How to Connect Microsoft SharePoint to Gemini via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → SharePoint (Microsoft 365), paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Microsoft SharePoint + Gemini

Let your AI work in SharePoint: find sites, browse and search document libraries, see file details and who has access, read, create and update list items, create lists, folders and text files, read site pages, and search everything with Microsoft Search. Microsoft 365 through Microsoft Graph, signed in with your work account.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_TENANT_ID

Step 1 — Get credentials

1. Open the Microsoft Entra admin center (entra.microsoft.com) or the Azure portal and go to Applications → App registrations → New registration.

2. Name the app (for example "AnythingMCP Microsoft 365") and choose the Supported account types. The choice decides what goes into MICROSOFT_TENANT_ID:

   • Accounts in this organizational directory only (single tenant): only users of your organisation can sign in. Use the Directory (tenant) ID from the app's Overview page (a GUID) or your domain, such as contoso.onmicrosoft.com.
   • Accounts in any organizational directory (multi-tenant): use organizations.
   • Accounts in any organizational directory and personal Microsoft accounts: use common. Personal Microsoft accounts have no SharePoint, so they can sign in but get no data.

   If the value does not match the account type, Microsoft refuses the sign-in (AADSTS50194 or AADSTS50020).

3. Under Redirect URI, pick the platform Web and enter https://cloud.anythingmcp.com/api/mcp-oauth/callback. If you host AnythingMCP yourself, enter https://your-anythingmcp-host/api/mcp-oauth/callback instead. The URI must match character for character, otherwise Microsoft answers AADSTS50011.

4. Open API permissions → Add a permission → Microsoft Graph → Delegated permissions and add offline_access, User.Read, Sites.ReadWrite.All and Files.ReadWrite.All. offline_access is what makes Microsoft issue a refresh token; without it the connector stops an hour after you authorize it.

5. Open Certificates & secrets → New client secret. Copy the secret Value, not the Secret ID; it is shown only once. Note the expiry date: when the secret expires, the connector stops working until you create a new one and paste it in.

6. Paste the Application (client) ID from the Overview page into MICROSOFT_CLIENT_ID, the secret value into MICROSOFT_CLIENT_SECRET and the tenant value from step 2 into MICROSOFT_TENANT_ID, then install the connector.

7. On the connector page, click Authorize with Provider and sign in with the work account whose SharePoint sites the AI should work with. The refresh token is stored encrypted, and access tokens (valid for about an hour) are renewed automatically.

8. Start with sharepoint_get_root_site: it shows your organisation's root site and confirms that SharePoint is reachable.

What ".All" means: in these delegated permissions, All means "every site the signed-in user can open". The AI never gets more than that user's own SharePoint access.

One Entra app for all Microsoft connectors: the app registration you made for the Outlook, OneDrive or Excel connector works here too. Open it, add the permissions from step 4 under API permissions, keep the same redirect URI and reuse the same client ID, secret and tenant. Each connector asks only for its own permissions when you authorize it:

• Outlook: Mail.ReadWrite, Mail.Send, Calendars.ReadWrite
• OneDrive: Files.ReadWrite
• Excel: Files.ReadWrite (plus Files.ReadWrite.All for workbooks in SharePoint or shared with you)
• SharePoint: Sites.ReadWrite.All and Files.ReadWrite.All

All of them also need offline_access and User.Read.

Admin consent: these delegated permissions normally do not need an administrator, but many organisations turn off user consent. If the sign-in shows "Need admin approval" (AADSTS65001 or AADSTS90094), a tenant administrator opens the app registration once and clicks API permissions → Grant admin consent for the organisation. After that every user can authorize. Each connector still works only with what the account that signed in may see.

Read-only setup: add Sites.Read.All and Files.Read.All to the app registration, replace the scopes in the connector's OAuth settings with offline_access User.Read Sites.Read.All Files.Read.All, authorize again and disable sharepoint_create_list_item, sharepoint_update_list_item, sharepoint_create_list, sharepoint_create_folder, sharepoint_upload_text_file, sharepoint_rename_drive_item and sharepoint_move_drive_item.

Switched off at install: sharepoint_delete_list_item, sharepoint_delete_drive_item, sharepoint_create_sharing_link and sharepoint_invite. Sharing links and invitations are off on purpose: they give other people access to your organisation's files, and a document the AI reads could contain text asking it to share something. Turn a tool on only if the AI really needs it. Deleted items go to the site's recycle bin.

Finding your way: the AI finds a site by keyword or from its address (for example https://contoso.sharepoint.com/sites/Marketing), then opens its document libraries and lists. sharepoint_search uses Microsoft Search across all sites, files and list items you can see. Modern site pages can be read; classic pages, news posts and page editing are not covered.

Lists: list values are stored under each column's internal name, which can differ from the name you see (a column shown as "Due date" may be DueDate). The AI reads the columns first with sharepoint_list_columns. On lists with more than 5,000 items, SharePoint only filters and sorts on indexed columns.

Files and content: the connector does not download file content: the AI gives you the file's link instead. It creates text files of up to about 4 MB and, by default, never overwrites an existing file. For the cells of Excel workbooks in a library, use the Microsoft Excel connector.

Common errors: 401 InvalidAuthenticationToken means the authorization was revoked or the client secret expired; paste a new secret if needed and click Authorize with Provider again. 403 accessDenied means a permission from step 4 is missing or was not consented, or you have no access to that site, library or list. 404 itemNotFound means a wrong site, library, list or item, or a site path that does not exist; personal Microsoft accounts get 404 or 400 for every call. 400 invalidRequest on list items means a column name is not the internal name or a value does not fit the column; "cannot be referenced in filter or orderby as it is not indexed" means the column needs an index in the list settings. 409 nameAlreadyExists means an item with that name is already in the folder.

The connector does not download file content, upload binary files, create sites or change site permissions, delete lists or columns, edit pages or manage the term store and content types.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Gemini

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Gemini CLI reads MCP servers from ~/.gemini/settings.json (on Windows %USERPROFILE%\.gemini\settings.json). Add:

{
  "mcpServers": {
    "anythingmcp": {
      "httpUrl": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart gemini.
3. Run /mcp inside Gemini CLI (or gemini mcp list in your shell): anythingmcp should show as connected.
4. Start prompting: Gemini CLI can now call the Microsoft SharePoint tools.

Available tools

Example prompts

• "Find the Marketing site and list the files in its Documents library that changed this month."
• "In the Projects list, show me every item with the status Open that is due before Friday."
• "Add an item to the Purchase Requests list: 'New laptops for sales', amount 4,800, status Pending."
• "Search SharePoint for the latest travel policy and tell me where it is stored."

FAQ

Where does Gemini CLI look for MCP servers? In ~/.gemini/settings.json for your user, or in .gemini/settings.json inside a project. gemini mcp list shows each server and whether it connects.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Meta Muse