Microsoft SharePoint Online modules
In an Adobe Workfront Fusion scenario, you can automate workflows that use Microsoft SharePoint Online, as well as connect it to multiple third-party applications and services.
For instructions on creating a scenario, see the articles under Create scenarios: article index.
For information about modules, see the articles under Modules: article index.
Access requirements
| table 0-row-2 1-row-2 2-row-2 3-row-2 layout-auto html-authored no-header | |
|---|---|
| Adobe Workfront package |
Any Adobe Workfront Workflow package and any Adobe Workfront Automation and Integration package Workfront Ultimate Workfront Prime and Select packages, with an additional purchase of Workfront Fusion. |
| Adobe Workfront licenses |
Standard Work or higher |
| Adobe Workfront Fusion license |
Operation-based: Available to organizations with operation-based licenses Connector-based (legacy): Workfront Fusion for Work Automation and Integration |
| Product | If your organization has a Select or Prime Workfront package that does not include Workfront Automation and Integration, your organization must purchase Adobe Workfront Fusion. |
For more detail about the information in this table, see Access requirements in documentation.
For information on Adobe Workfront Fusion licenses, see Adobe Workfront Fusion licenses.
Prerequisites
To use Microsoft SharePoint Online modules, you must have a Microsoft SharePoint Online account.
SharePoint API information
The SharePoint connector uses the following:
Connect Microsoft SharePoint Online to Workfront Fusion connect-microsoft-sharepoint-online-to-workfront-fusion
- Connect Microsoft SharePoint Online to Workfront Fusion using a Microsoft account
- Connect Microsoft SharePoint Online to Workfront Fusion using advanced settings
- Connect Microsoft SharePoint Online to Workfront Fusion using certificate authorization
- Connect Microsoft SharePoint Online to Workfront Fusion using a service principal
Connect Microsoft SharePoint Online to Workfront Fusion using a Microsoft account
Connect Microsoft SharePoint Online to Workfront Fusion using advanced settings
To include credentials in the connection, enable the Show advanced settings option. For this type of connection, you need a Client ID, Client Secret, and Tenant ID.
-
In any SharePoint module, click Add near the Connection field to open the Create a connection box.
-
Click Show advanced settings.
-
Fill in the following fields:
table 0-row-2 1-row-2 2-row-2 3-row-2 4-row-2 layout-auto html-authored no-header Connection type To use client credentials, select Microsoft 365 Email. Connection name Enter a name for the connection. Client ID Enter the client ID for the SharePoint app you are connecting to. Client secret Enter the client secret for the SharePoint app you are connecting to. Tenant ID Enter the tenant ID of the SharePoint app you are connecting to. -
Click Continue to save the connection and return to the module.
Connect Microsoft SharePoint Online to Workfront Fusion using certificate authorization
You can use certificate authorization to connect to SharePoint.
| note important |
|---|
| IMPORTANT |
| To use certificate authorization, you must first create an app in Microsoft Entra and upload the certificate there. |
| For instructions, see How to configure certificate authorities for Microsoft Entra certificate-based authentication in the Microsoft documentation. |
-
In any SharePoint module, click Add near the Connection field to open the Create a connection box.
-
Click Show advanced settings.
-
Fill in the following fields:
table 0-row-2 1-row-2 2-row-2 3-row-2 4-row-2 layout-auto html-authored no-header Connection type To use certificate authorization, select Microsoft SharePoint Online (Cert Auth). Connection name Enter a name for the connection. Client ID Enter the client ID for the SharePoint app you are connecting to. Thumbprint Enter the thumbprint for the SharePoint app you are connecting to. Private key Enter the certificate or private key that was generated when your credentials were created in Microsoft.
To extract your private key or certificate:
-
Click Extract.
-
Select whether you are extracting a certificate or a private key.
-
Select the type of file you are extracting.
-
Select the file that contains the private key or certificate.
-
Enter the password for the file.
-
Click Save to extract the file and return to the connection setup.
-
-
Click Continue to save the connection and return to the module.
Connect Microsoft SharePoint Online to Workfront Fusion using a service principal
You can create a connection that uses a service principal (an Application API connection) instead of a personal account. This is useful when you want the connection to run as an application or service identity rather than a specific person — for example, so the integration doesn’t break if that person leaves the company or changes their password.
| note important |
|---|
| IMPORTANT |
| This connection type is available only for the Make an API Call module. Other SharePoint modules require one of the other connection types described in this article. |
- Prerequisites to connecting Microsoft SharePoint Online to Workfront Fusion using a service principal
- Create the app registration in Microsoft Entra ID
- Create a client secret
- Grant API permissions
- Collect your connection details
- Create the connection
Prerequisites to connecting Microsoft SharePoint Online to Workfront Fusion using a service principal
You need Global Administrator, Application Administrator, or Privileged Role Administrator access in Microsoft Entra ID, to register the app and grant it permissions. If you do not have this access, ask someone on your IT or identity team to complete those steps for you.
Continue to Create the app registration in Microsoft Entra ID.
Create the app registration in Microsoft Entra ID (Service principal)
- Sign in to the Microsoft Entra admin center.
- Go to App registrations > New registration.
- Give the app a clear, recognizable name. For example,
Make - SharePoint Integration. - Leave Redirect URI blank. This connection does not involve anyone signing in through a browser.
- Select Register.
- Continue to Create a client secret.
Create a client secret (Service principal)
- In your new app registration, go to Certificates & secrets.
- Select New client secret, add a description, and choose an expiry period.
- Select Add.
- Copy the secret’s Value immediately. It is displayed only once. If you navigate away before copying it, you must create a new one.
- Continue to Grant API permissions.
Grant API permissions (Service principal)
- In your app registration, go to API permissions.
- Select Add a permission, then select Microsoft Graph.
- Select Application permissions.
- Select the permission or permissions your API calls need, then select Add permissions.
- Select Grant admin consent for your organization, then confirm.
- Continue to Collect your connection details.
Collect your connection details (Service principal)
From the app registration’s Overview page, note the following values. You enter these when creating the connection in the module.
| table 0-row-2 1-row-2 2-row-2 layout-auto html-authored no-header | |
|---|---|
| Tenant ID | On the Overview page, labeled Directory (tenant) ID. |
| Client ID | On the Overview page, labeled Application (client) ID. |
| Client Secret | The value you copied in Create a client secret. |
Continue to Create the connection.
Create the connection (Service principal)
-
In the Make an API Call module, click Add near the Connection field to open the Create a connection box.
-
Click Show advanced settings.
-
In the Connection type field, select Service Principal.
-
Enter the following:
- Tenant ID
- Client ID
- Client Secret
-
Click Continue to save the connection and return to the module.
If everything is set up correctly, the connection validates successfully.
Connect Microsoft SharePoint Online to Adobe Workfront Fusion using a federated connection
A federated connection works like the service principal connection, except that it does not use a client secret.
Instead of storing a secret, you tell Microsoft Entra ID to trust tokens that Workfront Fusion issues for one specific connection. When the connection runs, Fusion presents a short-lived proof of identity and Microsoft Entra ID returns an access token. Because there is no client secret, there is nothing that expires and no secret to rotate or store.
| note |
|---|
| NOTE |
| Setting up this connection takes two visits to the Microsoft Entra admin center. You register the app first, then create the connection in Workfront Fusion, then return to Microsoft Entra ID to add the federated credential. This is because the federated credential identifies one specific connection, and that identifier does not exist until the connection is created. |
- Prerequisites to connecting Microsoft SharePoint Online to Workfront Fusion using a federated connection
- Create the app registration in Microsoft Entra ID (Federated connection)
- Grant API permissions (Federated connection)
- Collect your connection details (Federated connection)
- Create the connection in Workfront Fusion (Federated connection)
- Add the federated credential in Microsoft Entra ID (Federated connection)
- Verify the connection (Federated connection)
- Troubleshooting
Prerequisites to connecting Microsoft SharePoint Online to Workfront Fusion using a federated connection
You need Global Administrator, Application Administrator, or Privileged Role Administrator access in Microsoft Entra ID, to register the app, grant it permissions, and add the federated credential. If you do not have this access, ask someone on your IT or identity team to complete those steps for you.
Create the app registration in Microsoft Entra ID (Federated connection)
- Sign in to the Microsoft Entra admin center.
- Go to App registrations > New registration.
- Give the app a clear, recognizable name. For example,
Workfront Fusion SharePoint Integration. - Leave Redirect URI blank. This connection does not involve anyone signing in through a browser.
- Select Register.
Do not create a client secret. A federated connection does not use one. - Continue to Grant API permissions.
Grant API permissions (Federated connection)
- In your app registration, go to API permissions.
- Select Add a permission, then select Microsoft Graph.
- Select Application permissions.
- Select the permission or permissions your API calls need, then select Add permissions.
- Select Grant admin consent for your organization, then confirm.
- Continue to Collect your connection details.
Collect your connection details (Federated connection)
-
From the app registration’s Overview page, note the following values. You enter these when creating the connection in the module.
table 0-row-2 1-row-2 layout-auto html-authored no-header Tenant ID On the Overview page, labeled Directory (tenant) ID. Client ID On the Overview page, labeled Application (client) ID. -
Continue to Create the connection in Workfront Fusion.
Create the connection in Workfront Fusion (Federated connection)
-
In the Make an API Call module, click b near the Connection field to open the Create a connection box.
-
Click (Federated connection).
-
In the Connection type field, select the federated connection type.
-
Enter the following:
- Tenant ID
- Client ID
-
Select Create.
Workfront Fusion displays three values. You use them in the next procedure.table 0-row-2 1-row-2 2-row-2 layout-auto html-authored no-header Issuer Always https://oidc.automations.adobe.com.Subject Identifies this one connection. It looks like fusion:6e5b1c2a345bd8d1ed98b6b4f1459818:28964. It is different for every connection you create.Audience Always api://AzureADTokenExchange. -
Leave this panel open and copy the Subject value.
note NOTE Do not close the panel or select Cancel. The connection is not finished until you complete the remaining procedures. If you close the panel, you must delete the connection and start again, because a new connection receives a new Subject. -
Continue to Add the federated credential in Microsoft Entra ID.
Add the federated credential in Microsoft Entra ID (Federated connection)
This procedure is what replaces the client secret. It tells Microsoft Entra ID to accept tokens that Workfront Fusion issues for this one connection.
-
In a new browser tab, return to the Microsoft Entra admin center and open your app registration.
-
Go to Certificates & secrets > Federated credentials.
-
Select Add credential.
-
In Federated credential scenario, select Other issuer.
-
Enter the following:
table 0-row-2 1-row-2 2-row-2 3-row-2 layout-auto html-authored no-header Issuer https://oidc.automations.adobe.com.Subject identifier The Subject you copied from Workfront Fusion. Paste it exactly, with no added spaces. Name A name that identifies this connection, so you can find it later. For example, workfront-fusion-connection-28964.Audience api://AzureADTokenExchange. This is usually filled in for you. Leave the default value. -
Select Add.
-
Continue to Verify the connection.
Verify the connection (Federated connection)
-
Return to the Workfront Fusion browser tab, where the connection panel is still open.
-
Select Save.
- If everything is set up correctly, the connection validates successfully and you can proceed with setting up the module.
- If verification fails, the panel stays open and displays the error. Correct the problem in Microsoft Entra ID and select Save again. You do not need to recreate the connection, and the Subject does not change.
Troubleshooting
| table 0-row-2 1-row-2 2-row-2 layout-auto html-authored no-header | |
|---|---|
| The connection fails verification with an invalid client or invalid request error | Microsoft Entra ID could not match the token to a federated credential. Check that the Issuer is exactly https://oidc.automations.adobe.com with no trailing slash, and that the Subject identifier is character-for-character identical to the Subject shown in Workfront Fusion. A Subject copied from a different connection is the most common cause. |
| The connection verifies, but API calls return 403 | The identity is trusted, but the app does not have the Microsoft Graph permissions your call needs. Return to Grant API permissions, add the required application permission, and grant admin consent. |
| You cannot add another federated credential | You have reached the limit of 20 federated credentials for that app registration. Register an additional app and create further connections against it. |
Microsoft SharePoint modules and their fields
When you configure Microsoft SharePoint Online modules, Workfront Fusion displays the fields listed below. Along with these, additional Microsoft SharePoint Online fields might display, depending on factors such as your access level in the app or service. A bolded title in a module indicates a required field.
If you see the map button above a field or function, you can use it to set variables and functions for that field. For more information, see Map information from one module to another.
Drive item
Create a file
This module returns creates a file in SharePoint. This module has better performance than the Create a file (Legacy) module.
Create a file (Legacy)
This module creates a file in SharePoint.
For better performance, we recommend using the Create a file module.
Create a folder
This action module creates a new folder in SharePoint.
Get a file
This action module retrieves the specified SharePoint file.
Get a folder
This module retrieved details about the specified folder
Update a folder or a file
This action module updates the metadata of a folder or a file
Watch folder items
This trigger module starts a scenario when an item is updated in a folder you select.
Item
Copy an Item
This action module copies an existing item in a SharePoint list.
Create an item
This action module creates a new item in a SharePoint list.
Delete an item
This action module deletes an existing item in a SharePoint list.
Get an Item
This action module returns the data of a specified item.
Get details
This module gets item details from the specified URL.
List Items
This action module retrieves a list of all items in a specified list.
Move an Item
This action module copies an existing item in a SharePoint list.
Update an item
This action module updates an existing item in a SharePoint list.
Watch Items (Scheduled)
This trigger module starts a scenario when an item is created or modified.
List
Create a List
This action module creates a new list in SharePoint.
Get a List
This action module returns the data of a specified list.
List Lists
This action module retrieves a list of all items in a specified site.
Watch Lists
This trigger module starts a scenario when a list is created or modified.
Page (Beta)
beta version in Microsoft Graph are subject to change. The use of these APIs in production applications is not supported.Get a Page
This action module returns the data of a specified page.
List Pages
This module retrieves a list of all pages.
Publish a Page
This action module publishes the latest version of the selected page.
Watch Pages
This trigger module starts a scenario when a page is modified on the specified site.
Site
Get a Site
This action module returns the data of a specified site.
Search Sites
This action module searches for sites by a parameter you specify.
Other
Get Changes
This module retrieves additions, updates, and deletions made in the SharePoint folder.
Make an API Call
This module allows you to perform a custom API call.
Watch events
This instant trigger module starts a scenario when an item is added, updated, or deleted in SharePoint.