MCP SharePoint in Agent Builder Does Not Function With Application-Only Sites.Selected Access

ChatGPT Bugs
1

Hi everyone,
I’m running into a permissions-related limitation when integrating MCP SharePoint into an Agent Builder flow, and I want to confirm whether this is expected behavior or if there’s a recommended workaround.

Context

I have an Azure AD–registered application with:

1. Delegated permissions:

  • User.Read
    This is tied to my personal Microsoft Graph session.

2. Application permissions:

  • Sites.Selected
    The app is granted explicit access to a specific SharePoint site created for this project.
    Due to organizational policy, we cannot enable Sites.Read.All or any broad “all sites” permissions.

Both permission sets are valid and have been confirmed by our technical support team.
I can successfully perform Graph API operations with the app-only token in Postman.

What Works

When I connect MCP SharePoint inside Agent Builder using my personal delegated token, everything works:

  • Listing files

  • Retrieving content

  • Searching

  • General flow execution

However, I do not want to rely on delegated/personal tokens in production because:

  • They expire (after 1 hour) and cannot be extended due to policy

  • They rely on my personal identity, not an application identity

  • They do not scale for a production workflow

What Fails

When I switch to the application-level token (App ID + Secret + Certificates) with Sites.Selected:

  • The MCP connector fails to browse or index the SharePoint site

  • Agent Builder cannot execute file listing or search

  • The flow effectively breaks, even though the app token works in Postman

After testing and troubleshooting, it looks like Agent Builder currently requires broad site access (e.g., Sites.Read.All) to perform its internal operations such as:

  • Search

  • Autocomplete

  • Recursive browsing

  • Directory walking

The issue is that app-only access with Sites.Selected does not permit global search operations in SharePoint Online, and therefore Agent Builder can’t resolve queries or list content.

What I Cannot Change

Due to enterprise security policy:

  • I cannot request Sites.Read.All or Files.Read.All for the application

  • I cannot expand delegated permissions

  • I cannot rely on a personal Graph token for production

Possible Workaround (But Imperfect)

I could use the File Search connector with a separate file-sync job and deploy via the Agent SDK — but this adds:

  • Additional maintenance

  • A separate syncing script

  • Responsibility for keeping file lists current

This defeats the purpose of using a managed connector.

My Questions

1. Is it expected that MCP SharePoint currently works only with delegated tokens or global app permissions?

And not with Sites.Selected app-only scopes?

2. Is there a planned update for MCP SharePoint to support:

  • Least-privilege app-only access,

  • Per-site permissions,

  • Or Sites.Selected for restricted enterprise environments?

3. Is there any current way to make MCP SharePoint work in Agent Builder with app-only, site-scoped access without changing our tenant’s security policies?

4. If support for restricted scopes is on the roadmap, is there an approximate timeline?

Desired Outcome

I want to connect Agent Builder to a SharePoint site exclusively using an application-level Sites.Selected token, without:

  • escalating permissions globally,

  • relying on delegated personal tokens, or

  • maintaining a custom sync pipeline.

Any insights from the OpenAI team or the community would be incredibly helpful.
Thank you!

2

Hi there,

kind follow-up (after 3 weeks). Any chance for the response by the OpenAI team?

Thank you!

Best,

Slava

3

Hey @Slava_Mirovsky, These are some great questions and apologies for the delay. Below is our findings.

Q1) Yes — this is expected behavior today. The managed SharePoint connector relies on delegated OAuth or broader Graph permissions (like Sites.Read.All) for operations such as site resolution and search, and the ChatGPT connector auth flow currently doesn’t support client-credentials/app-only tokens directly.

Docs (for reference):

Q2) Is there a planned update to support least-privilege app-only (Sites.Selected)?

Nothing officially committed in docs yet, but the team is actively working around improving access control models. That said, there’s no concrete timeline we can share right now.

Q3) Any current way to make MCP SharePoint work in Agent Builder with app-only, site-scoped access without changing tenant policy?

At the moment, not with the managed SharePoint connector. Since connector operations depend on broader Graph permissions and user-interactive auth, Sites.Selected app-only setups will run into the limitations you’re seeing.

Q4) If support is on the roadmap, approximate timeline?

Same as Q2 — no confirmed timeline yet. Apologies, but as stated above our team is actively looking to improve this behaviour and make it more flexible for use cases as you described.

Thank you!

1 Like