Storing LitArbi Server’s files in SharePoint, step by step

Before you start

You need a Global Administrator of your Microsoft 365 (or someone who may grant admin consent and manage SharePoint), an administrator account on your LitArbi Server — version 1.10.2 or later — and the SharePoint site for the files: an existing one or a new one.

Working on your own, without LitArbi Server? Then you need none of the steps below — see Without LitArbi Server: a few clicks in SharePoint and in LitArbi’s Settings.

These are the five things you set up, in this order:

Why this way? Many integrations ask for access to every SharePoint site of the firm (Sites.ReadWrite.All). LitArbi Server asks for one site — not your mailboxes, not OneDrive, not the other sites. That is what Sites.Selected is for, and why step 4 exists.

The lawyers notice nothing. Their LitArbi talks only to LitArbi Server, which passes each file through: access still follows LitArbi’s matter membership, and every view and download is logged.

Step 1 — Register LitArbi Server in Microsoft Entra

1. Sign in to the Microsoft Entra admin center and open Entra ID ▸ App registrations ▸ New registration.
2. Name: LitArbi Server. Supported account types: leave Single tenant only. Leave the redirect URI empty and click Register.

1. The app’s Overview opens. Copy the Application (client) ID and the Directory (tenant) ID into a note — you need both in step 5. Neither is secret.

Step 2 — Allow access to selected sites only

1. In the app open API permissions and click Add a permission.
2. Choose the large Microsoft Graph tile.

1. Choose Application permissions — the server works without anyone signed in. Type Sites.Selected into the search box, tick Sites.Selected under Sites and click Add permissions.

1. Back on API permissions, click Grant admin consent for … (your directory’s name) and confirm with Yes. The Status column turns to a green tick: “Granted for …”.

Sites.Selected on its own opens no site at all. The one site comes in step 4.

Step 3 — Create the client secret

1. Open Certificates & secrets ▸ Client secrets ▸ New client secret.
2. Description: LitArbi Server. Expires: up to 24 months; the suggested 180 days mean renewing twice a year. Click Add.
3. Copy the Value at once: about 40 characters with a ~ in it. Entra shows it only now — when you come back, it is hidden.

Keep the secret only in the firm’s password manager, never in an e-mail. Put its expiry date in the calendar: before it runs out, create a new secret and enter it in step 5 — the other fields stay as they are.

Step 4 — Give LitArbi Server write access to one site

Sites.Selected needs a second half: the site has to be shared with the app. The admin centers have no button for it; Microsoft’s Graph Explorer does it with two requests in the browser.

4a · Find the site’s ID

1. Open Graph Explorer and sign in at the top right with your administrator account.
2. Leave GET and enter https://graph.microsoft.com/v1.0/sites/yourfirm.sharepoint.com:/sites/Litigation — with your site’s host and path, as in the site’s address bar.
3. Click Run query. Under OK – 200 the answer shows "id": three parts separated by commas. Copy all three, without the quotation marks.

4b · Let Graph Explorer manage site permissions, once

1. Graph Explorer itself needs the permission Sites.FullControl.All for the next request. Click the tab Modify permissions and there the link Open the permissions panel.

1. In the panel type Sites.FullControl, open Sites and click Consent; confirm Microsoft’s question with Accept. Graph Explorer then shows “Scope consent successful” — close the panel.

4c · Share the site with LitArbi Server

1. Switch the method to POST and enter https://graph.microsoft.com/v1.0/sites/SITE-ID/permissions — the ID from 4a in place of SITE-ID.
2. Paste this into Request body, with your Application (client) ID from step 1 in place of YOUR-CLIENT-ID:

{
  "roles": ["write"],
  "grantedToIdentities": [{
    "application": {
      "id": "YOUR-CLIENT-ID",
      "displayName": "LitArbi Server"
    }
  }]
}

1. Click Run query. The answer starts with Created – 201 and contains "roles": ["write"].

Your IT works with PnP PowerShell? One line does the same: Grant-PnPAzureADAppSitePermission -AppId YOUR-CLIENT-ID -DisplayName "LitArbi Server" -Site https://yourfirm.sharepoint.com/sites/Litigation -Permissions Write

Step 5 — The Storage page in LitArbi Server

In LitArbi Web open Administration ▸ Storage, choose SharePoint (Microsoft 365) and fill in:

Enter your own LitArbi password to confirm and click Test and save. The server signs in to Microsoft 365, creates the folder, writes a test file and deletes it again; only when all of that works does it switch. The page then says “Saved. New files are now stored in: SharePoint (Microsoft 365).” The secret is stored encrypted on the server.

Files stored before stay where they are and keep opening. Move … files to SharePoint copies them over, each one checked against its fingerprint.

What you find in SharePoint

• One folder per matter: Client — Matter (ABCDEF12).
• Each file under its own name plus a short code: Share Purchase Agreement (a1b2c3d4).pdf. Two different files with the same name both stay; the same file twice is stored once.
• “Modified by: SharePoint App” — that is LitArbi Server.
• LitArbi never deletes anything in SharePoint: your retention rules apply, also to files deleted in LitArbi.

Whoever has access to the site sees every matter in it — outside LitArbi’s matter membership and its log. Give the site only to the people who should see everything, or to nobody but the administrator.

Without LitArbi Server

A lawyer working on their own keeps the exhibit files in SharePoint all the same — straight from LitArbi, signed in with their own Microsoft 365 account. No app registration, no secret, no server, no OneDrive app. LitArbi 0.9.70 or later.

1. In LitArbi open Settings ▸ Storage and click Sign In with Microsoft…. Sign in with your Microsoft 365 work account.
2. Choose Library…: pick the SharePoint site and its document library (usually Documents). Leave Use for new matters ticked; tick Also keep the files of … for the matter that is open.
3. That is all. LitArbi keeps every exhibit file of the matter in LitArbi ▸ Client — Matter, named by date and title, and a working copy on your Mac. New and changed files go up by themselves; a renamed exhibit renames its copy; nothing is ever deleted in SharePoint.

“Need admin approval”? Some organisations let only IT approve apps. Approval Link for IT… copies a link for them: one click approves LitArbi for the whole organisation. LitArbi never gets more access than you already have in SharePoint.

Prefer a synced folder? Click Sync in the SharePoint library (Microsoft’s OneDrive app keeps it on your Mac) and choose it under Or a synced folder; Nextcloud, Dropbox, Google Drive and iCloud Drive work the same way. Several lawyers on one matter need LitArbi Server — the matter’s records live there, and its files can go to SharePoint as described above.

When something goes wrong

Test and save shows the reason. The usual ones: