SharePoint SFTP OAuth2 migration guide

What changes ​

Legacy SharePoint Online WebDAV connections authenticate with a username and password and obtain SAML cookies such as FedAuth. The dedicated sharepoint-online connector uses an Entra ID application identity and Microsoft Graph instead. It has been available since SFTPPlus MFT 5.16.0. Use a current supported release for your migration.

The application has its own site grants rather than inheriting the old user's permissions. It requires a client secret, so OAuth2 does not mean credential-free access. Protect the secret and plan for its rotation without disabling MFA for user accounts.

Prepare the application and site permissions ​

Register an application in Entra ID and record its tenant ID and application ID. Create a client secret for the SFTPPlus location. Add Microsoft Graph Sites.Selected application permissions and grant administrator consent. Then explicitly grant the application access to each required site using Microsoft's selected permissions procedure. Consent by itself gives no access to a site.

Use read access for downloads that do not delete source files, or write access when the workflow changes site content. Have your administrator review the permissions for your intended operations. The legacy appinv.aspx procedure is not the setup route for this Graph connector.

Update locations and paths ​

Create a separate SharePoint Online location for each site. Set the site URL, directory_id, application_id, and the client secret in password.

For example, a site URL might be https://example.sharepoint.com/sites/finance. The transfer path for its Reports library is /Reports/2026, without the site domain or site name. Paths are case sensitive. A legacy WebDAV path containing /sites/finance/Reports/2026 therefore needs to change when moving to the new location.

Validate before switching production ​

Keep the old configuration as a reference and configure a test transfer using non-sensitive files in a separate folder. Retain source files during testing: deletion through the Online connector is permanent and does not use the recycle bin. Verify the delivered contents and successful transfer log entry, then test scheduling, existing filenames, and recovery from a connection failure. Stop the old transfer before enabling its replacement against production folders to avoid duplicate processing.

Troubleshoot authentication errors ​

For a legacy WebDAV location, a failure to retrieve authentication cookies or a 403 Forbidden response can occur when the tenant's sign-in policies prevent automated user login. A valid password and successful browser login do not establish that the same account can authenticate through a background process. Ask your administrator to review the relevant Entra sign-in logs. Do not disable user MFA as the remedy; migrate the transfer to the OAuth2 application identity described above.

For an OAuth2 location, check the tenant and application IDs, client secret value and expiry, administrator consent, and explicit permission grant for the target site. For a path error, check the library name and case, and remove the site name from the transfer path. A 403 response alone is not enough to identify the cause.

Microsoft's Azure ACS retirement on 2 April 2026 concerns the ACS model, including legacy app-permission setup. It is not a universal retirement date for every SAML or FedAuth login.

Request a configuration review with your product version, location type, transfer direction, and error text, with secrets removed from any logs or configuration you share. For deployment and evaluation options, see SFTP to SharePoint Online integration.