Microsoft SharePoint

Minimal User Permissions & Viz User

We recommend that you create a new user within your external tool, to be used only for Viz. This is the user information you will enter when setting up your tool connection within Planview Viz. By creating a new user, you will ensure that the correct permissions are granted.

In general, your user account should have sufficient permissions to read artifacts in your tool. 

Your user should have a secure password or token. Please be aware that Viz will not allow you to save a tool connection utilizing a weak password/token, such as 'tasktop.'

See Microsoft SharePoint User Guide to learn how to create a new user in Microsoft SharePoint.

Connecting to the Microsoft SharePoint Repository

Standard Authentication

Required Fields:

• URL
  • Example Format: http://abc-msps999
• Username
  • Example Format: domain\gu-sharepoint
• Password

SharePoint Azure Active Directory OAuth2 via Certificate

Note: Access to SharePoint via Azure AD authentication is only supported via certificate support. Shared secret is not supported.

See the section below for steps on configuring this authentication method.

Required Fields:

• URL

  • Example Format: http://abc-msps999
• Token Location
  • This can be found on the App Registration overview in Azure AD.
• Client ID
  • This can be found on the Overview page of your App Registration.
• Scope
  • Example format: https://company.sharepoint.com/.default
• Client Assertion
  • This is the entire encoded JWT token .
  • You will need to generate a custom JWT token for client assertion.

App Registration

The first step in using the Azure AD authenticator is to set up an app registration for Planview Viz — to generate authentication tokens and control access. See the section below for setting up app registration.

After setting up the app registration, you must grant 'Sites.FullControl.All' and 'SharePoint' permissions.

Note: Due to a restriction that is dictated by Azure Active Directory, the app registration must be granted access to ALL SharePoint sites within a Tenant and cannot be restricted. Please note that this may conflict with your organization's security policies.

To learn more, refer to Microsoft documentation here.

SharePoint Azure Active Directory OAuth2 via Certificate Configuration 

This authentication method only works with SharePoint online and Azure Active directory.

See the steps below to set up the Azure Active Directory authentication method:

1. Register an application for Viz on Azure Active directory 
   1.  
2. Grant permissions to the application to allow it to access SharePoint online
   1. Grant the application the "Sites.FullControl.All" permission under "SharePoint" 
3. Generate a Public / Private X.509 certificate key pair according to your requirements
   1. Note: You must use either Windows or Linux as you likely will not be able to generate a certificate key pair using Mac OSx. 
4. Add the certificate for Viz to Azure with the following steps:
   1. In the SharePoint application, click Certificates & secrets in the left sidebar.
   2. Then, add the public certificate to the Certificates section. 
      1. 

5. Generate a new JWT token

   1. Note: You must use either Windows or Linux as you likely will not be able to generate this token using Mac OSx.

   2. You can find additional information on the structure of the JWT token here and a tutorial on generating the JWT on Linux using Node here.

6. Save the token to use in Viz.
7. Fill in the Repository Connection fields in Planview Viz as follows:
   1. Token Location: This is the "Directory (tenant) ID" from your App Registration overview (see screenshot below)
      1. Example Format: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
   2. Client ID: This is the “Application (client) ID” from your App Registration overview (see screenshot below)
   3. Scope: This is your base SharePoint URL, <base-url>/.default
      1. Example Format: https://mycompany.sharepoint.com/.default
   4. Client Assertion: This is the entire encoded JWT token 
      1. 

Supported Work Items

Supported Containers