Synapse & Service Principal SharePoint Integration

The only way to allow SharePoint authentication via a System Assigned Managed Identity (e.g. a Synapse Workspace) is via the Microsoft Graph API. The interactive notebook shared in this post defines the process of granting Service Principals (inc. Synapse managed identities) access to SharePoint sites, which allows the use of SharePoint as a source/target system when connecting from a Synapse workspace (e.g. in a Synapse Pipeline).

The process is summarised below:

1. Configure the SharePoint sites that need to be managed and the Managed Identity which needs access
2. Setup an authenticated connection to Microsoft Graph
3. Apply the SharePoint permissions:
   • Grant the managed identity the Sites.Selected Microsoft Graph permission
   • Grant the managed identity read/write permissions to the specified SharePoint site

Pre-requisites

1. The notebook is a Jupyter .ipynb file and uses PowerShell functions to perform the necessary steps. The recommended approach to running the notebook is from Visual Studio code, using the Polyglot Notebooks extension in the .NET interactive environment.

2. The following permissions are required to run the notebook:

• Entra ID Global Administrator
• Explicit 'Owner' permissions on the SharePoint site being updated

Interactive Notebook