Skip to main content

SharePoint integration: technical description for IT and information security

How Legartis imports documents from SharePoint Online: architecture, permissions, flow, revocation

1. Purpose

Legartis continuously imports one chosen folder of a SharePoint Online document library, one way only, into a folder in your Legartis workspace, so the Legal Agent can search its contents. Legartis never writes, changes or deletes anything in SharePoint.

2. Architecture

  • The connection uses the official Microsoft Graph API (graph.microsoft.com). Sign-in goes through Microsoft Entra ID (login.microsoftonline.com).

  • Legartis operates its own multi-tenant Entra application, "Legartis SharePoint Import". Its client secret is held only by Legartis, in a secured secret store.

  • Nothing is installed on your side: no agent, no gateway, and no inbound firewall rule. All connections are outbound from Legartis to Microsoft endpoints, encrypted with TLS.

3. Permissions

Legartis uses two Microsoft Graph permissions with clearly separated jobs:

  • Import (ongoing): application permission Sites.Selected, read only. On its own it grants no access to any site. Legartis can read only the sites that are explicitly shared with its app, and only with read rights. The import runs without a user context (OAuth 2.0 client credentials). No user passwords are stored. Per workspace, Legartis stores only non-secret IDs: tenant, site, library and folder.

  • Setup (one-off): delegated permission Sites.FullControl.All. It is used only on behalf of the signed-in administrator during setup, to search sites and to give the Legartis app read access to the chosen site with one click. It never reaches further than that administrator's own rights. The resulting token is stored encrypted, used for at most 24 hours from sign-in, and deleted after that and on disconnect. The import never uses it. This is why Microsoft's consent screen shows the line "Have full control of all site collections".

  • The one-off admin consent for Sites.Selected requires the Global Administrator or Privileged Role Administrator role. Microsoft requires this for Graph application permissions.

  • Instead of the one-click grant, your IT can also share the site with the Legartis app itself, for example with PnP PowerShell:

Grant-PnPAzureADAppSitePermission -AppId <Legartis app ID> -DisplayName "Legartis SharePoint Import" -Site https://<tenant>.sharepoint.com/sites/<site> -Permissions Read

4. Flow

  1. A Legartis workspace admin opens Integrations → SharePoint and connects. A Microsoft administrator signs in and gives consent. Legartis reads the tenant from the signed id_token. A workspace is bound to exactly one tenant.

  2. The administrator searches for the library's site and grants the Legartis app read access to it (or IT does this itself, see section 3).

  3. In the Legartis workspace, the admin picks the library, the source folder, the target folder and the team that gets access.

  4. The first run imports every file below the source folder. After that, Legartis asks Graph for changes only, every 5 minutes: new files become new documents, changed content becomes a new version, and renames and moves are applied. Deletions in SharePoint are not applied in version 1. The document stays in Legartis until it is deleted there.

  5. Unsupported formats and files that are too large are skipped and counted in the status display.

5. Data processing and access in Legartis

  • Imported files are stored and processed exactly like manually uploaded documents: text extraction, OCR for scanned PDFs, and indexing for the Legal Agent's search. The same hosting, encryption and data processing terms (DPA/TOMs) apply as before.

  • Inside Legartis, only members of the team chosen at setup can see the content.

  • SharePoint permissions on individual subfolders are not carried over. The shared folder should therefore contain only content meant for that team.

6. Revocation

Access can be ended at any time:

  • in Legartis, with Disconnect,

  • in SharePoint, by removing the site permission,

  • or in Entra ID, by deleting the enterprise application "Legartis SharePoint Import".

The last two take effect on Microsoft's side immediately.

7. What we need from you

  • a Microsoft administrator for the one-off consent and the site grant,

  • the site URL and the folder to import.

Did this answer your question?