Help guides

Connecting Microsoft 365: OneDrive and SharePoint

With Microsoft 365 connected, your team can pick the documents they send straight from OneDrive or SharePoint, and every completed envelope is saved to a SharePoint site you choose — the signed documents, the combined PDF and the certificate of completion, in a folder of its own.

It comes with the Scale plan, and we’ll help you set it up if you need it. This guide is for the owner or an admin of your SignSwifly workspace, and for your Microsoft 365 administrator, who does two of the steps in your own Microsoft 365. It takes three steps, and each one is shown in SignSwifly under Settings → Connections.

Before you start

• Your SignSwifly workspace is on the Scale plan. If Settings → Connections says Microsoft 365 isn’t available yet, email us and we’ll let you know when it is.
• You’ll need three people, or one person with all three roles:
  • an owner or admin of your SignSwifly workspace;
  • a Global Administrator or Privileged Role Administrator in your Microsoft 365, to approve SignSwifly (step 1);
  • a Global Administrator, or a SharePoint Administrator once your admin has approved Microsoft Graph PowerShell to manage sites, to give SignSwifly one site (step 2; see why).
• Everyone uses a work or school Microsoft 365 account. Personal Microsoft accounts can’t be used.
• The SharePoint site’s address ends in sharepoint.com. Sites on a custom domain, or in a government cloud such as sharepoint.us, can’t be used.
• Microsoft’s sign-in opens in a popup window. If your browser blocks popups, allow them for anz.signswifly.com.au.

Your own people do every step, signed in as themselves. We never need a Microsoft 365 password, a sign-in code or access to your organisation, and we’ll never ask for one. We’re happy to talk your IT team through the steps.

What your Microsoft 365 admin will see

SignSwifly connects to Microsoft 365 through an app called SignSwifly Connections, published by Au Fait Solutions Pty Ltd, the company that runs SignSwifly. Microsoft shows its publisher domain as signswifly.com.au. Its application (client) ID is:

3baac921-a601-42a3-ad68-f109a7afa381

The same ID is shown in step 2 under Settings → Connections. After approval, the app is listed in your Microsoft Entra admin center under Enterprise applications, with that ID.

Microsoft has verified Au Fait Solutions Pty Ltd as the app’s publisher. So on Microsoft’s approval screen, and in Enterprise applications, the publisher appears with Microsoft’s blue verified badge. Microsoft shows the name in capitals: AU FAIT SOLUTIONS PTY LTD. Choosing the publisher’s name on the approval screen shows more, including the publisher domain, signswifly.com.au. Publisher verification is Microsoft’s check of the company behind an app, not of what the app does; the permissions below say what it does.

Your admin approves the app once for everyone (step 1). Do step 1 before anyone picks a file, even if you don’t plan to save to SharePoint. Saving to SharePoint needs a permission SignSwifly uses on its own, and only an admin can approve that kind of permission, so step 1 is needed anyway. Your admin’s approval also covers file picking for everyone in your organisation. Without it, whether a person can approve SignSwifly for themselves when they first pick a file depends on your organisation’s Microsoft 365 consent settings, and some organisations don’t allow it.

What SignSwifly can do

The app asks for four permissions. Three of them only work while one of your people is signed in, and only for files that person can already open. The fourth lets SignSwifly save completed envelopes with nobody signed in, but only to a site your admin chooses.

That’s all it asks for. SignSwifly can’t read your email, calendar or Teams. On its own, with nobody signed in, it can’t open any SharePoint site except the one your admin grants; a file from any other site reaches SignSwifly only when one of your people picks it. When someone picks a file, Microsoft’s sign-in stays in their browser tab; SignSwifly’s servers fetch only the file they chose, once, and keep no Microsoft sign-in. The site grant in step 2 gives write access to that one site, which in Microsoft’s terms includes reading it. SignSwifly uses it only to read the site’s name and list its document libraries, find or make the folder you chose, make each envelope’s folder, upload its files, and write and delete a small test file when you connect or choose Test connection.

Set it up

Step 1: your Microsoft 365 admin approves SignSwifly

1. An owner or admin of your workspace signs in to SignSwifly and opens Settings → Connections. Under Save completed envelopes to SharePoint, step 1 has the approval link.
2. If you’re the Microsoft 365 admin, choose Open Microsoft’s approval page. If not, choose Copy and send the link to your admin.
3. Your admin opens the link and signs in with their work account. Microsoft shows SignSwifly Connections, its publisher with Microsoft’s blue verified badge, and the permissions above. They choose Accept, which approves it for your whole organisation.
4. Microsoft returns to a SignSwifly page that says SignSwifly is approved ✓. Your admin doesn’t need a SignSwifly account to see it.

Only a Global Administrator or Privileged Role Administrator can approve it. Microsoft doesn’t let other admin roles approve an app that asks to act on its own in Microsoft Graph, as Sites.Selected does. If the page says Microsoft couldn’t complete the approval, ask someone with one of those two roles. If it says The approval was cancelled or declined, nothing changed: your admin can try again when ready. (Both pages are headed “SignSwifly wasn’t approved”, so go by the words under the heading.)

Once approved, your people can pick files from OneDrive and SharePoint. SignSwifly still can’t reach any SharePoint site on its own until step 2.

Step 2: your SharePoint admin gives SignSwifly one site

First choose the site completed envelopes should go to. SignSwifly gets write access to the whole of that site, so a site kept for signed records, such as “Signed agreements”, is a good choice. You can make a new one in SharePoint for it. Use a top-level site, at /sites/Name or /teams/Name: SignSwifly always connects the top-level site in an address, so a subsite can’t be used.

Your admin then runs a short PowerShell script. It signs in asking for a Microsoft permission to manage sites (Sites.FullControl.All), which only an admin can approve; a SharePoint Administrator can’t approve it for themselves. A Global Administrator can always run it. A SharePoint Administrator can run it once that permission has been approved for Microsoft Graph PowerShell in your organisation. If Microsoft shows a SharePoint Administrator Need admin approval, the admin who did step 1 approves it once, or runs the script themselves.

The script uses Microsoft Graph PowerShell; if it isn’t installed on their computer, they install it first:

Install-Module Microsoft.Graph -Scope CurrentUser

1. In Settings → Connections, step 2, choose Copy beside the script. It already has SignSwifly’s app ID in it. It looks like this:

Connect-MgGraph -Scopes "Sites.FullControl.All"
$site = Get-MgSite -SiteId "contoso.sharepoint.com:/sites/YourSite"
New-MgSitePermission -SiteId $site.Id -BodyParameter @{
  roles = @("write")
  grantedToIdentities = @(@{ application = @{ id = "3baac921-a601-42a3-ad68-f109a7afa381"; displayName = "SignSwifly" } })
}

2. Change contoso.sharepoint.com:/sites/YourSite to your site: its host name, a colon, then its path. For a site at https://northwind.sharepoint.com/sites/Contracts, that’s northwind.sharepoint.com:/sites/Contracts.
3. Paste it into PowerShell and press Enter. Microsoft asks the admin to sign in. If Microsoft Graph PowerShell hasn’t been approved to manage sites in your organisation yet, it then asks a Global Administrator to accept that permission; a SharePoint Administrator sees Need admin approval instead (see above).
4. PowerShell answers with the new permission, which shows write under its roles. That’s it: SignSwifly can now save to that site, and to no other.

If your admin prefers PnP PowerShell, Grant-PnPAzureADAppSitePermission with -Permissions Write and the same app ID does the same thing. PnP now needs an app registration of your own to sign in with, so Microsoft Graph PowerShell is usually simpler.

Step 3: connect the site in SignSwifly

An owner or admin of your workspace does this, in Settings → Connections, step 3.

1. Choose Sign in to Microsoft 365, and sign in with your work account in the organisation the site belongs to. SignSwifly shows who you’re signed in as.
2. Under Site address, paste the site’s address from your browser, such as https://northwind.sharepoint.com/sites/Contracts, and choose Find site. The address of a library or a page on the site works too. A subsite’s address finds the top-level site above it, so that’s the site your admin grants in step 2.
3. SignSwifly shows Found and the site’s name. Under Library, choose the document library to save into.
4. Under Folder (optional), give a folder inside that library, such as Signed contracts/2026. It’s made if it isn’t there. Leave it empty to save straight into the library.
5. Under Name each envelope’s folder, keep the suggested naming or change it (see where completed envelopes go). An example name shows as you type.
6. Choose Connect and test. SignSwifly writes a small text file whose name starts “SignSwifly connection test” to the folder and deletes it straight away. When it works, you see Connected. SignSwifly wrote and deleted a test file there. ✓

The connection is recorded in Settings → Team → Activity, with who connected it and when.

Check it works

• Settings → Connections now says where every completed envelope is saved, who connected it and when, and when it was last tested. Choose Test connection to run the test again at any time.
• Send a short test envelope to yourself and sign it. After a minute or so, open its row under Send & Sign: it says Saved to SharePoint, with a link to its folder.
• The envelope’s audit trail has a Saved to SharePoint entry, listing each file saved with its SHA-256 fingerprint.

Using it

Picking a document from OneDrive or SharePoint

Anyone in a Scale workspace can do this, in the envelope editor or the template editor.

1. In the envelope editor, give the envelope a name first.
2. Choose ☁️ From OneDrive or SharePoint, under the upload box beside + Add blank document.
3. Microsoft asks you to choose your work account and sign in. If SignSwifly says Microsoft 365 needs you to confirm access to your files, choose Continue.
4. Microsoft’s own file picker opens, with your OneDrive, recent files, files shared with you, and SharePoint sites. Choose the file. In the envelope editor you can choose several at once.

• You see only the files you can already open in Microsoft 365.
• PDF, Word (.docx and .doc), RTF, PNG and JPEG files can be picked, up to 28 MB each, and a PDF up to 300 pages. A picked file is treated exactly like an upload, and Word files are converted to PDF in the same way; a PDF that can’t be opened safely isn’t added, and the page says so.
• An envelope holds up to 20 documents.
• SignSwifly keeps its own copy of the file, as with an upload. Changes made to the original in OneDrive afterwards don’t reach the envelope.
• The envelope’s audit trail records that the document came from Microsoft 365.
• The picker opens in your OneDrive, so everyone who uses it needs a OneDrive, even to pick a SharePoint file. If SignSwifly says your account has no OneDrive, ask your IT admin to set one up.

Where completed envelopes go

Each envelope completed after you connect is saved straight away, in a folder of its own, inside the library and folder you chose. The folder holds:

• each signed document, under its own file name;
• All documents (combined).pdf, when the envelope had a combined PDF;
• Certificate of completion.pdf.

Files signers attached aren’t saved there: download them from the envelope’s row under Attached by signers.

Each folder is named from the pattern you set. Out of the box it’s {Envelope title} – {Completed date}, which gives a name like “Lease renewal – 12 Smith St – 2026-09-29”. You can use:

• The pattern needs at least one of these, so each envelope gets a folder of its own. If two envelopes would have the same name, SharePoint adds a number to the second.
• Characters SharePoint doesn’t allow are replaced, and long names are shortened to fit.
• To change the naming later, edit it in Settings → Connections and choose Save naming. It applies to envelopes saved from then on.
• Envelopes completed before you connected aren’t saved automatically. Their row says Not saved to SharePoint: this workspace wasn’t saving to SharePoint when it completed. To save one, open its row under Send & Sign and choose Save to SharePoint.
• To save to a different site, library or folder, an owner or admin chooses Connect a different site. Anything already saved stays where it is. A save still waiting goes to the new place.
• Your signed documents always stay in SignSwifly as well. SharePoint gets a copy.

If a save fails

Saving to SharePoint never holds up an envelope: it’s completed and sealed in SignSwifly whatever happens in SharePoint. If a save fails, SignSwifly tries again 7 more times over about a day. Each attempt is recorded on the envelope’s audit trail.

SignSwifly doesn’t email anyone about it. Instead, under Send & Sign, the envelope’s row says Couldn’t save to SharePoint, why, and when it will try again. Once you’ve fixed the problem, anyone in the workspace can choose Retry there; after the last attempt, Retry is the way to save it. A retry sends only the files that didn’t arrive, so the folder never holds two copies.

A file protected by a sensitivity label in SharePoint can’t be replaced by an app. This only matters when a save stopped partway and is tried again. If one envelope keeps failing for that reason, save its files by hand, or ask your admin about the label policy for that folder.

Disconnecting

In SignSwifly

An owner or admin opens Settings → Connections, chooses Disconnect, and confirms. Envelopes completed from then on aren’t saved to SharePoint. A save that was still waiting keeps trying for the rest of its day, and each failed try is on that envelope’s audit trail. Send & Sign stops showing SharePoint for envelopes not yet saved. Nothing already in SharePoint is touched. The change is recorded in Settings → Team → Activity.

In your Microsoft 365

Disconnecting in SignSwifly doesn’t change anything in your Microsoft 365. To take SignSwifly’s access away there too, disconnect in SignSwifly first, so no new saves are tried, then remove the site permission. Removing the app as well is optional.

• To remove its access to the site, your SharePoint admin lists the site’s app permissions, finds the one for SignSwifly, and removes it by its ID:

Connect-MgGraph -Scopes "Sites.FullControl.All"
$site = Get-MgSite -SiteId "contoso.sharepoint.com:/sites/YourSite"
Get-MgSitePermission -SiteId $site.Id | Format-List
Remove-MgSitePermission -SiteId $site.Id -PermissionId "the Id of SignSwifly's permission"

• To remove the app as well, after removing the site permission, your admin opens the Microsoft Entra admin center, goes to Enterprise applications, opens SignSwifly Connections, and deletes it under Properties. That withdraws the approval from step 1, and nobody can pick files from Microsoft 365 any more. Don’t delete the app instead of removing the site permission: the permission is kept on the site itself, so deleting the app leaves it there, and it applies again if anyone approves SignSwifly later or restores the app.

If your plan changes

Microsoft 365 is part of the Scale plan. If your workspace moves to another plan, the editors stop offering OneDrive and SharePoint, and completed envelopes aren’t saved to SharePoint. A save still waiting stops, and its envelope says why. The connection is kept, and an owner or admin can still disconnect it.

Back on Scale, envelopes completed in the last 14 days are saved automatically. Older ones say Not saved to SharePoint. For those, or a save that stopped, open its row under Send & Sign and choose Save to SharePoint or Retry.

Questions

Does SignSwifly store our Microsoft 365 passwords?

No. Everyone signs in on Microsoft’s own page, and SignSwifly never sees a password. It doesn’t keep anyone’s Microsoft sign-in either. For the connection it stores your Microsoft 365 organisation’s ID, the site, library and folder, the folder naming, who connected it and when, and the result of the last test. For each envelope it records how saving went and which files were saved.

Can SignSwifly read all of our SharePoint or OneDrive?

No. On its own, SignSwifly can reach only the one site your admin granted in step 2. When one of your people picks a file, they see only what they can already open, and SignSwifly fetches only the file they chose.

What happens if a save to SharePoint fails?

The envelope is still completed and sealed in SignSwifly. SignSwifly tries again over about a day, and the envelope’s row says why it failed, with a Retry button. See If a save fails.

Where is our data kept?

Documents picked from OneDrive or SharePoint are copied into SignSwifly and stored in Australia, like any upload. The copies saved to SharePoint are kept wherever your Microsoft 365 keeps that site, under your own Microsoft 365 settings and retention rules.

How can we check the app is really SignSwifly’s?

Before your admin chooses Accept in step 1, they can check three things on Microsoft’s approval screen. The app is called SignSwifly Connections. Its publisher is Au Fait Solutions Pty Ltd (shown as AU FAIT SOLUTIONS PTY LTD), with Microsoft’s blue verified badge. And choosing the publisher’s name shows the publisher domain signswifly.com.au. If any of these is different, don’t accept it, and email us. After approval, the app listed in Enterprise applications should have the application ID shown in What your Microsoft 365 admin will see.

Can we save to more than one site?

Each workspace saves to one site, library and folder at a time. Within it, each envelope gets a folder of its own.

Can you do the setup for us?

The approval and the site grant have to be done by your own admins, in your own Microsoft 365, and we never ask for access to it. We’re glad to go through each step with them: email us.