SOP Purpose:
Establish a repeatable, secure process for creating Microsoft Entra application credentials that allow LIHG applications, plugins, AI agents, automations, and internal systems to communicate with Microsoft Graph services such as SharePoint.
Standard:
Administrative Microsoft usernames and passwords are never provided to developers for application integrations. Instead, a dedicated Microsoft Entra App Registration is created for each application or logical integration.
For every new integration, document:
Application/System:
Example: UHD EOD Reports
Integration Purpose:
Example: Retrieve SharePoint sites, document libraries, folders, files, and file metadata for EOD evidence selection.
Environment:
Production / Staging / Development
Microsoft Service:
Example: SharePoint Online via Microsoft Graph
Authentication Type:
Application / App-only authentication
Required Access:
Read / Read-Write / Other
Approved SharePoint Sites:
List only the SharePoint sites the application actually needs.
Use a descriptive naming convention.
Recommended format:
LIHG-[SYSTEM]-[FUNCTION]-[ENVIRONMENT]
Example for the current project:
LIHG-UHD-EOD-SharePoint-PROD
Possible future examples:
LIHG-UHD-Email-PROD
LIHG-GrantAgent-SharePoint-PROD
LIHG-PULSE-Graph-PROD
LIHG-UHD-Calendar-PROD
Do not reuse one powerful Microsoft application for unrelated systems merely for convenience.
Go to the Microsoft Entra admin center.
Navigate to:
Entra ID → App registrations → New registration
Microsoft's current Entra procedure uses this path for creating an application registration.
Enter:
LIHG-UHD-EOD-SharePoint-PROD
Select:
Accounts in this organizational directory only
This creates a single-tenant application intended only for the organization's Microsoft tenant. Microsoft recommends single-tenant registration for applications intended for one organization.
Leave this blank.
The UHD EOD integration is using app-only/server authentication and does not require an interactive user-login redirect for this authentication model.
Click:
Register
After registration, Microsoft opens the application's Overview page.
Record:
Example format:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
This becomes:
UHD_EOD_SHAREPOINT_CLIENT_ID
Example format:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
This becomes:
UHD_EOD_SHAREPOINT_TENANT_ID
Microsoft displays both the Application/Client ID and Directory/Tenant ID on the application Overview page.
Object ID
Secret ID
Enterprise Application Object ID
The developer needs the Application (client) ID and Directory (tenant) ID.
Inside the App Registration navigate to:
Manage → API permissions
Select:
Add a permission
Select:
Microsoft Graph
Then select:
Application permissions
Do not select Delegated Permissions for an unattended server integration.
Application permissions allow the application to operate without a signed-in user.
Search for:
Sites.Selected
Select:
Sites.Selected — Application
Microsoft defines this permission as allowing the application to access a subset of SharePoint site collections; the specific sites and access levels are separately authorized in SharePoint.
This should be the preferred configuration whenever technically supported.
Sites.Selected alone does not automatically grant access to a SharePoint site.
The approved site must subsequently be granted to the application.
For a read-only integration, the site-specific authorization should be:
Read
If an existing application was specifically built around tenant-wide read access and does not yet support site-specific authorization, use:
Sites.Read.All
Application permission
Microsoft defines Sites.Read.All Application permission as allowing the application to read documents and list items across all SharePoint site collections without a signed-in user. It requires administrator consent.
Because this is broader access, it should not become the default LIHG standard when Sites.Selected can accomplish the task.
For UHD EOD Reports, the application itself is read-only and should not receive:
Sites.ReadWrite.All
Sites.Manage.All
Sites.FullControl.All
unless a future approved feature genuinely requires those capabilities.
After adding the application permission, remain on:
API permissions
Review the permission carefully.
Select:
Grant admin consent for [Organization Name]
Confirm the request.
Refresh the page.
Verify the permission status displays:
Granted for [Organization Name]
Microsoft requires administrator consent for Microsoft Graph application permissions. Microsoft identifies Privileged Role Administrator as a role capable of granting consent for Microsoft Graph application permissions.
Do not proceed until the required permission shows as granted.
Navigate to:
Manage → Certificates & secrets
Select:
Client secrets
Select:
New client secret
Use a descriptive value, for example:
UHD EOD Production Graph Credential
Use the organization's approved expiration period.
Microsoft permits client-secret lifetimes up to 24 months and recommends shorter lifetimes; Microsoft also recommends certificates or federated credentials over client secrets for production applications when technically feasible.
For an existing application that specifically expects a client secret, use the client secret now and document its expiration date.
Select:
Add
Microsoft displays several fields after creating the secret.
The field the application needs is:
Copy the Value.
Do NOT give the developer merely the:
Secret ID
The Secret ID is not the application password.
Microsoft displays the actual secret value only once; after leaving the page, the value cannot be retrieved again.
Store it immediately in the approved secure credential-management location.
If the value is lost, create a new client secret rather than trying to recover the old one.
Maintain:
Application Name
Client ID
Tenant ID
Credential Created
Credential Expiration
Purpose
Owner
Production System
Permissions Granted
Approved SharePoint Sites
The credential must be rotated before expiration.
Old credentials should be removed after the replacement credential has been tested.
For the current UHD EOD integration, the developer needs these values:
# Microsoft Graph / SharePoint
UHD_EOD_SHAREPOINT_TENANT_ID=<Directory Tenant ID>
UHD_EOD_SHAREPOINT_CLIENT_ID=<Application Client ID>
UHD_EOD_SHAREPOINT_CLIENT_SECRET=<Client Secret VALUE>
UHD_EOD_SHAREPOINT_SITES=<approved SharePoint site>
UHD_EOD_SHAREPOINT_SYNC_DEPTH=2
Also provide:
Application Name:LIHG-UHD-EOD-SharePoint-PROD
Authentication:
Microsoft Graph App-Only / Client Credentials
Graph Permission:Sites.Selected (Application)
or approved compatibility permission.
Admin Consent:
Granted
Environment:
Production
Secret Expiration:
[DATE]
The following items are identifiers and may be documented internally:
Application name
Tenant ID
Client ID
SharePoint site path
Permission names
Secret expiration date
The following is confidential:
The client-secret value must never be:
committed to GitHub;
placed in application source code;
stored in README files;
placed in handover documentation;
placed in screenshots;
included in EOD reports.
The preferred handoff is either:
an administrator places the secret directly into the production environment; or
the secret is provided through an approved secure credential-management mechanism.
The source repository should contain only placeholders.
The developer or authorized DevOps administrator enters the credentials into the server's production environment:
UHD_EOD_SHAREPOINT_TENANT_ID=ACTUAL_TENANT_GUID
UHD_EOD_SHAREPOINT_CLIENT_ID=ACTUAL_CLIENT_GUID
UHD_EOD_SHAREPOINT_CLIENT_SECRET=ACTUAL_SECRET_VALUE
UHD_EOD_SHAREPOINT_SITES=ACTUAL_SHAREPOINT_SITE
UHD_EOD_SHAREPOINT_SYNC_DEPTH=2
The real values must remain outside Git source control.
After configuration, the developer must demonstrate that:
UHD successfully authenticates with Microsoft Graph.
The configured SharePoint site appears.
Document libraries populate.
Folder paths populate.
Files populate.
A selected file returns its correct file link.
The SharePoint item ID is stored correctly.
The filename populates when available.
An unauthorized/non-approved SharePoint site cannot be accessed when Sites.Selected is being used.
No real credential appears in GitHub or logs.
Only after successful verification should the Microsoft Graph integration be marked production complete.
Before the existing credential expires:
Open the existing Entra App Registration.
Go to Certificates & secrets.
Create a second credential.
Copy its new Value.
Update production.
Test Microsoft Graph connectivity.
Confirm the integration operates normally.
Delete the old client secret.
Update the credential register with the new expiration date.
Never delete the active credential before confirming that the replacement works.
Before handing an integration to a developer, confirm:
☐ Dedicated App Registration created
☐ Descriptive enterprise app name used
☐ Single-tenant account type selected
☐ Tenant ID recorded
☐ Client ID recorded
☐ Correct Microsoft Graph Application permission selected
☐ Least-privilege permission used
☐ Admin consent granted
☐ Client credential created
☐ Client-secret Value, not Secret ID, captured
☐ Expiration date recorded
☐ Approved SharePoint site(s) documented
☐ Secret securely stored
☐ Developer .env variable names documented
☐ Secret excluded from Git/source control
☐ Production integration test required
☐ Credential rotation date tracked