Question

Which user rights should I have when using the FME SharePoint List Reader?

  • 22 December 2021
  • 3 replies
  • 11 views
F
Badge

I know that the SharePoint List reader and the SharePointOnline connector are quite different from each other. Using a registered app on Azure worked fine for the SharePointOnline connector and its attached web service - but for the list reader, the web connection only required us to exchange the [TENANT] with our sharepoint tenant without changing anything else. This was working fine on our testing SharePoint platform using a non-personal user account to logon with.

 

However, on our actual SharePoint platform, this trick does not work when using my own user credentials (it notifies me that the app needs admin rights) - and I am asking myself why. Does the user need to have certain rights in order to use the web connection?

 

Then, as a second attempt, I followed the workflow here https://community.safe.com/s/article/How-to-create-a-Sharepoint-Web-Connection and it let me successfully test the connection as we have a registered app on Azure. But this failed when I tried to actually use the web connection when adding the FME SharePoint List Reader returning a server error 401.

 

The question is now, what is the right way to setup this connection?

 

I attached two screenshots - one showing the message of a successful connection on the test sharepoint and another one that failed on our actual sharepoint platform.

 

Thanks!

Ferid

2 Attachments

3 replies

danminneyatsaf
Rank
Userlevel 2
Badge +10

Hi @fungergis​ the SharepointOnlineConnector automatically adds the necessary read/write scopes which may be causing this confusion. The SharePoint List Reader on the other hand requires that you set the permissions explicitly on the registered app (e.g. AllSites.Read).

 

For your app, do you have the appropriate permissions set? If not I would try adjusting these and see if it fixes your problem.

 

Let me know how that goes!

F
Badge

Hi @fungergis​ the SharepointOnlineConnector automatically adds the necessary read/write scopes which may be causing this confusion. The SharePoint List Reader on the other hand requires that you set the permissions explicitly on the registered app (e.g. AllSites.Read).

 

For your app, do you have the appropriate permissions set? If not I would try adjusting these and see if it fixes your problem.

 

Let me know how that goes!

Hi Dan,

 

thanks for your post - after almost 2 months, I can tell that we also tried to create a new azure multitenant app and followed the instruction here and the video here to the detail.

 

The only thing that is really working - and that requires a super user with all possible admin rights - is the first option to replace the [TENANT] in the web service definition:

imageThe multitenant app our admins created for me comes along with all the rights as per tutorial - but no matter if I try the multitenant or the singletenant way of connecting, I always get this prompt which is basically telling that admin approval is necessary in order to access the resources of my organization:

imageWhen we magically made it happen that the url got successfully tested (by simplifying the request URL) I am ending up with something like this when adding the SP List reader:

Sharepoint_errormessageTo be honest, I am out of ideas - and our local support at axmann.at cannot assist as well since this lies somewhere in the domain of admin and user rights.

 

Do you know what could help here? Or is "replacing the TENANT url" the only viable option in this? Because whatever I tried, I failed.

j.botterill
Rank
Userlevel 2
Badge +19

The TENANT url replacement option works well if the permissions/scope (delegatred AllSites.Read MyFiles.Write) is set for certain members AND the client and secret passed into the FME web service definition

 

If you're Admin/IT don't want to assign AD members to the registered app, they can create a (super)user AD and grant this user exclusively to the registered app. They also need to add this user to specific O365 groups where the sharepoint libraries/lists exist.

Then you can open FME with Run as different user. Authenticate the sharepoint web connection with this account (perhaps with MFA off?).

This method gives Admin/IT more confidence that this FME superuser can be restricted to only access the libraries/lists that are not sensitive

 

Most microsoft subscriptions are single tenant, unless they invite other O365 organisations ?

 

Reply


Community Stats

28,723
Posts
109,512
Replies
36,560
Members
Terms & ConditionsCookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.