What the SharePoint connector does
Many companies store expense receipts and invoices in SharePoint lists, with each row identified by an expense reference such as INV-00123.
The SharePoint connector is a document source, not a data source. This is the key difference from connectors like Concur or Rydoo:
You continue to upload your expense data as a CSV or Excel file exactly as you do today
SharePoint supplies the documents that belong to those expenses
During an import, VAT4U:
Reads the Expense ID from each row of your file
Searches every SharePoint list you have configured for that ID
Downloads all documents found for it
Merges multiple pages into a single PDF per expense
Attaches the result to the expense, ready for OCR, compliance checks and VAT recovery
A single expense often has documents spread across more than one list, and several pages within a list. The connector collects all of them.
The connector has read-only access to the sites you grant it. It cannot modify, create or delete anything in SharePoint.
Before you begin — what you need
Setting up this connector requires two people: your Microsoft 365 administrator, and a VAT4U user with the Administrator role.
Your Microsoft 365 administrator needs to:
Register an application in Microsoft Entra ID
Upload a certificate that VAT4U provides
Grant that application read access to the relevant SharePoint site
VAT4U provides a separate step-by-step guide for your administrator — ask VAT4U Support for the SharePoint access guide and forward it to them. It takes about twenty minutes and is done entirely in the browser.
Once your administrator is finished, you will have:
Value | Where it comes from |
Directory (tenant) ID | Application Overview page in Entra ID |
Application (client) ID | Application Overview page in Entra ID |
Client secret | Certificates & secrets, at the time the secret is created |
Certificate | Generated by VAT4U — you receive the private key and public certificate |
Site URL | The SharePoint site holding your documents |
List names | Every list VAT4U should search |
Why both a secret and a certificate?
SharePoint stores documents attached to a list in one of two ways, and the two require different credentials:
How the document is stored | Credential required |
Inline, in a text column | Client secret or certificate |
As a genuine SharePoint attachment | Certificate only |
Microsoft does not permit client-secret authentication for application access to the SharePoint API — only a certificate works there. This is a Microsoft platform rule and cannot be changed by any tenant setting.
If you configure only a client secret, the connector will appear to work: expenses import normally and documents stored inline are retrieved. Documents stored as SharePoint attachments will simply be missing, which is easy to mistake for expenses that have no receipt. VAT4U shows a warning on the connector page when no certificate is configured.
Step 1 — Activate the connector in VAT4U
Go to your company page and open the Connectors tab.
Under Document Source Connectors, click the SharePoint card.
Click Configure SharePoint integration.
Fill in the connection form:
Field | What to enter |
Directory (tenant) ID | The tenant GUID from your administrator |
Application (client) ID | The application GUID from your administrator |
Client secret | The secret Value — not the Secret ID |
Client secret expiry | The expiry date set when the secret was created |
Private key (PEM) | The private key supplied by VAT4U |
Public certificate (PEM / .cer) | The matching certificate — the same file your administrator uploaded to Entra ID |
Click Save connection details.
The thumbprint is calculated automatically and shown on the page. Your administrator can compare it with the value displayed in Entra ID to confirm both sides hold the same certificate.
Note: Secrets and keys are stored encrypted and are never displayed again. When editing later, leave a field blank to keep its stored value.
Step 2 — Add your SharePoint lists
In the SharePoint lists section, click Add list.
Complete one row per list:
Column | What to enter |
Site URL | Full site address, e.g. |
List name | The list name exactly as it appears in SharePoint |
Expense ID column | The column holding the expense reference. Usually |
Document storage | Leave as Detect automatically unless you know how the list stores documents |
Enabled | Switch off to exclude a list without deleting its settings |
Click Save lists.
Add every list that holds expense documents. All enabled lists are searched for each Expense ID, and everything found is combined into one document per expense.
Step 3 — Test the connection
Click Test connection.
VAT4U authenticates and checks each list in turn. A table shows whether each one is reachable.
If a list shows Not reachable, the most common cause is that your administrator granted the application access to a different site, or has not completed the site grant step. The detail column explains which.
Then test a real expense:
In Test a single Expense ID, enter an expense reference you know has documents in SharePoint.
Click Look up.
VAT4U reports how many documents it found and their sizes, without importing anything. This is the fastest way to confirm that your Expense ID column is mapped correctly before committing a whole file.
Step 4 — Run an import
Nothing changes in how you import. Upload your CSV or Excel file through the Import Wizard as usual, and map the column containing the Expense ID to a supporting-document field.
Documents are fetched in the background after the import completes. You can follow progress on the import detail page, in the document status panel.
Troubleshooting
A list shows "Not reachable" in the connection test
The application does not have access to that site. Ask your administrator to confirm the site grant was applied to the exact site URL you entered — a grant on one site does not cover other sites in the same tenant.
Look up returns no documents for an expense you can see in SharePoint
Check the Expense ID column setting matches the column actually holding the reference. It is the internal column name that matters, which is not always what is displayed
Confirm the value in your file matches SharePoint exactly, including any prefix
Confirm the list is Enabled
Look up is very slow, or fails on a large list
SharePoint refuses to search an unindexed column once a list passes 5,000 items. Ask your administrator to add an index on the Expense ID column in List settings → Indexed columns. This takes about a minute and is permanent.
Expenses import, but some documents are missing
Usually the certificate is missing or incomplete, so documents stored as SharePoint attachments cannot be retrieved. Check the connector page for a warning about certificate configuration, and confirm with your administrator that the SharePoint API permission was granted in addition to the Microsoft Graph one.
A warning says the secret or certificate is expiring
Credential renewal
Both the client secret and the certificate expire. Document retrieval stops on the expiry date — expenses will continue to import, but arrive without documents.
VAT4U shows a warning on the connector page from 30 days before expiry, and an error once a credential has expired.
To renew a client secret: your administrator creates a new one in Entra ID and sends you the Value. Open the connector, click Edit, enter the new secret and its expiry date, and save.
To renew a certificate: contact VAT4U Support. We issue a new key pair and send your administrator the public certificate to upload. Once uploaded, we update the VAT4U side.
We recommend arranging renewal about a month before expiry so there is no interruption.
Frequently asked questions
Does this replace my CSV import? No. The connector supplies documents only. You continue to provide expense data exactly as you do today.
Can VAT4U see other content in our SharePoint? No. Access is read-only and limited to the specific sites your administrator grants. The application cannot see any other site in your tenant.
Can I connect lists from more than one site? Yes. Each list row has its own site URL. Your administrator must grant the application access to each site separately.
What if an expense has several receipts? They are merged into a single PDF, ordered by page number where the list provides one.
What happens if I deactivate the connector? Documents already imported are unaffected. Deactivation removes the stored credentials and list settings, so future imports will not fetch documents from SharePoint.
How do we revoke VAT4U's access entirely? Your administrator removes the site grant, or the API permission, in Entra ID. This takes effect immediately and is independent of anything configured in VAT4U.
Is the connection secure? Yes. All communication uses TLS. Credentials are encrypted in VAT4U's database and never displayed after saving. The certificate private key is generated by VAT4U and never sent to any third party.