Tableau Connector for Microsoft SharePoint

Build 25.0.9434

Configuring a Connection

After Installing the Connector you can connect and create a Data Source for data in Microsoft SharePoint.

Setting Up a Data Source

Complete the following steps to connect to the data:

  1. Under Connect | To a Server, click More....
  2. Select the data source called Microsoft SharePoint by CData.
  3. Enter the information required for the connection.
  4. Click Sign In.
  5. If necessary, select a Database and Schema to discover what tables and views are available.

Using the Connection Builder

The connector makes the most common connection properties available directly in Tableau. However, it can be difficult to use if you need to use more advanced settings or need to troubleshoot connection issues. The connector includes a separate connection builder that allows you to create and test connections outside of Tableau.

There are two ways to access the connection builder:

  • On Windows, use a shortcut called Connection Builder in the Start menu, under the CData Tableau Connector for Microsoft SharePoint folder.
  • You can also start the connection builder by going to the driver install directory and running the .jar file in the lib directory.

In the connection builder, you can set values for connection properties and click Test Connection to validate that they work. You can also use the Copy to Clipboard button to save the connection string. This connection string can be given to the Connection String option included in the connector connection window in Tableau.

Connecting to Microsoft SharePoint

Regardless of whether you will connect online or on-premises, what architecture will be used, and which Lists and Documents will be accessed, connecting to Microsoft SharePoint requires exactly two things:
  • Set the URL connection property.
  • Set the appropriate authentication properties for your working environment.

Setting URL:

Microsoft SharePoint works with all Lists and Documents in the global Microsoft SharePoint site, or all Lists and Documents at individual sites.

To work with all Lists and Documents in the global Microsoft SharePoint site, set the URL connection property to your Site Collection URL. For example: 

https://teams.contoso.com

To work with all Lists and Documents at an individual site, set the URL connection property to your individual site URL. For example: 

 https://teams.contoso.com/TeamA

The following sections describe how to set the appropriate authentication properties for your working environment. For information about how to create a custom OAuth application (required for use with AzureAD in a Web application; optional for AzureAD access via a Desktop application or a Headless Server), see Creating a Custom Entra ID (Azure AD) Application.

Microsoft SharePoint Online

Set SharePointEdition to "SharePoint Online" and set the User and Password to the credentials you use to log onto SharePoint, for example, the credentials to your Microsoft Online Services account.

Microsoft SharePoint online supports a number of cloud-based architectures, each of which supports a different set of authentication schemes:

  • Microsoft Entra ID (Azure AD)
  • Single sign-on (SSO) via the ADFS, Okta, OneLogin, or PingFederate SSO identity provider
  • Azure MSI
  • Azure Password
  • OAuthJWT
  • SharePointOAuth

If the user account domain is different from the domain configured with the identity provider, set SSODomain to the latter. This property may be required for any SSO.

Microsoft Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID (Azure AD) is a connection type that leverages OAuth to authenticate. OAuth requires the authenticating user to interact with Microsoft SharePoint using an internet browser. The driver facilitates this in several ways as described below.

Your organization may require Admin Consent when authorizing a new AzureAD application for your Azure Tenant. In all AzureAD flows, any initial installation and use of an AzureAD application requires that an administrator approve the application for their Azure Tenant. For details, see Creating a Custom Entra ID (Azure AD) Application.

Desktop Applications
CData provides an embedded OAuth application that simplifies OAuth desktop authentication. Alternatively, you can create a custom AzureAD application. See Creating a Custom Entra ID (Azure AD) Application for information about creating custom applications and reasons for doing so.

For authentication, the only difference between the two methods is that you must set two additional connection properties when using custom AzureAD applications.

After setting the following connection properties, you are ready to connect:

When you connect the connector opens the OAuth endpoint in your default browser. Log in and grant permissions to the application. The connector then completes the OAuth process:

  1. Extracts the access token from the callback URL and authenticates requests.
  2. Obtains a new access token when the old one expires.
  3. Saves OAuth values in OAuthSettingsLocation. These stored values persist across connections.
Headless Machines

To configure the driver to use OAuth with a user account on a headless machine, you must authenticate on another device that has an internet browser.

  1. Choose one of these two options:

    • Option 1: Obtain the OAuthVerifier value as described in "Obtain and Exchange a Verifier Code" below.
    • Option 2: Install the connector on another machine and transfer the OAuth authentication values after you authenticate through the usual browser-based flow, as described in "Transfer OAuth Settings" below.

  2. Now configure the connector to automatically refresh the access token from the headless machine.

Option 1: Obtain and Exchange a Verifier Code

To obtain a verifier code, you must authenticate at the OAuth authorization URL.

Follow the steps below to authenticate from the machine with an internet browser and obtain the OAuthVerifier connection property.

  1. Choose one of these options:

    • If you are using the Embedded OAuth Application click Microsoft SharePoint OAuth endpoint to open the endpoint in your browser.
    • If you are using a custom OAuth application, create the Authorization URL by setting the following properties: Now call the GetOAuthAuthorizationURL stored procedure with the appropriate CallbackURL. Open the URL returned by the stored procedure in a browser.

  2. Log in and grant permissions to the connector. You are redirected to the callback URL, which contains the verifier code.
  3. Save the value of the verifier code. Later you will set this in the OAuthVerifier connection property.
Next, you must exchange the OAuth verifier code for OAuth refresh and access tokens. Set the following properties:

On the headless machine, set the following connection properties to obtain the OAuth authentication values:

After the OAuth settings file is generated, you must re-set the following properties to connect:

  • InitiateOAuth: REFRESH.
  • OAuthSettingsLocation: The location containing the encrypted OAuth authentication values. Make sure this location grants read and write permissions to the connector to enable the automatic refreshing of the access token.
  • Custom applications only:
    • OAuthClientId: The client Id assigned when you registered your application.
    • OAuthClientSecret: The client secret assigned when you registered your application.

Option 2: Transfer OAuth Settings

Prior to connecting on a headless machine, you must create and install a connection with the driver on a device that supports an internet browser. Set the connection properties as described in "Desktop Applications" above.

After completing the instructions in "Desktop Applications", the resulting authentication values are encrypted and written to the location specified by OAuthSettingsLocation. The default filename is OAuthSettings.txt.

Once you have successfully tested the connection, copy the OAuth settings file to your headless machine.

On the headless machine, set the following connection properties to connect to data:

  • InitiateOAuth: REFRESH.
  • OAuthSettingsLocation: The location of your OAuth settings file. Make sure this location gives read and write permissions to the connector to enable the automatic refreshing of the access token.
  • Custom applications only:
    • OAuthClientId: The client Id assigned when you registered your application.
    • OAuthClientSecret: The client secret assigned when you registered your application.

Single Sign-On Identity Providers

ADFS

Set the AuthScheme to ADFS. You must set the following connection properties:

  • User: The ADFS user.
  • Password: The user's ADFS password.
  • SSODomain (optional): The domain configured with the ADFS identity provider.
Example connection string: 
AuthScheme=ADFS;User=ADFSUserName;Password=ADFSPassword;URL='http://sharepointserver/mysite';
Okta

Set the AuthScheme to Okta. The following connection properties are used to connect to Okta:

  • User: The Okta user.
  • Password: The user's Okta password.
  • SSODomain (optional): The domain configured with the OKTA identity provider.

Example connection string: 

AuthScheme=Okta;User=oktaUserName;Password=oktaPassword;URL='http://sharepointserver/mysite';
OneLogin

Set the AuthScheme to OneLogin. The following connection properties are used to connect to OneLogin:

  • User: The OneLogin user.
  • Password: The user's OneLogin password.
  • SSODomain (optional): The domain configured with the OneLogin identity provider.

Example connection string: 

AuthScheme=OneLogin;User=OneLoginUserName;Password=OneLoginPassword;URL='http://sharepointserver/mysite';
PingFederate

Set the AuthScheme to PingFederate. The following connection properties are used to connect to PingFederate:

  • User: The PingFederate user.
  • Password: PingFederate password for the user.
  • SSODomain (optional): The domain configured with the PingFederate identity provider.

Example connection string: 

AuthScheme=PingFederate;User=PingFederateUserName;Password=PingFederatePassword;URL='http://sharepointserver/mysite';

Azure MSI

If you are running Microsoft SharePoint on an Azure VM, you can leverage Azure Managed Service Identity (MSI) credentials to connect:

The MSI credentials are automatically obtained for authentication.

Azure Password

To connect using your Azure dredentials directly, specify the following connection properties:
  • AuthScheme: AzurePassword
  • User: The user account used to connect to Azure
  • Password: The password used to connect to Azure
  • AzureTenant: Directory (tenant) ID, found on the Overview page of the OAuth application used to authenticate to Microsoft SharePoint on Azure.

OAuthJWT Certificate

Set the AuthScheme to OAUTHJWT. The following connection properties are used to connect to Microsoft SharePoint:

SharePointOAuth

Set the AuthScheme to SharePointOAuth. The following connection properties are used to connect to SharePointOAuth:

Example connection string: 

SharePointEdition='SharePointOnline';URL=https://contoso.sharepoint.com;Schema=REST;AuthScheme=SharePointOAuth;InitiateOAuth=GETANDREFRESH;OAuthClientId=11111111-1111-1111-1111-111111111111;OAuthClientSecret=1111111111111/11111111111111/11111111111111=;
This AuthScheme works with the SharePoint app-only principal. Refer to Creating a Custom Entra ID (Azure AD) Application for instructions on how to set up and grant access to the app-only principal. The only section that applies to this AuthScheme is the SharePoint App section.

On April 2, 2026, Azure Access Control Services (ACS) will be retired for SharePoint in Microsoft 365. Existing users will no longer be able to create or use Azure ACS principals to access SharePoint. Additionally, as of November 1, 2024, Azure ACS was no longer available for new tenants. This change applied to all environments, including Government Clouds and the Department of Defense.

Microsoft recommends switching to a more secure authentication method, such as AzureAD or OAuthJWT.

Microsoft SharePoint On-Premises

Microsoft SharePoint On-Premises supports a number of premise-based architectures:

  • Windows (NTLM)
  • Kerberos
  • ADFS
  • Anonymous Access

Set SharePointEdition to "SharePoint On-Premises" to use the following authentication types.

Windows (NTLM)

This is the most common authentication type. As such, the connector is preconfigured to use NTLM as the default; simply set the Windows User and Password to connect.

Kerberos

Set the AuthScheme to NEGOTIATE, and then set the following Kerberos connection properties:

  • KerberosKDC: The host name or IP Address of your Kerberos KDC machine.
  • KerberosRealm: The realm of the Microsoft SharePoint Kerberos principal. This is the value after the '@' symbol (for instance, EXAMPLE.COM) of the principal value (for instance, MyService/[email protected]).
  • KerberosSPN: The service and host of the Microsoft SharePoint Kerberos Principal. This is the value prior to the '@' symbol (for instance, MyService/MyHost) of the principal value (for instance, MyService/[email protected]).

For details on how to authenticate with Kerberos, see Using Kerberos.

ADFS

Set the AuthScheme to ADFS, and then set the following connection properties:

You also need the to set SSOProperties to authenticate to ADFS. Specify the value of the RelyingParty parameter; it is located on the ADFS server for SharePoint. Example connection string: 
AuthScheme=ADFS;User=ADFSUserName;Password=ADFSPassword;SSOLoginURL='https://<authority>/adfs/services/trust/2005/usernamemixed';SSO Properties ='RelyingParty=urn:sharepoint:sp2016;';

Anonymous Access

Set the AuthScheme to NONE along with the URL.

Next Step

See Using the Connector to create data visualizations.

Copyright (c) 2025 CData Software, Inc. - All rights reserved.
Build 25.0.9434