Migrating SharePoint Destinations to Microsoft Graph

Summary

Microsoft has retired the legacy SharePoint Add-In authentication model. As a result, applications must now use Microsoft Entra ID (Azure AD) and Microsoft Graph / SharePoint REST APIs for authentication and access.

Reference: Retirement announcement for SharePoint Add-Ins 

In remiCrystal, this means existing SharePoint targets that relied on legacy authentication should be recreated using the newer Microsoft Graph-based authentication method.

Important: This migration requires creating new SharePoint destinations/targets in remiCrystal. Existing targets using the retired authentication model cannot simply be switched in place without reconfiguration.

Applies to

• remiCrystal
• SharePoint Online
• Microsoft Entra ID (Azure AD)
• Microsoft Graph authentication for SharePoint destinations

Symptoms

Users may experience one or more of the following:

• SharePoint destinations no longer authenticate successfully
• Target validation fails for legacy SharePoint connections
• Uploads to SharePoint document libraries stop working
• Older SharePoint authentication methods are no longer accepted by Microsoft 365

Cause

Microsoft has retired the SharePoint Add-In model and older authentication approaches tied to it. Because of this change, applications must authenticate using modern Microsoft identity platform methods and access SharePoint resources through Microsoft Graph / SharePoint REST-compatible APIs.

Resolution

To migrate SharePoint delivery in remiCrystal, complete the following steps:

1. Register an application in Microsoft Entra ID
2. Assign the required Microsoft Graph permissions
3. Create a client secret
4. Create a new MS Graph account in remiCrystal
5. Create a new SharePoint target and browse to the desired document library

Step 1: Register an Application in Microsoft Entra ID

1. Sign in to the Azure portal at https://portal.azure.com.
2. Go to Microsoft Entra ID.
3. Select App registrations.
4. Click New registration.
5. Enter a name such as remiCrystal SharePoint Integration.
6. Select the appropriate supported account type for your organization.
7. Click Register.

Note: In most remiCrystal SharePoint delivery scenarios, a single-tenant app registration is the typical choice unless your organization requires another configuration.

Step 2: Record the Application Details

After the application is created, record the following values from the Overview page:

• Application (client) ID
• Directory (tenant) ID

These values will be required when creating the MS Graph account in remiCrystal.

Step 3: Create a Client Secret

1. In the app registration, go to Certificates & secrets.
2. Click New client secret.
3. Enter a description.
4. Select an expiration period according to your organization's policy.
5. Click Add.
6. Copy the secret value immediately and store it securely.

Important: The client secret value is only shown once. If it is lost, a new secret must be created.

Step 4: Assign Required API Permissions

1. In the app registration, go to API permissions.
2. Click Add a permission.
3. Select Microsoft Graph.
4. Select either Delegated permissions or Application permissions, depending on your setup.

Recommended Permissions for SharePoint

Authentication Model	Permissions
Delegated (User)	Sites.ReadWrite.All Files.ReadWrite.All
Application (Service Principal)	Sites.ReadWrite.All

5. Click Add permissions.
6. If required, click Grant admin consent.

Note: Application permissions typically require tenant administrator consent before they can be used.

Step 5: Create the MS Graph Account in remiCrystal

1. Open remiCrystal.
2. Go to Options.
3. Select MS Graph / Power BI.
4. Click Add.
5. Enter the account details.

Figure 1. MS Graph / Power BI account list in remiCrystal.

Figure 2. MS Graph account configuration dialog.

Account Configuration

• Account Name: Friendly name for the account
• Authentication Type:
  • Delegated (User), or
  • Application (Service Principal)
• Account Type: MS Graph (SharePoint)
• Tenant ID: Directory (tenant) ID from Azure
• Client ID: Application (client) ID from Azure
• Client Secret: Client secret value created in Azure
• Refresh Token: Required for delegated authentication where applicable

6. Click Validate.
7. Click Save.

Note: The exact validation and token acquisition behavior may differ depending on whether the account uses delegated authentication or application authentication.

Step 6: Create a New SharePoint Target

1. Create or edit a schedule in remiCrystal.
2. Go to Target.
3. Select Output To > SharePoint.
4. Set Authentication Type to MSGraph.
5. Select the account you created in the Account Name dropdown.
6. Enter the SharePoint Site Address.
7. Browse to the required Document Library location.
8. Save the target.

Figure 3. Creating a SharePoint target using MSGraph authentication.

 

Example SharePoint Site Address

https://yourtenant.sharepoint.com/sites/yoursite

Example Document Library Path

Document Library/remiWare/remiCrystal

Important: Because the authentication model has changed, existing SharePoint targets should be recreated as new targets using the MSGraph account. Reusing older legacy configurations is not recommended.

Verification

After configuration is complete:

1. Validate the MS Graph account in remiCrystal.
2. Use the SharePoint target browse function to confirm access to the site and document library.
3. Run a test schedule and confirm the file is delivered to the expected SharePoint location.

Troubleshooting

Validation Fails

• Verify the Tenant ID, Client ID, and Client Secret
• Confirm the client secret has not expired
• Confirm the API permissions were added to the correct app registration
• Confirm admin consent was granted where required

Unable to Browse SharePoint Library

• Verify the SharePoint Site Address is correct
• Verify the account has access to the site
• Confirm the configured Microsoft Graph permissions are sufficient
• Confirm the selected authentication type matches how the app was intended to be used

Uploads Fail After Successful Validation

• Verify the selected document library path is correct
• Confirm the destination folder still exists
• Confirm the authenticated identity has write access to the destination library

Additional Information

For Microsoft guidance on the SharePoint Add-In retirement, see: Retirement announcement for SharePoint Add-Ins