Create a Microsoft SharePoint Online external content connector

Release version: Xanadu

Updated June 26, 2025

4 minutes to read

Create an external content connector to retrieve searchable content and security principals from your Microsoft SharePoint Online source system.

Before you begin

A source system administrator must have already configured your Microsoft SharePoint Online source system to allow access by the Microsoft SharePoint Online external content connector. For details on configuring these settings in the source system, see Create a public/private key pair for the Microsoft SharePoint Online external content connector and Configure Microsoft SharePoint Online for external content indexing.

If your Microsoft SharePoint Online tenant is in the Microsoft 365 GCC or GCC High cloud or the Microsoft 365 DoD cloud, you must have already configured the Microsoft cloud service endpoint URL. For instructions on configuring this setting, see Configure the Microsoft cloud service endpoint URL.

Role required: admin

Procedure

Navigate to All > External Content Connectors > External Content Admin Home.
If prompted, select Switch scope to switch to the External Content Connectors Admin scope.
You need to be in this scope to create or edit external content connectors.
In the Connectors section, select New.
On the Choose source page, select the SharePoint Online tile, then select Next.

On the Connector details page, fill in the required connection settings.


Connection setting	Description
Connector name	Unique name for this Microsoft SharePoint Online external content connector.
Application (client) ID	Application (client) ID for the OAuth 2.0 application defined in the Microsoft Entra admin center that grants access to your Microsoft SharePoint Online source system. If you have access to the OAuth 2.0 application's registration record in the Microsoft Entra admin center, you can navigate to Overview and copy this ID from the Application (client) ID field in the Essentials section. If you can't access the OAuth 2.0 application's registration record in the Microsoft Entra admin center, ask your Microsoft Entra administrator for the application's Application (client) ID value.
Directory (tenant) ID	Directory (tenant) ID for the OAuth 2.0 application defined in the Microsoft Entra admin center that grants access to your Microsoft SharePoint Online source system. If you have access to the OAuth 2.0 application's registration record in the Microsoft Entra admin center, you can navigate to Overview and copy this ID from the Directory (tenant) ID field in the Essentials section. If you can't access the OAuth 2.0 application's registration record in the Microsoft Entra admin center, ask your Microsoft Entra administrator for the application's Directory (tenant) ID value.
JKS Certificate	Java KeyStore (JKS) file containing a public/private key pair generated with the Java keytool utility. These keys must match the public key from the DER-encoded binary X.509 format certificate uploaded to the OAuth 2.0 application defined in the Microsoft Entra admin center that allows the Microsoft SharePoint Online external content connector to access your source system data. If you don't have a copy of the JKS file, ask your security administrator for it. You can't download the JKS file from the OAuth 2.0 application's registration record in the Microsoft Entra portal.
JKS certificate password	Password for the Java KeyStore (JKS) file specified in JKS Certificate. If you don't have the password for the JKS file, ask your security administrator for it. You can't retrieve the JKS certificate password from the registration record for the OAuth 2.0 application defined in the Microsoft Entra admin center that allows the Microsoft SharePoint Online external content connector to access your source system data.
JKS certificate thumbprint (Base 64)	Base64-encoded thumbprint SHA1 hash for the DER-encoded binary X.509 format public key certificate uploaded to the OAuth 2.0 application defined in the Microsoft Entra admin center that allows the Microsoft SharePoint Online external content connector to access your source system data. If you don't have this value, ask your Microsoft Entra administrator for the base64-encoded thumbprint SHA1 hash for the application's DER-encoded binary X.509 format public key certificate.

Select Save and validate.

Note:
If validation fails, an error message appears. Double-check your connection settings to ensure they're correct.

Result

Your new Microsoft SharePoint Online external content connector appears in the Connectors section.

What to do next

You can optionally define crawl settings for your new Microsoft SharePoint Online external content connector. Using these settings, you can limit the set of sites you want the connector to crawl, or define the file extensions for documents you want the connector's crawls to include or exclude. To learn how to configure the connector's crawl settings, see Configure crawl settings for the Microsoft SharePoint Online external content connector.

If you want the connector to crawl everything in the source system, and don't want to apply file-extension inclusion or exclusion filters, you can skip definition of crawl settings and go straight on to define a crawl schedule for your new connector or run one-time crawls for it. For details on defining a crawl schedule, see Define a crawl schedule for an external content connector. To learn about running one-time crawls, see Run a one-time full or partial document crawl for an external content connector and Run a one-time user mapping crawl for an external content connector.

You can create search sources for the connector's indexed source and link them to your search profiles. To view the connector's indexed source, navigate to All > AI Search > AI Search Index > Indexed Sources. For information about creating search sources and linking them to search profiles, see Search sources in AI Search.