CogLake User Guide

Before you start

You need permission to manage connectors in CogLake, a Microsoft work account with access to the site, and an Entra administrator who can register an application and approve its delegated permissions. This connector reads documents; it does not write to SharePoint. Use a dedicated account with access only to the intended sites.

1. Register the Microsoft application

Open Microsoft Entra ID in the Azure portal or Entra admin center.

Manage Microsoft Entra ID tile in Azure — Open Microsoft Entra ID in your organization's directory.

Choose App registrations → New registration, or Add → App registration.

Entra Add menu with App registration — Create a new app registration for the CogLake connector.

Name the application CogLake SharePoint. For one organization, choose Accounts in this organizational directory only. A multitenant registration is only necessary when the same app must be used by multiple Microsoft organizations.

Microsoft application registration and Web redirect URI fields — The screenshot illustrates the form. Its multitenant selection and example URL are not required defaults: use your account type and the exact URL copied from CogLake.

In CogLake, open Administration → Connections → Connectors → Add connector → SharePoint → Connection. Copy the readonly OAuth redirect URI. In Entra, select platform Web and paste it as a redirect URI. For example, a Load installation uses https://load.coglake.com/api/coglake/connectors/oauth/sharepoint/callback. Never copy localhost or the screenshot's example address into a deployed installation.

2. Credentials and permissions

From the registration's Overview, copy Application (client) ID and Directory (tenant) ID into CogLake.
Under Certificates & secrets, create a client secret. Copy its Value, not its secret ID, into the password field. Record its expiry in your organization's credential rotation process.
Under API permissions → Microsoft Graph → Delegated permissions, configure User.Read, Files.Read.All, Sites.Read.All, offline_access, openid and profile. Ask your Entra administrator to grant the required consent. Do not substitute application permissions: this connector uses an interactive delegated flow.
Enter the actual site URL, such as https://contoso.sharepoint.com/sites/operations. A document sharing link or an Entra portal URL is not a site URL.

Microsoft reference: application registration and Graph permissions.

3. Connect, then finish all remaining steps

Select Connect, sign in at Microsoft and approve the requested access. Keep the same CogLake browser session. After returning, the wizard continues at Sync, not at the finished connector list.

Sync: choose Microsoft Graph delta for scheduled incremental updates, or Manual only. Set the interval to match your needs.
Scope: choose which document libraries/folders CogLake should import. Start with a small allowlist for the first test. A failed listing is an error to resolve, not a reason to import everything.
Permissions: select the CogLake roles that may search or read the source. Source document permissions still apply; granting a connector role is not a replacement for SharePoint access.
Save: only now is setup complete. Scheduled synchronization can begin when enabled; Manual only waits for Start sync.

An unfinished OAuth setup stays as a paused draft. Reopen its settings to continue. Do not share secrets or authorization links in support screenshots.

Verify the result

Check connection health, run a sync, wait for processing/indexing to finish and search for a known document title or phrase. Test with both an authorized employee and a user who must not see the document. The connector card reports sync progress; diagnostics explain individual import failures. Removing a connector does not delete SharePoint files.

Troubleshooting

Symptom	Check
Redirect URI mismatch / AADSTS50011	The Entra Web callback must exactly match the URL copied from this installation.
Invalid secret	Use the secret value and check its expiry.
Consent required / access denied	Verify delegated scopes, administrator consent and the signed-in account's site access.
Callback fails after switching browsers	Restart Connect in the same authenticated CogLake session. OAuth state is short-lived and single-use.
Libraries cannot be loaded	Check site URL, Microsoft account access and Graph connectivity; retry before saving scope.
Documents imported but no search result	Check processing/indexing status, role access and source permissions.

Kurzanleitung auf Deutsch

Entra ID öffnen → App-Registrierung anlegen → Plattform Web → die unveränderbare Weiterleitungs-URL aus CogLake kopieren. Für die eigene Organisation normalerweise nur dieses Verzeichnis wählen; die Abbildung zeigt lediglich ein Beispiel. Anwendungs-ID, Verzeichnis-ID und den Wert des Clientgeheimnisses in CogLake eintragen. Die delegierten Graph-Berechtigungen aus Schritt 2 durch den Entra-Administrator genehmigen lassen. Die echte SharePoint-Site-URL eintragen und Verbinden wählen. Nach der Microsoft-Anmeldung Synchronisierung, Umfang und Berechtigungen abschließen und speichern. Ein Entwurf synchronisiert noch nicht. Danach einen kleinen Import und die Suche mit berechtigten und nicht berechtigten Benutzern prüfen.

SharePoint