SharePoint (Graph API) Integration with Adobe Workfront — Step-by-Step Guide
The modern, supported method. This guide uses the new SharePoint (Graph API) integration introduced in Workfront 22.3 (July 2022). It replaces the legacy ACS-based integration which was fully retired on April 2, 2026.
Why Graph API Instead of the Legacy Method?
| Legacy (SharePoint) ❌ | New (SharePoint Graph API) ✅ | |
|---|---|---|
| Auth method | Azure ACS via appregnew.aspx |
OAuth 2.0 via Microsoft Entra ID |
| Status | Retired April 2, 2026 | Fully supported — no retirement date |
| Admin setup required | Yes — complex, multiple pages | No — zero admin config needed |
| Per-user auth | No | Yes — each user signs in once |
| Permissions model | App-only, tenant/site scope | Delegated — user's own SharePoint access |
| Least privilege | Difficult to enforce | Built-in — users only see what they already have |
| New document linking | ❌ Not possible | ✅ Fully supported |
How It Works — The Simple Version
Admin enables SharePoint (Graph API) in Workfront once
↓
Each user signs into their Microsoft account from Workfront
↓
Workfront uses OAuth2 to get an access token on their behalf
↓
User can now browse, link, and upload SharePoint documents
↓
Users only see files they already have access to in SharePoint
🔐 Least Privilege built-in: Permissions are delegated — the integration never gets more access than the individual user already has in SharePoint. No admin grants, no XML, no FullControl required.
What You Need Before You Start
| Requirement | Who |
|---|---|
| Workfront System Administrator access | You (admin doing the setup) |
| Microsoft 365 account with SharePoint Online access | Each user |
| SharePoint Online (not on-premises) | Your org's Microsoft tenant |
| Workfront license: Standard or Plan | Your users |
| Workfront access level: Edit access to Documents | Your users |
⚠️ This integration works with SharePoint Online only. On-premises SharePoint is not supported.
Part 1 — Admin Setup (One-Time, Done Once for All Users)
This part takes about 2 minutes. You do it once and all users benefit.
Step 1 — Log into Workfront as System Administrator
- Open your browser and go to:
https://[your-tenant].my.workfront.com - Log in with your Workfront System Administrator credentials.
Step 2 — Go to Setup
- Click the Main Menu icon (grid/waffle icon) in the top-right corner of the screen.
- Click Setup (the gear icon).
Step 3 — Enable SharePoint (Graph API) in Cloud Providers
-
In the left panel, click Documents.
-
Under Documents, click Cloud Providers.
-
You will see a list of document integrations. Find SharePoint (Graph API) and make sure its checkbox is checked/enabled.
⚠️ If you also have the old SharePoint (legacy) integration listed, keep it enabled only if you have existing documents linked through it that users still need to access. For all new document linking, users must use SharePoint (Graph API).
-
Click Save.
✅ Admin setup is complete. That is all the admin needs to do.
Part 2 — User Setup (Each User Does This Once)
Every user must connect their own Microsoft account to Workfront the first time they use the integration. This is a one-time step per user.
Step 4 — Go to the Documents Area
Users can connect SharePoint from any place in Workfront that has a Documents tab. For example:
- Open any Project → click the Documents tab
- Or go to the main Documents area from the Main Menu
Step 5 — Click Add New → From SharePoint (Graph API)
-
Click the Add New button.
-
In the dropdown, click From SharePoint (Graph API).
If you do not see this option, ask your Workfront administrator to complete Part 1 (Step 3) above.
Step 6 — Sign into Your Microsoft Account
- A Microsoft login popup or redirect will appear.
- Enter your Microsoft 365 / work email and password.
- Complete any MFA (Multi-Factor Authentication) prompt if your organisation requires it.
Step 7 — Review and Accept Permissions
The first time you connect, Workfront will ask for permission to access your SharePoint. You will see a screen titled "Permissions requested" listing what Workfront needs:
| Permission Workfront Requests | Why It Needs It |
|---|---|
| Have full access to your files | To link and upload documents on your behalf |
| Read items in all site collections | To let you browse and navigate SharePoint sites |
| Edit or delete items in all site collections | To create assets; delete is only used to clean up failed link attempts |
| Maintain access to data you have given it access to | To generate a refresh token so you stay logged in |
| Sign in and read your profile | To act on your behalf through the OAuth2 flow |
🔐 These are delegated permissions — Workfront can only access what you personally can access in SharePoint. It cannot see anything beyond your own SharePoint permissions.
Click Accept (or Yes / Allow depending on what the screen shows).
⚠️ If you see "Approval Required" instead of "Permissions requested" — this means your organisation's Microsoft admin has restricted app consent. In that case, use the page to submit an approval request to your Microsoft 365 admin. Once the admin approves, come back and repeat from Step 5.
Step 8 — Browse and Select Files from SharePoint
After accepting, the SharePoint file picker will open inside Workfront. You can now:
- Browse your SharePoint sites and document libraries
- Use the search bar to find files by name
- Select one or multiple files or folders
- Click Link to attach them to Workfront
✅ The selected files are now linked to Workfront. A SharePoint icon will appear next to them in the Documents tab.
ℹ️ Files remain stored in SharePoint. Workfront only holds a link — not a copy of the file.
Part 3 — Day-to-Day Usage
Once set up, here is how users work with the integration every day.
Linking a Document from SharePoint to Workfront
- Go to the Documents tab of any Project, Task, or Issue.
- Click Add New → From SharePoint (Graph API).
- Browse or search for the file.
- Select the file(s) → click Link.
Sending a Document from Workfront to SharePoint
- Select a document already in Workfront.
- Click the More menu (three dots) → Send to → SharePoint (Graph API).
- Browse to the SharePoint folder where you want to save it.
- Click Save.
The document is now stored in SharePoint and linked back to Workfront. Any updates in SharePoint will reflect in Workfront.
Linking a Folder from SharePoint
- Go to the Documents tab.
- Click Add New → From SharePoint (Graph API).
- Browse to the folder you want to link.
- Select the folder → click Link.
⚠️ Linked folders sync their contents. If someone adds, removes, or edits files in SharePoint, those changes appear in Workfront automatically. However, the sync uses the credentials of the user who originally linked the folder — so if that user leaves the organisation, the folder must be re-linked by another user.
Important Limitations to Know
| Limitation | Detail |
|---|---|
| One SharePoint instance per user | A user can connect to only one SharePoint tenant. They cannot connect to a second SharePoint even if they have access to it. |
| No global/service account | Each user must authenticate individually. There is no way to set up a single shared account for all users. |
| SharePoint Online only | On-premises SharePoint is not supported. |
| File size limit | Single file: 5 GB max. Multiple files at once: 1 GB total. |
| Folder ownership risk | If the user who linked a folder loses SharePoint access or leaves the org, that folder becomes inaccessible in Workfront until re-linked. |
| New Documents area | This integration is not available in the new Adobe cloud storage Documents area. It works in the classic Documents tab only. |
Troubleshooting
| Problem | Fix |
|---|---|
| "From SharePoint (Graph API)" not visible in Add New | Admin has not enabled it — complete Part 1, Step 3 |
| "Approval Required" screen appears | Microsoft admin needs to approve the Workfront app in their Entra ID tenant — submit the request from that screen |
| User can see some sites but not others | Users only see what they have permission to in SharePoint — check their SharePoint site access |
| Linked folder content not loading | The user who linked the folder may have lost access — re-link the folder with an active user who has access |
| MFA prompt keeps repeating | Check if your org's Conditional Access policies require re-authentication — contact your Microsoft 365 admin |
| File linked but cannot open | Verify the user has at least View access to that file in SharePoint |
Comparison: What Each Role Does
| Role | Action | When |
|---|---|---|
| Workfront Admin | Enable SharePoint (Graph API) in Cloud Providers | Once, before users start |
| Microsoft 365 Admin | Approve the Workfront app (only if org restricts app consent) | Once, if "Approval Required" screen appears |
| Each User | Sign into Microsoft account from Workfront | Once per user |
| Each User | Link/browse/upload documents | Every time they need a SharePoint file |
Security Overview
- All communication between Workfront and SharePoint is over HTTPS.
- Workfront uses OAuth 2.0 — no passwords are stored by Workfront.
- Permissions are delegated — Workfront acts on behalf of the signed-in user, never beyond their access.
- Users can revoke access at any time from their Microsoft account's app permissions page at
https://myapps.microsoft.com. - Workfront does not store or copy SharePoint files. Only thumbnails for preview are cached.
Official References
| Resource | URL |
|---|---|
| Adobe Docs — Configure SharePoint Integration | https://experienceleague.adobe.com/en/docs/workfront/using/administration-and-setup/configure-integrations/configure-sharepoint-integration |
| Adobe Docs — Link Documents from External Apps | https://experienceleague.adobe.com/en/docs/workfront/using/documents/add-new-documents-to-workfront/link-documents-from-external-apps |
| Adobe Docs — Configure Document Integrations | https://experienceleague.adobe.com/en/docs/workfront/using/administration-and-setup/configure-integrations/configure-document-integrations |
| Microsoft — Azure ACS Retirement | https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-azure-acs |
What the Graph API Flow Actually Looks Like:
No comments:
Post a Comment