This guide walks you through connecting SharePoint Online to TruU TOTAL for persona generation and threat detection.

Overview

TOTAL ingests document and collaboration activity events from SharePoint Online via the Office 365 Management Activity API. We poll the activity feed on a configurable interval to collect, normalize, and correlate file access, sharing, permission changes, and site administration events across your SharePoint environment. Connector Type: Polling

Prerequisites

Microsoft Entra ID (Azure AD) access with Application Administrator or Global Administrator role
SharePoint Online enabled with active sites and document libraries
Microsoft 365 E3/E5 or equivalent license
Approximately 20 minutes to complete setup

Step 1: Register an Application in Entra ID

Sign in to the Azure Portal
Navigate to Microsoft Entra ID → App registrations
Click New registration
Enter:
- Name: TruU TOTAL - SharePoint Integration
- Supported account types: Accounts in this organizational directory only
- Redirect URI: Leave blank
Click Register
On the app’s Overview page, copy:
- Application (client) ID
- Directory (tenant) ID
Paste the Client ID and Tenant ID into the TruU Portal

Step 2: Create a Client Secret

In your App Registration, go to Certificates & secrets
Click New client secret
Enter:
- Description: TOTAL SharePoint integration
- Expires: Choose your organization’s preferred expiry
Click Add
Immediately copy the secret Value — it will only be shown once
Paste the Client Secret value into the TruU Portal

Step 3: Grant API Permissions

In the App Registration, click API permissions
Click Add a permission → Office 365 Management APIs → Application permissions
Add the following permission:
- ActivityFeed.Read — Read activity data for your organization
Additionally, add Microsoft Graph → Application permissions:
- Sites.Read.All — Read SharePoint site metadata for context enrichment
- User.Read.All — Read user profiles for identity resolution
Click Add permissions
Click Grant admin consent for [Your Organization]
Click Yes to confirm

All permissions are read-only. TOTAL cannot create, modify, or delete sites, documents, or permissions.

Step 4: Enable the Activity Feed Subscription

TOTAL will automatically start a subscription to the Audit.SharePoint content type via the Management Activity API. This is handled during the Test Connection step in the TruU Portal — no manual action is required on your part.

Step 5: Verify Connectivity

Once credentials are entered in the TruU Portal:

Click Test Connection — TOTAL will validate credentials and start the activity feed subscription
If successful, you’ll see a confirmation with recent SharePoint activity detected
If configured, TOTAL will run a historical data pull (up to 7 days) to seed user personas

Security & Privacy

What We Access

Read-only access to SharePoint activity logs via the Office 365 Management Activity API
File access, modification, sharing, and deletion events (metadata only — not file contents)
Site and permission administration events
All queries use timestamp filtering — we only fetch new events since the last poll

What We Don’t Have Access To

File contents or document text
Write access to SharePoint sites or libraries
Ability to modify permissions, sharing settings, or site configuration
Access to SharePoint admin center functions

Updating or Rotating Credentials

Rotate Client Secret (Recommended: Before expiry)

In Azure Portal, go to Entra ID → App registrations → TruU TOTAL - SharePoint Integration
Go to Certificates & secrets
Click New client secret (create the new one before deleting the old one)
Copy the new secret value and paste it in the TruU Portal
After TOTAL confirms the new secret is active, delete the old secret

Revoke Access

To immediately remove TOTAL’s access:

Option A — Disable in the TruU Portal
Option B — Remove the App Registration’s API permissions in Entra ID
Option C — Delete the App Registration entirely

Rate Limiting & Scalability

Office 365 Management Activity API Rate Limits

Parameter	Limit
Management Activity API	60,000 requests per minute per tenant
Content blob availability	5–15 minutes after event occurrence
Content retention	7 days (blobs expire after 7 days)
Throttle response	HTTP 429 with `Retry-After` header

Ingestion Capacity

At ~1,000 req/s (60K req/min), the Management Activity API provides massive headroom. A large enterprise with 100K+ users typically generates 500K–5M SharePoint events/day. The practical throughput constraint is Microsoft’s content blob delivery lag (5–15 minutes), not the API rate limit itself. TOTAL processes content blobs in parallel as they become available.

Event Freshness

SharePoint events are delivered via content blobs that become available 5–15 minutes after the event occurs. TOTAL polls on a configurable interval (default: 5 minutes). End-to-end latency is typically 10–20 minutes.

Resilience

TOTAL uses cursor-based ingestion with at-least-once delivery. The polling cursor only advances after events are successfully collected, normalized, and published. If any step fails, the cursor stays put and the next poll replays from the last known-good position. No events are lost. Transient failures (429s, 5xx, timeouts) are retried automatically with exponential backoff. After 5 consecutive failures, the connector self-pauses and can be re-enabled from the TruU Portal. Content blobs are retained for 7 days — any outage shorter than that results in zero data loss. For outages exceeding 7 days, events older than 7 days are unrecoverable.

Connector Design

Each connector polls on an independent, configurable interval. Events are batched and published in per-user order to preserve sequence integrity for persona building. Connector workers are stateless and scale horizontally. All polling intervals, page sizes, and batching parameters are tunable from the TruU Portal.

Part 2: Event Types & Data Schema

Signal Classification

Signal Class	TOTAL Category
Productivity & SaaS	Activity, Data Access

Event Types We Ingest

TOTAL extracts the following categories of events from the SharePoint activity feed. Every event is tied to a specific UserId (human identity). The Office 365 Management Activity API provides granular event types across file operations, sharing, and access control — all attributable to the user who performed the action.

File Operation Events

Operation	Description	TOTAL Classification
`FileAccessed`	User accessed a file	Data Access
`FileDownloaded`	User downloaded a file	Data Access
`FileUploaded`	User uploaded a file	Data Access
`FileModified`	User modified a file	Data Access
`FileDeleted`	User deleted a file	Data Access
`FileDeletedFirstStageRecycleBin`	File moved to first-stage recycle bin	Data Access
`FileDeletedSecondStageRecycleBin`	File permanently deleted from recycle bin	Data Access
`FileRestored`	User restored a file from recycle bin	Data Access
`FileMoved`	User moved a file between locations	Data Access
`FileRenamed`	User renamed a file	Data Access
`FileCopied`	User copied a file	Data Access
`FileCheckedOut`	User checked out a file	Data Access
`FileCheckedIn`	User checked in a file	Data Access
`FilePreviewed`	User previewed a file	Data Access
`FileSyncDownloadedFull`	User synced a full file download	Data Access
`FileSyncUploadedFull`	User synced a full file upload	Data Access
`FileVersionsAllDeleted`	All file versions deleted	Data Access

Operation	Description	TOTAL Classification
`SharingSet`	User shared a file or folder	Data Access
`SharingRevoked`	User revoked sharing on a resource	Data Access
`SharingInvitationCreated`	Sharing invitation sent	Data Access
`SharingInvitationAccepted`	Sharing invitation accepted	Data Access
`AnonymousLinkCreated`	Anonymous sharing link created	Data Access
`AnonymousLinkUsed`	Anonymous sharing link accessed	Data Access
`AnonymousLinkRemoved`	Anonymous sharing link removed	Data Access
`CompanyLinkCreated`	Company-wide sharing link created	Data Access
`SecureLinkCreated`	Secure sharing link created	Data Access
`AddedToSecureLink`	User added to a secure sharing link	Data Access

Site Administration Events

Operation	Description	TOTAL Classification
`SiteCollectionAdminAdded`	User added as site collection admin	Admin
`SiteCollectionAdminRemoved`	User removed as site collection admin	Admin
`MemberAdded`	User added to a SharePoint group	Admin
`MemberRemoved`	User removed from a SharePoint group	Admin

Permission Events

Operation	Description	TOTAL Classification
`SitePermissionsModified`	User’s site permissions changed	Admin
`SharingInheritanceBroken`	Unique permissions set on a resource for a user	Admin
`SharingInheritanceReset`	Permissions inheritance restored for a user	Admin

DLP & Compliance Events

Operation	Description	TOTAL Classification
`DLPRuleMatch`	User’s action triggered a DLP policy rule match	Alert
`SensitivityLabelApplied`	User applied a sensitivity label to a document	Admin
`SensitivityLabelRemoved`	User removed a sensitivity label from a document	Admin
`SensitivityLabelChanged`	User changed a sensitivity label on a document	Admin

Sample Source Event (Office 365 Management Activity API — File Downloaded)

{
  "CreationTime": "2026-03-15T11:30:45.000Z",
  "Id": "e5f6a7b8-c9d0-1234-efgh-567890123456",
  "Operation": "FileDownloaded",
  "OrganizationId": "org-id-001",
  "RecordType": 6,
  "UserKey": "user-aad-id-001",
  "UserType": 0,
  "Workload": "SharePoint",
  "ClientIP": "198.51.100.42",
  "UserId": "jane.doe@acme.com",
  "EventSource": "SharePoint",
  "ItemType": "File",
  "Site": "https://acme.sharepoint.com/sites/engineering",
  "SiteUrl": "https://acme.sharepoint.com/sites/engineering",
  "SourceRelativeUrl": "Shared Documents/Confidential",
  "SourceFileName": "architecture-review-2026.docx",
  "SourceFileExtension": "docx",
  "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
  "MachineDomainInfo": "ACME-WS-001",
  "MachineId": "machine-id-001",
  "ObjectId": "https://acme.sharepoint.com/sites/engineering/Shared Documents/Confidential/architecture-review-2026.docx",
  "ListId": "list-id-001",
  "ListItemUniqueId": "item-id-001",
  "CorrelationId": "corr-id-001",
  "CustomUniqueId": true,
  "SensitivityLabelId": "label-confidential-001",
  "SensitiveInfoTypeData": ""
}

TOTAL Normalized Event

{
  "event_id": "e5f6a7b8-c9d0-1234-efgh-567890123456",
  "event_type": "DATA_ACCESS",
  "source": "SHAREPOINT",
  "signal_type": "PRODUCTIVITY",
  "domain_id": "customer-domain-001",
  "tuid": "tuid-jane-doe-001",
  "timestamp": "2026-03-15T11:30:45.000Z",
  "payload": {
    "event_id": "e5f6a7b8-c9d0-1234-efgh-567890123456",
    "user": "jane.doe@acme.com",
    "action": "FileDownloaded",
    "site": "engineering",
    "file_name": "architecture-review-2026.docx",
    "file_extension": "docx",
    "file_path": "Shared Documents/Confidential",
    "ip_address": "198.51.100.42",
    "device": "ACME-WS-001",
    "sensitivity_label": "label-confidential-001"
  },
  "raw_metadata": {
    "platform_event_id": "e5f6a7b8-c9d0-1234-efgh-567890123456",
    "operation": "FileDownloaded",
    "workload": "SharePoint",
    "record_type": 6,
    "user_id": "jane.doe@acme.com",
    "user_key": "user-aad-id-001",
    "client_ip": "198.51.100.42",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    "site_url": "https://acme.sharepoint.com/sites/engineering",
    "source_relative_url": "Shared Documents/Confidential",
    "source_file_name": "architecture-review-2026.docx",
    "source_file_extension": "docx",
    "item_type": "File",
    "machine_domain": "ACME-WS-001",
    "machine_id": "machine-id-001",
    "sensitivity_label_id": "label-confidential-001",
    "correlation_id": "corr-id-001",
    "created_at": "2026-03-15T11:30:45.000Z",
    "source_platform": "sharepoint"
  },
  "platform_event_id": "e5f6a7b8-c9d0-1234-efgh-567890123456",
  "platform_event_source": "OFFICE365_MANAGEMENT_ACTIVITY_API"
}

How This Feeds TOTAL

Persona Building

SharePoint events define a user’s document access and data interaction pattern — which sites they visit, what files they access, how frequently they download or share documents, and what sensitivity levels they typically interact with. This forms the data access baseline of each persona, anchored to job function and routine.

Anomaly Detection

TOTAL’s behavioral engine uses SharePoint events to detect:

Data exfiltration indicators — bulk file downloads, unusual download volumes, or access to sensitive documents outside normal patterns
Sharing anomalies — creation of anonymous links to sensitive documents, sharing with external domains not in the user’s baseline
Permission escalation — unexpected site admin additions or permission level changes
Sensitivity label manipulation — removal or downgrade of sensitivity labels that may indicate an attempt to circumvent DLP controls
Access pattern drift — users accessing sites or document libraries outside their normal scope, indicating potential lateral movement or insider threat preparation

Breach Lifecycle Coverage

SharePoint events provide primary coverage across the Intent Exposed stage. Document access patterns are a core predictive indicator for exposing early intent and preparation — when a user begins accessing resources outside their normal routine, it often signals the earliest observable phase of an insider threat or compromised account.

INTEGRATIONS

​Overview

​Prerequisites

​Step 1: Register an Application in Entra ID

​Step 2: Create a Client Secret

​Step 3: Grant API Permissions

​Step 4: Enable the Activity Feed Subscription

​Step 5: Verify Connectivity

​Security & Privacy

​What We Access

​What We Don’t Have Access To

​Updating or Rotating Credentials

​Rotate Client Secret (Recommended: Before expiry)

​Revoke Access

​Rate Limiting & Scalability

​Office 365 Management Activity API Rate Limits

​Ingestion Capacity

​Event Freshness

​Resilience

​Connector Design

​Part 2: Event Types & Data Schema

​Signal Classification

​Event Types We Ingest

​File Operation Events

​Sharing Events

​Site Administration Events

​Permission Events

​DLP & Compliance Events

​Sample Source Event (Office 365 Management Activity API — File Downloaded)

​TOTAL Normalized Event

​How This Feeds TOTAL

​Persona Building

​Anomaly Detection

​Breach Lifecycle Coverage