Gemini Enterprise Series: Enable MS SharePoint & Outlook Connectors in less than 10 minutes

As AI adoption accelerates across enterprises, connecting Google Cloud Gemini Enterprise to Microsoft 365 is essential for unified workforce search and productivity. This step-by-step tutorial walks through registering Gemini Enterprise as an OAuth 2.0 application in Microsoft Entra ID, granting delegated Microsoft Graph and SharePoint API permissions, and setting up Federated Search and Actions connectors (Data Stores) for Microsoft SharePoint Online and Microsoft Outlook.

Overview

The Gemini Enterprise App is Google Cloud’s solution for enterprise-wide deployment of AI for the workforce. It provides an AI-powered enterprise search and assistant platform built on Google Cloud. It enables organizations to connect hundreds of data repositories — including Microsoft 365 services like Microsoft SharePoint and Microsoft Outlook — allowing users to securely query, discover, synthesize, and act upon corporate data using Google’s advanced generative AI models. This guide provides a comprehensive overview of how you can bring the best of Google’s AI capabilities to your corporate Microsoft 365 environment.

What we will cover in this guide

1. Setting up Gemini Enterprise as a third-party OAuth 2.0 application in Microsoft Entra ID.
2. Creating the Client ID and Client Secret, retrieving the Tenant ID, and configuring the required delegated API permissions (with Admin Consent) so that the Gemini Enterprise App can authenticate on behalf of the user to your Microsoft 365 environment.
3. Setting up the Microsoft Outlook and Microsoft SharePoint Connectors (Data Stores) step by step in the Gemini Enterprise Admin Console.

GCP and Microsoft Services used for the solution:

• GCP Gemini Enterprise App (Data Stores & Federated Search/Actions Connectors)
• Microsoft Entra ID (App Registrations, OAuth 2.0 Credentials & API Permissions)
• Microsoft 365 Admin Center (Organization Information & Tenant ID)
• Microsoft Outlook
• Microsoft SharePoint Online

Understanding User Federation for Gemini Enterprise & Microsoft 365

Before diving into the console screens, it is important to understand how identity and data access work together when connecting Google Cloud Gemini Enterprise to Microsoft 365 , and why Google Cloud now recommends Federated Search over traditional Data Ingestion connectors for these workloads.

How the New Recommended User Federation Works (Google Identity + Entra ID OAuth 2.0)

In a modern enterprise environment running both Google Cloud and Microsoft 365, the recommended architecture separates application sign-in from data-source authorization using a clean, two-layer federation model:

• Layer 1 — Application Sign-In via Google Identity: End users sign into the Gemini Enterprise web or mobile interface using their Google Identity (Cloud Identity or Google Workspace account). In most dual-cloud enterprises, Cloud Identity is already federated with Microsoft Entra ID for single sign-on (SSO) and provisioned with matching corporate email addresses (User Principal Names, or UPNs). Because Gemini Enterprise uses Google Identity for application-level access, you do not need to configure complex Workforce Identity Federation (WIF) pools or replicate Microsoft Entra ID security groups into Google Cloud just to query M365 data. You may still use WIF if you prefer, although it comes with its own tradeoffs and its out of scope for this particular guide.
• Layer 2 — Real-Time Data Authorization via Per-User OAuth 2.0 Delegation: When an end user queries Gemini Enterprise or triggers an interactive action across SharePoint or Outlook, the Federated Search & Actions connectors use the OAuth 2.0 application registered in Microsoft Entra ID ( that we will name “gemini-enterprise-sharepoint-connector” in this guide) to call the Microsoft Graph REST API and M365 Search APIs directly on behalf of that signed-in user.
• Native Source ACL Enforcement (Zero Privilege Escalation): Because all API calls use Delegated permissions (AllSites.Read, Mail.Read, Calendars.ReadWrite, Contacts.ReadWrite, User.Read) rather than tenant-wide background crawler credentials, Microsoft Entra ID, SharePoint Online, and Exchange Online evaluate the user’s native access control lists (ACLs) in real time at query execution. Users can only discover, summarize, or act upon SharePoint sites, files, emails, and calendar events they already have permission to access in Microsoft 365.

Federated Search vs. Data Ingestion connectors: Key Tradeoffs and Why We Recommend Federated Search

When configuring a Microsoft SharePoint or Microsoft Outlook Data Store in the Gemini Enterprise Admin Console, you are presented with two connector modes: Federated search (recommended) and Data ingestion. While Data Ingestion crawls and copies external content into a Google Cloud index, Federated Search queries Microsoft 365 APIs live at runtime. Google Cloud now recommends Federated Search as the default pattern for Microsoft 365 integrations based on the following architectural tradeoffs:

• Identity & ACL Simplicity:
  – Federated Search (Recommended): Works directly with Google Identity (or any configured IdP) via per-user OAuth 2.0 delegated tokens. Requires no Workforce Identity Federation (WIF) setup and no SCIM group syncing into Google Cloud, and imposes no artificial limits on the number of readers per document.
  – Data Ingestion: Strictly requires configuring Microsoft Entra ID with Workforce Identity Federation (WIF) so Google Cloud can ingest and evaluate Entra ID group ACLs against an indexed copy of the data (and caps SharePoint document ACLs at 3,000 reader principals per document). Furthermore, changing your identity provider later requires deleting and recreating all ingested data stores.
• Security Posture & Least-Privilege Permissions:
  – Federated Search (Recommended): Requires only Delegated API scopes (AllSites.Read, Mail.Read, Calendars.ReadWrite, Contacts.ReadWrite) with administrator consent. The connector never holds more access than the individual signed-in user.
  – Data Ingestion: Requires high-privilege, tenant-wide Application / Full Control permissions (such as Sites.FullControl.All across SharePoint and tenant-wide Mail.Read, GroupMember.Read.All, and User.Read.All across all mailboxes) so background indexing jobs can crawl every site and mailbox — a frequent blocker for enterprise security and M365 governance teams.
• Data Residency, Duplication & Storage Governance:
  – Federated Search (Recommended): Zero data duplication. Corporate emails, attachments, calendar items, and SharePoint documents stay 100% inside Microsoft 365 and are never copied into a secondary search index in Google Cloud.
  – Data Ingestion: Copies and stores full text and metadata snapshots inside Google Cloud Discovery Engine storage, duplicating sensitive M365 data across clouds and incurring additional indexing storage costs.
• Data Freshness & Throttling Resilience:
  – Federated Search (Recommended): Real-time freshness. Newly arrived emails, updated meeting invites, newly uploaded SharePoint files, and permission changes take effect immediately on the very next user query.
  – Data Ingestion: Subject to full and incremental crawl intervals, sync latency, and strict Microsoft Graph ingestion rate limits (for example, Outlook data ingestion is throttled at 10,000 API requests per 10-minute window).
• Interactive Agentic Actions:
  – Federated Search (Recommended): Natively supports interactive Actions executed on behalf of the user (such as sending/forwarding/moving Outlook emails, creating/updating calendar events and contacts, downloading mail attachments, and executing SharePoint actions).
  – Data Ingestion: Built for passive, read-only indexing and retrieval over periodically synced snapshots.
• Mobile App & Gemini Notebooks sharing:
  – At the time of this publication, sharing Gemini Notebooks is not supported with WIF, nor is the Gemini Enterprise Mobile app, so if your use case involves either of these, your only option is to use Federated Connectors.
• When to Still Consider Data Ingestion (Deep Document Parsing Tradeoff):
  – Because Federated Search delegates retrieval to Microsoft 365’s live search APIs at query time, it relies on Microsoft Search’s native indexing rather than running Google Cloud’s offline Layout Parser and OCR pipeline over every document in advance. If your primary workload requires deep optical character recognition (OCR) or structural layout extraction over large volumes of complex, multi-column scanned PDFs stored in SharePoint, Data Ingestion provides deeper offline document parsing. For virtually all other enterprise M365 search, grounding, and assistant workflows, Federated Search is the recommended choice.

Prerequisites for User Federation in This Tutorial

Before walking through the step-by-step configuration, ensure your environment meets these prerequisites across Identity, Google Cloud, and Microsoft 365:

• Identity & User Federation Prerequisites:
  – Google Identity Configured in Gemini Enterprise: In the Google Cloud Console under Gemini Enterprise > Settings > Authentication, confirm that Google Identity is enabled as your identity provider.
  – Aligned User Email / UPN: End users signing into Gemini Enterprise with their Google Identity (Cloud Identity or Google Workspace account) should have an email address that matches their Microsoft 365 User Principal Name (UPN) and Exchange Online mailbox address, and must be able to complete a one-time OAuth 2.0 user sign-in flow when first connecting their M365 account.
• Google Cloud & Gemini Enterprise Prerequisites:
  – Active Gemini Enterprise App: A Google Cloud project with the Gemini Enterprise (Discovery Engine) API enabled and an active Gemini Enterprise application created.
  – Administrator & End-User IAM Roles: The administrator setting up the connectors needs the Discovery Engine Admin (roles/discoveryengine.admin) role in Google Cloud, and end users accessing the assistant need the Gemini Enterprise User (roles/discoveryengine.agentspaceUser) role (or if you need fine-grained access control to the connectors, the proper User role in each connector for those users or groups and also enable Resource Access Control enabled in GE Settings, this setting is out of scope for this tutorial).
• Microsoft Entra ID & Microsoft 365 Prerequisites:
  – Microsoft 365 Online Tenant: An active Microsoft 365 subscription with SharePoint Online and Exchange Online (user mailboxes must reside in Exchange Online rather than on-premises Hybrid Exchange so they can be queried via the Microsoft Graph REST API).
  – Entra ID Global Administrator (or App + SharePoint Admin) Access: Administrator access to the Microsoft Entra Admin Center (https://entra.microsoft.com) and Microsoft 365 Admin Center (https://admin.microsoft.com) to register the OAuth 2.0 application, generate a Client Secret, and click Grant admin consent for the delegated Microsoft Graph and SharePoint API permissions.

Architecture Overview of This Tutorial’s Approach

The diagram below illustrates the end-to-end federated architecture we will build in this tutorial. End users authenticate to the Gemini Enterprise App using Google Identity (this might not be required if you already have federated your Entra users using Google Cloud Directory Sync, for example), while the SharePoint (sharepoint-connector) and Outlook (outlook-connector) Federated Data Stores communicate with Microsoft SharePoint Online and Microsoft Outlook / Exchange Online in real time through our Microsoft Entra ID OAuth 2.0 App Registration using per-user delegated permissions.

Architecture Diagram — Gemini Enterprise Federated Search & Actions with Microsoft Entra ID OAuth 2.0 User Delegation:

Starting the Connector Setup in the Gemini Enterprise Admin Console

Note: Some of the screenshots provided are for the Outlook connector, but they work similarly for the Sharepoint connector. you would need to do the connector setup twice, one for Sharepoint, one for the Outlook connector.

• Console: Google Cloud Console — Gemini Enterprise Admin Console (https://console.cloud.google.com)
• Where to navigate: Gemini Enterprise (left sidebar) > Data stores > + Create data store > Microsoft SharePoint > Step 2: Data

When you begin creating a Microsoft 365 Data Store in the Gemini Enterprise Admin Console:

1. Open Gemini Enterprise in the Google Cloud Console and select Data stores from the left-hand navigation menu (above Manage users and Settings).
2. Click + Create data store and choose Microsoft SharePoint (or Microsoft Outlook) in Step 1: Source.
3. In Step 2: Data (Specify the SharePoint source for your data store), expand 1. Connector mode and select Federated search (recommended) instead of Data ingestion, then click Continue.
4. Next, notice the collapsed configuration sections right below Connector mode: 2. Authentication settings, 3. Destinations, 4. Advanced options, and 5. Entities to search. To complete 2. Authentication settings, Gemini Enterprise requires your Microsoft Entra ID OAuth 2.0 credentials (Client ID, Client Secret, Tenant ID, and SharePoint Instance URI). Before we can fill out those fields, let’s switch to the Microsoft Entra Admin Center to create and retrieve them.

Console: Google Cloud Console — Gemini Enterprise Admin Console (Data stores > Create data store > Step 2: Data — Microsoft SharePoint):

Part 1: Set Up Gemini Enterprise as an OAuth 2.0 Application in Microsoft Entra ID

To complete the Authentication settings step in the Gemini Enterprise connector wizard, you first need to register Gemini Enterprise as an OAuth 2.0 application in Microsoft Entra ID and obtain the following credentials:

• Entra ID’s Tenant ID (Directory (tenant) ID)
• Client ID (Application (client) ID)
• Client Secret (Value)
• SharePoint Instance URI (https://<your-domain>.sharepoint.com)

For the complete prerequisite reference, see Configure Microsoft SharePoint for Gemini Enterprise.

Step 1: Locate Your Tenant ID and Open App Registrations in the Microsoft Entra Admin Center

• Console: Microsoft Entra Admin Center (https://entra.microsoft.com)
• Where to navigate: Left navigation sidebar > Entra ID > Overview and Entra ID > App registrations

Follow these steps in the Microsoft Entra Admin Center:

1. Sign in to the Microsoft Entra Admin Center using an account with Global Administrator privileges (as indicated by the Global Administrator badge on the right card below).
2. On the Microsoft Entra overview dashboard (Entra ID > Overview), locate the organization card on the left showing your Tenant ID and Primary domain. Click the copy icon next to Tenant ID to copy your Directory UUID.
3. In the left-hand navigation sidebar under Entra ID, click App registrations (highlighted in the navigation menu below), and then click + New registration at the top of the screen.
4. In the Register an application dialog:
   – Name: Enter a recognizable name for your integration, such as gemini-enterprise-sharepoint-connector (you can reuse this single Entra ID app registration for both the SharePoint and Outlook connectors).
   – Supported account types: Select Accounts in this organizational directory only (Single tenant).
   – Redirect URI: Select Web as the platform and add the required Google Cloud OAuth callback URIs (https://vertexaisearch.cloud.google.com/console/oauth/sharepoint_oauth.html for SharePoint, https://vertexaisearch.cloud.google.com/console/oauth/default_oauth.html for Outlook, and https://vertexaisearch.cloud.google.com/oauth-redirect under Manage > Authentication).
   – Click Register, and copy the Application (client) ID displayed on the newly created app’s Overview screen.

Console: Microsoft Entra Admin Center (Entra ID > Overview & Entra ID > App registrations in the left sidebar):

Understanding the Four Credentials Required by Gemini Enterprise

Before moving to the next screens, let’s review the exact four parameters you are collecting for the Gemini Enterprise connectors:

• Client ID: The unique Application (client) ID (UUID) generated on your app’s Overview blade in the Microsoft Entra Admin Center (Entra ID > App registrations > <your-app> > Overview).
• Client secret: The confidential Value string created under App registrations > <your-app> > Manage > Certificates & secrets (detailed in Step 3 below).
• Tenant ID: Your Microsoft 365 / Entra ID Directory (tenant) ID (UUID), which uniquely identifies your organization’s tenant.
• Instance URI: Your organization’s root SharePoint Online URL (for example, https://<your-domain>.sharepoint.com), required when configuring the SharePoint connector.

You will also configure the Microsoft Graph and SharePoint API permissions with the consent of a Microsoft SharePoint / Global Administrator.

Step 2: Retrieve Your Tenant ID from the Microsoft 365 Admin Center (Alternative Method)

• Console: Microsoft 365 Admin Center (https://admin.cloud.microsoft)
• Where to navigate: Home > Setup > Organization information (or open the direct link: Organization Information in the M365 Admin Center)

In addition to the Microsoft Entra Overview page shown in Step 1, you can also look up your Tenant ID and Default domain directly in the Microsoft 365 Admin Center:

1. Open the Organization information panel in the Microsoft 365 admin center.
2. In the Organization information flyout drawer on the right, locate Default domain (YOUR_DOMAIN) and Tenant ID (highlighted by the red box and arrow below).
3. Copy your Tenant ID and save it alongside your Client ID.

Console: Microsoft 365 Admin Center (Home > Setup > Organization information flyout panel — Copy your Tenant ID):

Step 3: Create and Copy the Client Secret in the Microsoft Entra Admin Center

• Console: Microsoft Entra Admin Center (https://entra.microsoft.com)
• Where to navigate: Home > App registrations > gemini-enterprise-sharepoint-connector > Manage (left sidebar) > Certificates & secrets

Once you have registered Gemini Enterprise as an OAuth 2.0 client application in Microsoft Entra ID (and copied its Application (client) ID from the app’s Overview page), generate its client secret:

1. In the left navigation menu of your App Registration (gemini-enterprise-sharepoint-connector), look under Manage and click Certificates & secrets.
2. Select the Client secrets tab and click + New client secret.
3. Enter a clear Description (for example, Secret GE — client), choose an expiration period, and click Add.

What to retrieve (Critical!): Immediately copy the string under the Value column (highlighted by the red “Copy and store this!” arrow below — do not copy the Secret ID UUID). Store this secret value somewhere safe right away, because Microsoft Entra ID masks the Value permanently as soon as you leave or refresh this screen.

Console: Microsoft Entra Admin Center (Home > App registrations > gemini-enterprise-sharepoint-connector > Certificates & secrets):

Step 4: Enable the Required API Permissions and Grant Admin Consent in Microsoft Entra ID

• Console: Microsoft Entra Admin Center (https://entra.microsoft.com)
• Where to navigate: Home > App registrations > gemini-enterprise-sharepoint-connector > Manage (left sidebar) > API permissions

Next, configure the delegated API permissions required for Gemini Enterprise to authenticate users and access both Microsoft Outlook (via Microsoft Graph) and Microsoft SharePoint:

1. In the left-hand menu of your App Registration under Manage, select API permissions.
2. Click + Add a permission under Configured permissions.
3. Add Microsoft Graph Delegated Permissions (10 permissions for User Profile & Outlook Mail, Calendar, and Contacts):

• Select Microsoft Graph -> Delegated permissions, then search for and select the following 10 permissions:

Calendars.Read (Read user calendars)

Calendars.Read.Shared (Read user and shared calendars)

Calendars.ReadWrite (Have full access to user calendars)

Contacts.Read (Read user contacts)

Contacts.ReadWrite (Have full access to user contacts)

email (View users’ email address)

Mail.Read (Read user mail)

Mail.Read.Shared (Read user and shared mail)

Mail.Send (Send mail as a user)

User.Read (Sign in and read user profile)

• Click Add permissions.

4. Add Microsoft SharePoint Delegated Permissions (1 permission for SharePoint Site Collections):

• Click + Add a permission again -> choose SharePoint -> Delegated permissions.
• Expand AllSites, check AllSites.Read (Read items in all site collections), and click Add permissions.

5. Grant Tenant-Wide Admin Consent (Crucial Step!):

• Back on the API permissions screen, click ✓ Grant admin consent for <your-tenant> (next to + Add a permission) and confirm in the dialog prompt.
• Verify that every permission in the Status column displays a green checkmark (Granted for <your-tenant>), as shown below.

Console: Microsoft Entra Admin Center (Home > App registrations > gemini-enterprise-sharepoint-connector > API permissions):

Part 2: Configure the Microsoft Outlook Connector in the Gemini Enterprise Admin Console

With your OAuth 2.0 application registered, client secret generated, and delegated API permissions granted in Microsoft Entra ID, switch back to the Google Cloud Console — Gemini Enterprise Admin Console to configure your Microsoft 365 Data Store connectors. Let’s walk through the Microsoft Outlook connector setup first (or you can resume where you left off configuring the Sharepoint connector at the beggining of the guide).

Step 1: Select Connector Mode and Enter Authentication Settings (Step 2: Data)

• Console: Google Cloud Console — Gemini Enterprise Admin Console (https://console.cloud.google.com)
• Where to navigate: Gemini Enterprise (left navigation menu) > Data stores > + Create data store > Select “Microsoft Outlook” in Step 1 (Source) > Step 2: Data (Specify the Outlook source for your data store)

On the Specify the Outlook source for your data store screen, complete the first two sub-steps:

1. Sub-step 1 — Connector mode: Select Federated search (recommended) so Gemini Enterprise queries Microsoft Graph live using the user’s identity, then click Continue.
2. Sub-step 2 — Authentication settings: Populate the fields using the credentials you retrieved from the Microsoft Entra Admin Center:
   – Client ID (Required): Paste YOUR-ClientID (the Application (client) ID of the app you registered in Entra ID).
   – Client Secret (Required): Paste the Client Secret Value you created and copied under Certificates & secrets in Entra ID.
   – Tenant ID (Required): Paste YOUR-Tenant ID (the Directory UUID from the Entra ID Overview or M365 Admin Center).
   – Microsoft Outlook Environment Type: Select Standard from the dropdown.
3. Authorize with Your M365 Admin Account: Click the login/authorize button and sign in with your Microsoft 365 administrator credentials (for example, m365-admin@<your-domain>). Confirm that the green banner appears at the bottom: Successfully logged in with associated identity: ….

Console: Google Cloud Console — Gemini Enterprise Admin Console (Create data store > Step 2: Data > Connector mode & Authentication settings):

Step 2: Configure Advanced Options (Step 2: Data — Sub-step 3)

• Console: Google Cloud Console — Gemini Enterprise Admin Console
• Where to navigate: Gemini Enterprise > Data stores > Create data store > Step 2: Data > Sub-step 3: Advanced options (click Continue under Authentication settings and scroll down).

In Sub-step 3: Advanced options, configure the tenant and cloud environment settings for Microsoft Online:

1. Enable static IP: Leave this unchecked unless your Microsoft Entra ID Conditional Access rules enforce strict IP allowlisting.
2. Azure Tenant (Required): Paste your Microsoft Entra Tenant ID (e.g., a00xxxxx-9999–000x-x0x0–000xx0x0xxxxx) — the same Directory UUID you copied from the Entra ID Overview or M365 Organization Information screen.
3. Microsoft 365 Cloud Environment: Select Global from the dropdown menu.
4. Click Continue inside the Advanced options panel to expand Sub-step 4: Entities to search.

Console: Google Cloud Console — Gemini Enterprise Admin Console (Create data store > Step 2: Data > Sub-step 3: Advanced options):

Step 3: Choose Outlook Entities to Search (Step 2: Data — Sub-step 4)

• Console: Google Cloud Console — Gemini Enterprise Admin Console
• Where to navigate: Gemini Enterprise > Data stores > Create data store > Step 2: Data > Sub-step 4: Entities to search

Once Authentication settings and Advanced options display blue completion checkmarks, Sub-step 4: Entities to search expands:

1. Under Choose entities you want to include (Root > All), check all four Microsoft Outlook entities that you want Gemini Enterprise to query during federated search:
   – Mail: User emails and message threads.
   – Mail Attachment: Files and documents attached to emails.
   – Calendar: Calendar events, meetings, and invitations.
   – Contact: Personal and organizational contacts stored in Outlook.
2. Click the blue Continue button at the bottom of the page to move to Step 3: Actions.

Console: Google Cloud Console — Gemini Enterprise Admin Console (Create data store > Step 2: Data > Sub-step 4: Entities to search):

Step 4: Select Microsoft Outlook Actions to Enable (Step 3: Actions)

• Console: Google Cloud Console — Gemini Enterprise Admin Console
• Where to navigate: Gemini Enterprise > Data stores > Create data store > Step 3: Actions (Select Microsoft Outlook actions to enable)

After clicking Continue from the Data step, the wizard advances to Step 3: Actions in the left-hand stepper. Because we granted Mail.Send, Calendars.ReadWrite, and Contacts.ReadWrite delegated permissions in Microsoft Entra ID earlier, Gemini Enterprise (and any custom agents using this connector) can execute interactive actions on behalf of the user:

1. Check Select all actions (or individually select the specific actions allowed by your organization):
   – Create contact: Creates a new Outlook contact.
   – Create calendar event: Schedules new Outlook calendar events.
   – Download attachments: Downloads one or more attachments from a specified email message.
   – Forward email: Forwards an email to a new recipient.
   – Move email: Moves an email to a specific folder.
   – Send email: Drafts an email to be sent from the user’s Outlook account.
   – Update contact: Updates an existing Outlook contact.
   – Update calendar event: Updates an existing Outlook calendar event.
2. Click Continue at the bottom of the screen to proceed to Step 4: Configuration.

Console: Google Cloud Console — Gemini Enterprise Admin Console (Create data store > Step 3: Actions — Select Microsoft Outlook actions to enable):

Step 5: Name and Create Your Outlook Data Connector (Step 4: Configuration)

• Console: Google Cloud Console — Gemini Enterprise Admin Console
• Where to navigate: Gemini Enterprise > Data stores > Create data store > Step 4: Configuration (Configure your data connector)

In the final step of the wizard (4. Configuration), complete the following fields:

1. Location of your data connector: Verify that the Multi-region matches your Gemini Enterprise app location (for example, global (Global)).
2. Your data connector name: Enter a recognizable name in the Data connector name (Required) field, such as outlook-connector. Note the auto-generated resource ID right below the field (in this case ID: outlook-connector_9999999999990), which cannot be changed after creation.
3. Sensitive data protection policy (Optional): If your organization enforces Cloud DLP / Sensitive Data Protection inspection policies, provide the full resource name (projects/{project}/locations/{location}/contentPolicies/{policy}); otherwise, leave it blank.
4. Click Create at the bottom of the page to provision your Microsoft Outlook connector.

Console: Google Cloud Console — Gemini Enterprise Admin Console (Create data store > Step 4: Configuration — Configure your data connector):

Part 3: Complete the Microsoft SharePoint Connector in the Gemini Enterprise Admin Console

Now that your Microsoft Outlook connector is provisioned, you can complete the Microsoft SharePoint connector we initiated at the start of this tutorial using the exact same Microsoft Entra ID OAuth 2.0 application credentials (gemini-enterprise-sharepoint-connector):

1. Open the SharePoint Connector Wizard: In the Google Cloud Console — Gemini Enterprise Admin Console, navigate to Gemini Enterprise > Data stores > + Create data store, select Microsoft SharePoint under Step 1: Source, and select Federated search (recommended) under Step 2: Data > 1. Connector mode (as shown in the first screenshot of this article).
2. Configure Authentication Settings (2. Authentication settings):
   – Client ID: Paste the Application (client) ID from your Microsoft Entra ID App Registration.
   – Client Secret: Paste the Client Secret Value generated under Certificates & secrets.
   – Tenant ID: Paste your Microsoft Entra Tenant ID (UUID).
   – Instance URI: Enter your organization’s root SharePoint Online URL in the format https://<your-domain>.sharepoint.com (for example, https://contoso.sharepoint.com).
   – Click the login/authorization button, sign in with your Microsoft 365 administrator account, and verify that the green Successfully logged in with associated identity banner appears.
3. Configure Destinations, Advanced Options & Entities (3. Destinations, 4. Advanced options, 5. Entities to search): Specify the SharePoint site collections to include, enter your Azure Tenant UUID and Global environment under Advanced options, and select the SharePoint entities to search.
4. Configure Actions & Create (Step 3: Actions & Step 4: Configuration): Enable any desired SharePoint actions, enter a connector name (such as sharepoint-connector) in Step 4: Configuration, and click Create.
5. Attach Connectors to Your Gemini Enterprise App: In the left-hand navigation menu of the Gemini Enterprise Admin Console, click Apps, select your Gemini Enterprise application, and link both outlook-connector and sharepoint-connector as active Data Stores.

Congratulations!

You have successfully set up the Microsoft 365 connectors for your Gemini Enterprise App! By following this guide, you have established a secure, federated integration that allows your organization to query, discover, synthesize, and take action on corporate data across both Google Cloud and Microsoft 365 environments.

What we’ve covered

• App Registration in Microsoft Entra ID: Registered Gemini Enterprise as an OAuth 2.0 application in the Microsoft Entra Admin Center and retrieved critical credentials, including the Tenant ID (via both the Entra ID Overview screen and the Microsoft 365 Admin Center), Application (Client) ID, and Client Secret Value.
• API Permissions & Admin Consent: Configured the required delegated permissions for Microsoft Graph (10 permissions covering Mail, Calendars, Contacts, and User profiles) and SharePoint (AllSites.Read), and granted tenant-wide administrator consent so the Gemini Enterprise App can securely authenticate and act on behalf of users.
• Microsoft Outlook Connector Setup: Created and configured the outlook-connector Data Store in the Gemini Enterprise Admin Console, selecting Federated search mode, authenticating with Entra ID credentials, configuring Advanced options (Azure Tenant and Global cloud environment), selecting all four Entities to search (Mail, Mail Attachment, Calendar, and Contact), and enabling all 8 interactive Outlook Actions (creating/updating events and contacts, sending/forwarding/moving emails, and downloading attachments).
• Microsoft SharePoint Connector Setup: Configured the Microsoft SharePoint Federated search connector in the Gemini Enterprise Admin Console using the registered Entra ID application credentials and SharePoint Instance URI to enable seamless cross-platform search over SharePoint site collections.

Useful Documentation

• Learn about Gemini Enterprise: https://docs.cloud.google.com/gemini/enterprise/docs
• SharePoint Federated Connector in Gemini Enterprise: https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-sharepoint/third-party-config
• Outlook Federated Connector in Gemini Enterprise: https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-outlook/third-party-config

Manual Last Updated November 5, 2026

Gemini Enterprise Series: Enable MS SharePoint & Outlook Connectors in less than 10 minutes was originally published in Google Cloud – Community on Medium, where people are continuing the conversation by highlighting and responding to this story.

Source Credit: https://medium.com/google-cloud/gemini-enterprise-series-enable-ms-sharepoint-outlook-connectors-in-less-than-10-minutes-18800d1409ed?source=rss—-e52cf94d98af—4

About the Author

Deven Goratela

Administrator

Visit Website View All Posts