SharePoint

Scan SharePoint sites and document libraries for exposed secrets

The SharePoint Integration in the Praetorian Guard Platform (PGP)

The SharePoint integration in PGP provides continuous scanning of your organization's SharePoint sites and document libraries to detect exposed secrets such as API keys, tokens, passwords, and other sensitive information. PGP connects to SharePoint through the Microsoft Graph API using an Entra (Azure AD) app registration, discovers the sites in your tenant, and scans each site's default document library and modern site pages for security risks. On subsequent scans, PGP performs incremental checks — only re-scanning content that has changed since the last run.

Prerequisites

Before you begin, ensure you have:

  • A Microsoft 365 tenant with SharePoint Online (Microsoft commercial cloud; national/government clouds such as GCC High are not supported)
  • Permission to create and grant admin consent for an Entra app registration (Global Administrator or Application Administrator)
  • Access to your PGP account

Creating an App Registration in Microsoft Entra

  1. Sign in to the Microsoft Entra admin center and go to Identity → Applications → App registrations
  2. Click New registration, give it a descriptive name (e.g., "PGP Integration"), and register it
  3. Copy the Application (client) ID and the Directory (tenant) ID from the app's Overview page
  4. Under Certificates & secrets, click New client secret, add a description and expiry, then copy the secret Value immediately — it will not be shown again
  5. Under API permissions, add the following Microsoft Graph application permissions and grant admin consent:
    • Sites.Read.All
    • Files.Read.All

Note: Application permissions (not delegated) are required so PGP can scan without an interactive user session. Admin consent must be granted for the permissions to take effect.

Configuring the Integration in PGP

  1. In PGP, navigate to the Integrations page
  2. Find and click on SharePoint under the "SaaS Security" section
  3. Provide the following details:
    • Tenant ID — Your Microsoft 365 tenant domain or GUID (e.g., contoso.onmicrosoft.com or a tenant GUID)
    • Client ID — The Application (client) ID from your Entra app registration
    • Client Secret — The client secret Value you created
  4. Click Connect to establish the integration

Once configured, PGP will discover the SharePoint sites in your tenant and scan them for exposed secrets.

Note: PGP scans each site's default document library and its modern site pages. Within document libraries, text-based files (plain text, source code, configuration, JSON, XML) up to 1 MB are scanned; binary formats such as Office documents and PDFs are not.

Verifying the Connection

To verify that your connection is working:

  1. Navigate to Assets in PGP
  2. Look for sharepoint:site assets — each discovered site appears as an asset named after the site
  3. Check the Integrations page to confirm the SharePoint connection status

Remediating Exposed Secrets

SharePoint retains file version history, so a secret that appears in a document may also exist in one or more previous versions of that file.

To fully eliminate the exposure:

  1. Remove the secret from the current version of the file
  2. Delete or purge every prior file version that still contains the secret
  3. Rotate the affected credential to invalidate any copies that may have already been captured

Until every historical version is cleaned, the secret should be treated as compromised.

Troubleshooting

Common issues and solutions:

  • Unable to Connect — Verify the Tenant ID, Client ID, and Client Secret are correct and the secret has not expired
  • Authorization / Consent Errors — Confirm the Sites.Read.All and Files.Read.All application permissions were added and admin consent was granted
  • No Sites Discovered — Ensure the app has tenant-wide read access and that the sites exist in the target tenant
  • Expired Secret — Client secrets expire; create a new secret in Entra and update the connection

If you continue to experience issues, contact PGP Support.

Managing Your Connection

To manage your SharePoint connection:

  1. In PGP, navigate to the Integrations page
  2. Find your SharePoint connection
  3. Use the options menu (⋮) to update the stored credential (Refresh Token) or remove the connection (Disconnect)

Additional Resources

Need help? Contact our support team for assistance.