SharePoint Automation Plugin

Microsoft SharePoint Online automation via Microsoft Graph API. Uses the shared ms_auth module's InteractiveBrowserAuth flow with the Microsoft Graph Command Line Tools appId — admin-consented in the UHG tenant for Sites.Read.All, Files.Read.All, and ~25 other scopes.

Capabilities

• Resolve a SharePoint site by host + server-relative path
• Enumerate lists, document libraries, and subsites
• Fetch modern Site Pages (with web part / canvas layout)
• Fetch classic publishing pages (Pages library, template 850)
• Walk a document library and stream files
• Dump list items as JSON or CSV

First-time auth

No .local.md setup is required for users in the UHG tenant — the shipped defaults work out of the box. First call opens a browser for SSO; subsequent calls within the token TTL are silent (cache lives in the system keyring).

For other tenants, override via ~/.claude/ms-auth.local.md:

---
tenant_id: your-tenant-guid
client_id: your-app-id
---

Quickstart

import asyncio
from ms_auth import InteractiveBrowserAuth, GraphClient

async def main() -> None:
    auth = InteractiveBrowserAuth(plugin_name="sharepoint-automation")
    client = GraphClient(auth, scopes=["Sites.Read.All", "Files.Read.All"])
    site = await client.get(
        "/sites/uhgazure.sharepoint.com:/sites/iso/FWDelivery"
    )
    print(site["displayName"], site["webUrl"])
    await client.close()

asyncio.run(main())

Triggers (skill activation)

The skill activates when the user asks to read, search, list, or enumerate SharePoint content. Triggers:

• "list pages on the iso site"
• "show me the FWDelivery document library"
• "fetch this SharePoint page as markdown"
• "dump the Useful Links list as a CSV"
• "what subsites does this SharePoint site have?"

Scopes

Default scopes (admin-consented in UHG):

• Sites.Read.All — read all SharePoint site content
• Files.Read.All — read OneDrive + SharePoint document libraries
• User.Read — basic user profile

For write operations, request Sites.ReadWrite.All and Files.ReadWrite.All explicitly when constructing the client. These scopes are also pre-consented for the default appId.

Read-only by default

The plugin defaults to read-only. Mutating operations (page edits, list item create/update/delete, file uploads) require explicitly setting read_only_mode: false in ~/.claude/sharepoint-automation.local.md and requesting the matching *.ReadWrite.All scopes.