Microsoft Admin Instructions

• Connection Types and Sharing
• Enable Individual Connections for Microsoft Applications
  • Option 1: Request access directly from the AlphaSense application
  • Option 2: Enable directly in Microsoft Entra
  • Option 3: Approving an access request from a user
• Security Documentation
• Microsoft Connections FAQ

Connection Types and Sharing

All Microsoft connections are read-only: AlphaSense can read Microsoft content but does not modify files in Microsoft.

For synced connections, applicable to SharePoint, OneDrive, and OneNote, the person setting them up selects the folders to sync. For SharePoint, administrators can also request site selection to limit access to user-specified sites.

• Basic/Individual: Each user/organization connects their own Microsoft account. Synced content starts private, and the connecting user manages who can see it in AlphaSense, subject to company sharing settings.
• Shared: One user connects an account for team use. Sharing follows Microsoft permissions rather than being managed in AlphaSense.
• Workspace: An IT admin sets up a connection that blocks all other users within the account from syncing content. File access continues to follow Microsoft permissions. A shared connection or individual connection can also be made to be “Company wide”,

For the applications in this guide, SharePoint offers Individual and Workspace connections, OneDrive offers Individual and Shared connections, and OneNote offers Individual connections only. Microsoft 365 offers a pure MCP connection.

• MCP real-time (Microsoft 365): Users connect their own account for live access to Outlook, Calendar, and Teams. It does not sync folders into AlphaSense; access follows the user's Microsoft permissions.

Enable Individual Connections for Microsoft Applications

A Microsoft Entra Global Administrator must install the relevant integration(s) before anyone can connect. There are three ways they may do this.

Option 1: Request access directly from the AlphaSense application

Prerequisite: The third-party admin consent workflow must be enabled in Entra; otherwise, please enable using Option 2.

1. In AlphaSense, open the Integration Center and click “Request” beside each Microsoft application (SharePoint, OneDrive, or OneNote) you want to enable for your organization.
2. Where available, keep mirrored permissions enabled. This gives users the most flexibility when connecting.
3. Complete OAuth and select “Consent on behalf of your organization” so other users can connect.

Option 2: Enable directly in Microsoft Entra

Use this when you, as the Microsoft Entra Admin, do not have an AlphaSense license or when Third Party Admin Consent workflow is disabled at the organization.

1. Find the apps you want to install below. Paste the relevant app link in your browser
2. Replace {tenant-id} with your organization's tenant ID, and run
3. Optional: Assign specific users or security groups to this service principal.

SharePoint

<https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=bacc918c-0f40-4829-944b-4d434016ebd0&scope=offline_access%20user.read%20User.ReadBasic.All%20Notes.Read.All%20Notes.Read%20openid%20profile%20Sites.Read.All%20Files.Read.All>

Reach out to Support@alpha-sense.com if you need more granular control of site selection or scopes. See “Scopes” section for available options

OneDrive

<https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=0f77baf7-7137-4708-bd25-7d935a39264a&scope=offline_access%20user.read%20User.ReadBasic.All%20Notes.Read.All%20Notes.Read%20openid%20profile%20Files.Read.All%20GroupMember.Read.All%20Sites.FullControl.All>

Reach out to Support@alpha-sense.com if you need more granular control of scopes. Files shared with you, are not available via OneDrive, you must be the owner to sync them.

Microsoft 365 (Outlook, Calendar, Teams)

<https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=da17d800-0b09-4afe-a483-100376e2c466&scope=offline_access%20User.Read%20User.Read.All%20Chat.Read%20Chat.ReadBasic%20Team.ReadBasic.All%20Channel.ReadBasic.All%20ChannelMessage.Read.All%20Mail.Read%20Calendars.Read%20OnlineMeetings.Read%20OnlineMeetingRecording.Read.All%20OnlineMeetingTranscript.Read.All%20openid%20profile>

OneNote

<https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=79402eb5-239f-4a69-8a5c-8837f4a848e6&scope=offline_access%20user.read%20User.ReadBasic.All%20Notes.Read.All%20Notes.Read%20openid%20profile%20Sites.Read.All%20Files.Read.All>

Shared notebooks are not available via OneNote

Option 3: Approving an access request from a user

If the admin consent workflow is configured and an end user or service account has raised a request from the AlphaSense connection flow, an approving Entra admin completes the following steps in Entra.

The request remains pending until an approver acts on it; until then, the AlphaSense connection cannot complete.

Step 1. Navigate to Enterprise Apps in the Entra admin center.

Sign in to https://entra.microsoft.com as a configured reviewer and open the Enterprise apps blade.

Step 2. Open Admin Consent Requests and select the AlphaSense entries.

In Enterprise apps, choose Admin consent requests from the left rail. Locate the row for AlphaSense app(s) (screenshot is for reference only) in the My Pending list and click it.

Step 3. Click "Review permissions and consent."

From the request details pane on the right, click Review permissions and consent to open the Microsoft Permissions requested screen (screenshot is for reference only).

Step 4. Review the listed permissions and click Accept.

Review the scopes, if the scopes are correct for your security posture, click Accept. The request will close, and the AlphaSense connection workflow will be able to complete.

Security Documentation

Trust Center

Security

Integration Help Center

Scopes

Permissions vary by connector and connection type.

SharePoint

Supports Individual and Workspace connections. Both request these base scopes:

• User.Read: Sign in and read the signed-in user's profile.
• User.ReadBasic.All: Read basic profile information for other users.
• Files.Read.All: Read files the signed-in user can access.
• Notes.Read: Read the signed-in user's OneNote notebooks.
• Notes.Read.All: Read OneNote notebooks the signed-in user can access.
• offline_access: Maintain access through refresh tokens for ongoing sync.
• openid: Authenticate the signed-in user.
• profile: Read basic profile claims during sign-in.

One site-access scope is added based on the configured access level, The SharePoint link in Option 2 uses the Individual Read All Sites profile.

Workspace connections, only available to site owner or site-collection administrators also request GroupMember.Read.All to read group membership for permission mirroring.

Microsoft 365 (Outlook, Calendar, Teams)

Fully private Real-time MCP Connection, no sharing or syncing

• User.Read: Sign in and read the signed-in user's profile.
• User.Read.All: Read users' full profiles.
• Chat.Read: Read the signed-in user's Teams chats and messages.
• Chat.ReadBasic: Read basic information about the signed-in user's chats.
• Team.ReadBasic.All: Read team names and descriptions.
• Channel.ReadBasic.All: Read channel names and descriptions.
• ChannelMessage.Read.All: Read channel messages on behalf of the signed-in user.
• Mail.Read: Read the signed-in user's mail.
• Calendars.Read: Read the signed-in user's calendars.
• OnlineMeetings.Read: Read the signed-in user's online meeting details.
• OnlineMeetingRecording.Read.All: Read online meeting recordings on behalf of the signed-in user.
• OnlineMeetingTranscript.Read.All: Read online meeting transcripts on behalf of the signed-in user.
• offline_access: Maintain access through refresh tokens.
• openid: Authenticate the signed-in user.
• profile: Read basic profile claims during sign-in.

Users authenticate individually. Content access remains subject to their Microsoft 365 permissions and the organization's access policies.

OneDrive

Supports Individual and Shared connections. Workspace connections are not supported.

• activity.readonly: View the activity record of files in your OneDrive.
• metadata.readonly: View metadata of files in your OneDrive.
• read-only: View and download all your OneDrive files.
• admin.directory.user: Access all user and user alias operations.
• admin.directory.user.readonly: Retrieve users or user aliases.
• admin.directory.rolemanagement.readonly: Get and list roles, privileges, and role assignments.

OneNote

Supports Individual connections only. Users can sync notebooks they own;

• User.Read: Sign in and read the signed-in user's profile.
• User.ReadBasic.All: Read basic profile information for other users.
• Notes.Read: Read the signed-in user's OneNote notebooks.
• Notes.Read.All: Read OneNote notebooks the signed-in user can access.
• Sites.Read.All: Read documents and list items across sites accessible to the signed-in user.
• Files.Read.All: Read files the signed-in user can access.
• offline_access: Maintain access through refresh tokens for ongoing sync.
• openid: Authenticate the signed-in user.
• profile: Read basic profile claims during sign-in.

Microsoft Connections FAQ

Does each Microsoft application need admin approval?

• Approve each integration your organization plans to use: SharePoint, OneDrive, OneNote, and Microsoft 365 (Outlook, Calendar, Teams). We encourage you to select “consent on behalf of your organization” if you’d like other users to be able to sync and bring in content.

Does the approving administrator need an AlphaSense license?

• An administrator can use the direct Microsoft Entra consent links in Option 2 without an AlphaSense license.

Does admin consent automatically connect everyone or sync their content?

• No. Users must complete their own connection after approval. For SharePoint, OneDrive, and OneNote, they also select the content to sync. Admin consent authorizes the integration; it does not complete those user setup steps.⁠⁠⁠⁠⁠⁠⁠⁠

Does the connection take everything?

• No. Alphasense’s connections only take user directed content into the platform for use by your organization. We also offer additional controls to limit the scope of what is exposed to Alphasense, but no content comes in until directed by an authorized user within your organization.