Admin setup

Connect Wardwell to SharePoint

Five short steps from a fresh Entra tenant to your first scan. No agents on SharePoint servers, no PowerShell, no on-prem install — Wardwell receives a delegated Microsoft Graph role and patrols your intranet.

≈ 12 min · 5 steps
Need a hand?

On this page

jump to a step
  1. Step 1Register the app in Entra
  2. Step 2Request Files.Read.All + Sites.Read.All
  3. Step 3Grant admin consent
  4. Step 4Pick a SharePoint site URL
  5. Step 5Review the first scan
Step 1

Register the app in Entra

Open the Microsoft Entra admin center and create a single-tenant app registration for Wardwell. Your tenant admin account is required for the steps that follow.

  1. 1Go to entra.microsoft.com → Applications → App registrations.
  2. 2Click New registration. Name: Wardwell. Under Supported account types choose Accounts in this organizational directory only (single tenant). Leave the Redirect URI blank for now — better-auth wires those for you.
  3. 3On the app's Overview blade, copy the Application (client) ID and the Directory (tenant) ID.
  4. 4Drop those two values into the platform env (case-sensitive names — the deploy reads from AUTH_MICROSOFT_CLIENT_ID and AUTH_MICROSOFT_TENANT_ID):
AUTH_MICROSOFT_CLIENT_ID=<application (client) id>
AUTH_MICROSOFT_TENANT_ID=<directory (tenant) id>
Continue to step 2 →
Step 2

Request Files.Read.All + Sites.Read.All

Request the two delegated Graph permissions Wardwell actually uses. Anything wider is not granted — the scope list is openid profile email Files.Read.All Sites.Read.All offline_access.

  1. 1In the Wardwell app registration, open the API permissions blade.
  2. 2Click Add a permission → Microsoft Graph → Delegated permissions.
  3. 3Tick exactly the two rows below (names are case-sensitive in Entra):
Files.Read.All
Sites.Read.All
Continue to step 3 →
Step 3

Grant admin consent

Until a tenant admin consents here, every end user will hit a "needs admin consent" interstitial on first sign-in. Grant it once and nobody else has to.

  1. 1Still on the API permissions blade, click Grant admin consent for <your tenant>.
  2. 2Accept the confirmation dialog. The Status column flips to a green check for both Files.Read.All and Sites.Read.All.
Continue to step 4 →
Step 4

Pick a SharePoint site URL

Open /scan, sign in with the Microsoft 365 admin account you used to create the registration, and paste the URL of the SharePoint site you want to crawl first. Start with a small intranet hub (e.g. HR or People & Culture) so the first run is fast and reviewable.

Example URL formats

  • https://contoso.sharepoint.com/sites/people
  • https://contoso.sharepoint.com/sites/hr

Format must be a real /sites/<name> URL —ScanCreate validates siteUrl as z.string().url(); tenant roots like contoso.sharepoint.comdon't walk and will be rejected.

Open /scan →You'll land on the sign-in card the first time.
Step 5

Review the first scan

Submitting the form starts a row in queued. The scan worker walks the site via Microsoft Graph (walkSitePages, probeLinks) and writes ScanIssue rows for broken_link, stale, and missing_alt. The status flips to done and the table on the same page renders the result.

What you'll see in the results table

  • Counts per issue type at the top (broken_link · stale · missing_alt).
  • A row per issue with the offending URL, severity, last-seen timestamp, and an optional detail line.
  • A polled N× chip so you know how many status checks the walk cost.
Review your scan results →Run another scan

Subsequent scans reuse the cached delegated token (refresh via re-sign-in if it expires), so each run is one click.

Stuck on a step?

Email us — a real SharePoint admin will reply.

If the admin-consent dialog won't accept, or /scan errors with needs admin consent, ping us and we'll debug the scope list and redirect URI against your tenant.

Email wardwell-7@polsia.appBack to /scan