePoint. The card is called Microsoft 365 Connection.
2. Client ID: the Application (client) ID. Client Secret: the secret's Value from section 2.
3. Azure AD Tenant ID: the Directory (tenant) ID from section 2.
4. SharePoint Host: the start of your SharePoint address, for example company.sharepoint.com (open SharePoint in the browser and copy the part before the first /).
5. SharePoint Site ID (optional): leave it empty. Once document filing is switched on you pick the site and library from a list.
6. Check that the address under Redirect URI to register on your app is the one on your Azure app.
7. Click Connect to Microsoft 365. AhlanHamad says “Azure AD OAuth initiated — complete sign-in to authorize access” and opens Microsoft.
8. Sign in with the account from section 1 and accept the permissions.
9. You come back to a page that says Connected to Microsoft 365, then to the Microsoft 365 page, where the card says Connected to Microsoft 365 / SharePoint with your SharePoint Host and Azure AD Tenant ID.

Your app's ID and secret stay saved. If you connect again later, the card says “Your app credentials are saved. Click Connect to sign in with them — no need to enter them again.” To use a new secret, click Replace credentials.

5. Microsoft accounts: the application permission (once switched on)

When we switch Microsoft account changes on, a Microsoft accounts (Entra ID) section appears under the connection, with the tabs Permission, Settings, Link existing users and Activity. Account changes use the same Azure app, but as itself (an application permission), not as the person who connected, so they keep working after that person leaves.

1. In the Microsoft Entra admin center, open Entra ID → App registrations → your app.
2. API permissions → Add a permission → Microsoft Graph → Application permissions → User.ReadWrite.All → Add permissions.
3. Recommended: add User.RevokeSessions.All (application) the same way. Microsoft lists only this application permission for ending a user's sign-in sessions (Microsoft Learn: revokeSignInSessions); without it the account is still disabled, but sessions already open aren't ended at once.
4. Optional: add Domain.Read.All (application) so AhlanHamad can list your verified domains. Without it, you type the domain.
5. A Privileged Role Administrator or Global Administrator clicks Grant admin consent for <your organisation> and confirms. The Status must show Granted.
6. Back in AhlanHamad, press Test connection on the Permission tab. “The app works — waiting account changes will resume” means it works; the page shows what Microsoft granted under What the last test saw.

• Link existing users → Read directory matches your Microsoft users to employees (exact email, then similar names). Nothing is linked until you confirm, and nothing changes in Microsoft.
• Settings: Disable the account when the employee leaves, and Create accounts for new hires (off until you turn it on) with the Domain for sign-in names, the Sign-in name pattern and the Usage location. Click Save.
• When someone leaves: their linked Microsoft account is disabled and signed out at the end of their last working day, in your company's time zone. A rehire turns it back on.
• New hires (only if switched on): a temporary password is emailed once to the manager or HR; they must change it at first sign-in, and AhlanHamad keeps no copy. Licences are not assigned: do that in the Microsoft 365 admin center or with group-based licensing.
• Administrator accounts can't be disabled this way: Microsoft refuses it to this permission (who can perform sensitive actions). The Activity row says so; handle those in the Entra admin center.

6. SharePoint filing (once switched on)

1. When we switch document filing on, the page gets the tabs Connection, Document push and Activity.
2. On Document push, click Load sites, choose the Site and the Document library. Use a library only HR can open: files take the library's permissions.
3. Check the Folder template (by default a folder per employee, with a sub-folder per type) and the preview under it.
4. Under What to push, switch on the types you want: Employment contracts, HR letters, Employee documents, Offer letters. Click Save.
5. Payslips are separate: switching Push payslips to SharePoint on asks you to confirm (“Send payslips to SharePoint?”), because salary figures then live in your SharePoint.

• Only documents issued or uploaded after you switch a type on are filed; earlier ones are not sent.
• AhlanHamad doesn't share files with employees one by one, and never deletes anything in SharePoint. Files already there are your copies.

7. Troubleshooting

8. Disconnecting

1. In AhlanHamad, go to Integrations → Microsoft 365 / SharePoint and click Disconnect Microsoft 365. AhlanHamad deletes the stored secret and sign-in, and makes no more uploads or account changes.
2. AhlanHamad cannot withdraw anything at Microsoft for you. To close the door completely, delete the client secret (or the whole app registration) in the Microsoft Entra admin center.

• Files already in SharePoint and accounts already disabled stay as they are.

Microsoft sources used in this guide

• Microsoft Entra: register an application, add a redirect URI, add a client secret, find your tenant ID.
• Consent: grant tenant-wide admin consent, configure user consent.
• Microsoft Graph: permissions reference, revokeSignInSessions, who can perform sensitive actions on users.
• Microsoft's menus change from time to time. If a name here doesn't match your screen, the linked page has Microsoft's current wording.