Summary
The SharePoint connector's site resolution always issues a Graph API call against the bare tenant hostname (GET /v1.0/sites/{hostname}), regardless of what follows it in the source string. This means it can only reach document libraries that live at the tenant root site. It cannot reach a subsite (e.g. https://tenant.sharepoint.com/sites/{name}), even though subsites are extremely common in real SharePoint deployments.
Steps to reproduce
Have a document library inside a subsite, e.g.: https://contoso.sharepoint.com/sites/TeamSite/SomeLibrary
Grant the app Sites.Selected read access on that subsite specifically (via POST /sites/{subsite-id}/permissions), confirmed working via direct Graph calls.
Configure .oikb.yaml:
sources:
- name: docs
source: sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary
kb-id:
Run oikb daemon (or oikb sync).
Actual behavior
HTTP Request: GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com "403 Forbidden"
Even after granting the app Sites.Selected read access on the root site as a workaround, the connector then fails to resolve the subsite path at all:
Sync failed for sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary:
Library 'TeamSite/SomeLibrary' not found. Available: []
This confirms the connector treats everything after the hostname as a single library name to search for within the root site, with no awareness that TeamSite could itself be a separate site.
Expected behavior
The source string should support explicitly addressing a subsite, e.g. one of:
sharepoint:contoso.sharepoint.com/sites/TeamSite/SomeLibrary
or a colon-delimited form matching Graph's own subsite lookup syntax (sites/{hostname}:/sites/{subsite}:), which already works when called directly against Graph:
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/TeamSite
Why this matters
Subsites are a very common SharePoint pattern (departmental sites, project sites, etc.), and Sites.Selected — the least-privilege permission model that the connector's own docs recommend — is typically granted per-subsite, not at the root. Right now those two things don't compose: you can secure a subsite correctly, but the connector can't reach it.
Select from "## Summary" down to the last line above and it should paste cleanly into the GitHub issue body field.
Summary
The SharePoint connector's site resolution always issues a Graph API call against the bare tenant hostname (GET /v1.0/sites/{hostname}), regardless of what follows it in the source string. This means it can only reach document libraries that live at the tenant root site. It cannot reach a subsite (e.g. https://tenant.sharepoint.com/sites/{name}), even though subsites are extremely common in real SharePoint deployments.
Steps to reproduce
Have a document library inside a subsite, e.g.: https://contoso.sharepoint.com/sites/TeamSite/SomeLibrary
Grant the app Sites.Selected read access on that subsite specifically (via POST /sites/{subsite-id}/permissions), confirmed working via direct Graph calls.
Configure .oikb.yaml:
sources:
source: sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary
kb-id:
Run oikb daemon (or oikb sync).
Actual behavior
HTTP Request: GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com "403 Forbidden"
Even after granting the app Sites.Selected read access on the root site as a workaround, the connector then fails to resolve the subsite path at all:
Sync failed for sharepoint:contoso.sharepoint.com/TeamSite/SomeLibrary:
Library 'TeamSite/SomeLibrary' not found. Available: []
This confirms the connector treats everything after the hostname as a single library name to search for within the root site, with no awareness that TeamSite could itself be a separate site.
Expected behavior
The source string should support explicitly addressing a subsite, e.g. one of:
sharepoint:contoso.sharepoint.com/sites/TeamSite/SomeLibrary
or a colon-delimited form matching Graph's own subsite lookup syntax (sites/{hostname}:/sites/{subsite}:), which already works when called directly against Graph:
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/TeamSite
Why this matters
Subsites are a very common SharePoint pattern (departmental sites, project sites, etc.), and Sites.Selected — the least-privilege permission model that the connector's own docs recommend — is typically granted per-subsite, not at the root. Right now those two things don't compose: you can secure a subsite correctly, but the connector can't reach it.
Select from "## Summary" down to the last line above and it should paste cleanly into the GitHub issue body field.