Spider Impact can import spreadsheets that live in Microsoft 365 (SharePoint Online, OneDrive, and Teams) on a schedule, the same way it already imports from FTP, Google Sheets, or an uploaded file. Once the connection is set up, you paste the everyday "Copy link" URL of a spreadsheet, and Spider Impact downloads and imports the current version of that file on every run. Nobody has to download the file or upload it by hand.

Because SharePoint, OneDrive, and Teams all keep their files in the same storage underneath, a single connection reaches all three. Files you see in a Teams channel actually live in SharePoint, and files shared in a Teams chat live in the sender's OneDrive, so there's nothing extra to set up for Teams.

This works for every kind of spreadsheet import: KPI values, initiative values, scorecard and initiative structure, and datasets. The file itself has to be a CSV or Microsoft Excel file (.csv, .xls, or .xlsx).

Setting this up has two halves. A Microsoft 365 administrator does the first half once, in Microsoft Entra, the part of Microsoft 365 where apps and sign-ins are managed. After that, creating connections and building imports happens entirely inside Spider Impact.

Spider Impact connects to Microsoft 365 as an application rather than as a person signing in, which is why scheduled imports keep running when nobody is logged in. It also means there's no "Sign in with Microsoft" button — the setup work in Part 1 is what takes the place of it.

If the Microsoft terminology is new to you, the Glossary of Microsoft Terms at the end of this article explains each term in plain English.

Part 1: Setting Up the Microsoft Side

This part is done once, by someone who can administer your Microsoft 365 environment, in the Microsoft Entra admin center at entra.microsoft.com. You're creating an "app registration," which is an identity that Spider Impact will use to read your files.

Registering the Application

In the Entra admin center, go to Applications > App registrations and click "New registration." Give it a name you'll recognize later, such as "Spider Impact – Data Import," leave the default account type of "Single tenant" selected, skip the Redirect URI, and click Register.

Giving the App Permission to Read Your Files

Open your new app registration, go to API permissions, and click Add a permission > Microsoft Graph > Application permissions. You have two choices here, and they're a real trade-off between how much setup you want to do and how much the app can see.

Files.Read.All is the simplest. You add the permission, grant admin consent, and you're finished — the app can read files anywhere in your organization, including SharePoint, OneDrive, and Teams chats. The cost is that it's broad: the app could read any file in the organization, not just the ones you care about.

Sites.Selected is the most secure. The app starts out with access to nothing, and you then grant it read access to only the specific SharePoint sites you name, so it can never see anything else. The cost is one extra step per site, which we cover below. Sites.Selected reaches SharePoint sites and all Teams channel files, but it does not reach personal OneDrive files or files shared in Teams chats — those are only reachable with Files.Read.All.

Our recommendation is Sites.Selected, with the spreadsheets you want to import stored in a Teams channel or a SharePoint site rather than in a personal OneDrive folder or a chat.

After adding your choice, click "Grant admin consent for [your organization]" so the permission becomes active. You should see a green check in the Status column.

Admin consent only turns the permission on. If you chose Sites.Selected, the app still can't read a single file until you complete the next step. If you chose Files.Read.All, admin consent is all it needs and you can skip ahead to creating a credential.

Granting the app access to a site

This step is only for Sites.Selected. Microsoft doesn't offer a button for it in the portal, so per-site access is granted with a short command that a SharePoint administrator can run in about a minute per site.

The easiest way is PnP PowerShell. Install it once with

Install-Module PnP.PowerShell

Then for each site you want the app to read, fill in your site URL and the app's Client ID and run:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/YourSite" -Interactive
Grant-PnPAzureADAppSitePermission `
-AppId "<your Application (client) ID>" `
-DisplayName "Spider Impact – Data Import" `
-Site "https://contoso.sharepoint.com/sites/YourSite" `
-Permissions Read

That's all it takes. The app can now read files on that site and nowhere else. To import from another site later, run the

Grant-PnPAzureADAppSitePermission

command again with the new site's URL.

If you'd rather not use PowerShell, the same grant can be made in Microsoft Graph Explorer with a POST to /sites/{site-id}/permissions using the role read and your app's Client ID. And if this step is more than you want to take on, Files.Read.All skips it entirely.

Creating a Credential

Spider Impact needs a way to prove that it really is your app. Go to Certificates & secrets in the app registration and create either a client secret or a certificate. A secret is simpler; a certificate is more secure, and most US Government tenants require one.

Creating a client secret

On the Client secrets tab, click "New client secret," choose an expiration, and then copy the secret's Value immediately — Microsoft only shows it once. If you lose it, you'll have to create another one.

Client secrets expire. Make a note of the expiration date, because when the secret expires your scheduled imports will start failing until someone creates a new secret and pastes it into the Spider Impact connection.

Creating a certificate

On the Certificates tab, click "Upload certificate" and upload your public certificate. Entra gets the public certificate; Spider Impact gets the same certificate together with its private key, in a single PEM file.

Many organizations issue certificates centrally, so it's worth asking your IT or security team first. If you ask, request two things: the public certificate to upload to Entra, and a PEM file containing the certificate together with its private key for Spider Impact.

If you'd rather create your own, a free self-signed certificate works perfectly here. On a Mac or Linux machine — or on Windows with Git Bash — run this to make a certificate and private key that are good for two years:

openssl req -x509 -newkey rsa:2048 -days 730 -nodes \
-keyout spider-key.pem -out spider-cert.pem \
-subj "/CN=Spider Impact Microsoft 365 Import"

Then combine the two into the single PEM file that Spider Impact wants:

cat spider-cert.pem spider-key.pem > spider-impact.pem

Now upload spider-cert.pem to Entra on the Certificates tab, and keep spider-impact.pem to paste into Spider Impact in Part 2. Keep the private key and the combined PEM file private — anyone who has them can act as your app.

A few requirements to be aware of if you're building the PEM file yourself, or using one your IT team provided:

• The PEM has to contain both a certificate block (beginning with -----BEGIN CERTIFICATE-----) and a private key block (beginning with -----BEGIN PRIVATE KEY-----), and the key has to match the certificate.
• The key has to be an RSA key in PKCS#8 format, which is what the openssl req command above produces. An older-style key whose block reads -----BEGIN RSA PRIVATE KEY----- needs converting first with openssl pkcs8 -topk8 -nocrypt -in old-key.pem -out spider-key.pem.
• The certificate has to be within its validity period. An expired certificate is reported as such when you validate the connection.

Copying the Tenant ID and Client ID

Finally, go to the app registration's Overview page and copy these two values, which you'll paste into Spider Impact next:

• Application (client) ID
• Directory (tenant) ID

Part 2: Creating the Import Connection

Microsoft 365 connections are managed with all of the other import connections on the Admin > Import Connections screen. Find the "Microsoft 365 Connections" panel and click "Add Connection" in its corner.

This opens the "Add Microsoft 365 Connection" dialog, where you hand Spider Impact the information you gathered in Part 1.

1. Cloud Environment is almost always "Commercial (standard Microsoft 365)." Choose "GCC High (US Government)" or "DoD (US Department of Defense)" only if your organization is on one of the US Government clouds.
2. Tenant ID is the Directory (tenant) ID from the app's Overview page.
3. Client ID is the Application (client) ID from the same page.
4. Authentication Type flips between Client Secret and Certificate. Choose whichever you created in Part 1, and then paste the secret's value or the contents of your PEM file into the box below.

When you click Next, Spider Impact tries to authenticate with Microsoft 365 right away. If anything is wrong you'll see a message explaining which part to check, and you'll stay on this step until it works.

Once authentication succeeds, you give the connection a name and assign owners — the people and groups who are allowed to build imports with it — and click Done. Ownership works the same way here as it does for every other kind of import connection. Back on the Import Connections screen, the connection reports that it's online and ready to use.

One connection serves as many imports and datasets as you like, so most organizations only need one. As with the other connection types, a connection that's being used by an import or a dataset can't be deleted until nothing depends on it.

When you edit a saved connection later, leave the Client Secret or Certificate box blank to keep the credential you already saved. You only re-enter it when you actually want to change it — or when you switch the Authentication Type, since a certificate can't stand in for a secret.

Part 3: Importing a File

With the connection in place, importing a file is mostly a matter of pasting a link.

Copying the File's Link in Microsoft 365

Open the folder the file lives in, select the file, and click Copy link. Share does the same thing, with the added options for sending the link to somebody.

The example above is a Teams channel's folder, which is why it shows up in SharePoint rather than in Teams — the same link works either way.

When Microsoft offers you a choice of who the link is for, prefer a link scoped to your organization, or to "People with existing access," over an "Anyone" link. Spider Impact doesn't need the link to be public — it authenticates as your app — so there's no reason to create a link that anyone with the URL could open.

Choosing Your Microsoft 365 Data Source

Go to Admin > Imports and start a new import, or start creating a dataset. Choose a Standard Import, and then pick Microsoft 365 from the list of spreadsheet data sources.

Choose the connection you created in Part 2, paste the link you copied into the File URL box, and click Next.

Spider Impact checks the file when you click Next. If it can read the file, you move on to the rest of the import; if it can't, it tells you what went wrong. The Troubleshooting section below covers each message.

If no connection exists yet, or you need a different one, the "Add Microsoft 365 Connection" link on this step opens the same wizard from Part 2 without leaving the import.

From here on, a Microsoft 365 import is exactly like any other spreadsheet import. Spider Impact reads the file and shows you the data so you can pick the worksheet, mark the row that holds your column labels, ignore the columns you don't need, and map everything to its destination.

Then save the import and give it a schedule, just as you would for a spreadsheet on an FTP server. On every run, Spider Impact goes back to Microsoft 365 and reads the file again, so when somebody updates the spreadsheet, the next import picks up the change.

What to Expect Once It's Running

Spider Impact stores the link, not a copy of the file, and it resolves that link fresh on every run. This has a few consequences worth knowing about:

• Renaming or moving the file is fine. As long as the link still resolves in Microsoft 365, the import keeps working.
• Replacing the file with a different type is not. If the file behind the link changes from a .csv to an .xlsx, for example, Spider Impact stops rather than misreading it, and asks you to re-select the file.
• Revoking the link, or removing the app's access to the site, stops the import. The import fails with a message rather than quietly importing yesterday's data.

Throughout the Spider Impact interface, a Microsoft 365 file is identified by its file name rather than by its link, and the link is never displayed again once you've saved it. So when you edit a saved import you'll see the current file's name, and the File URL box will be empty — leave it empty to keep importing that file, or paste a new link to point the import somewhere else. Changing which connection an import uses always requires pasting a link, so the file can be checked against the new connection's access.

For the same reason, the link isn't carried along when a dataset is copied or exported to another environment. The copy keeps everything else, and you paste a link into it once to start it importing.

Re-linking a dataset to a different Microsoft 365 file requires that you own the connection, or that you have the Modify Import Connections permission. Imports are more permissive: an import's owner can re-link it even on a connection they don't own.

Government Clouds (GCC High and DoD)

Spider Impact can import from Microsoft's US Government clouds. Because Spider Impact runs inside your own network, your data never leaves your accreditation boundary, and no authorization on Spider Strategies' side is involved.

Everything in this article applies, with three differences:

• Set Cloud Environment on the connection to "GCC High (US Government)" or "DoD (US Department of Defense)." This is what points Spider Impact at the right Microsoft endpoints. A link from one cloud can't be read by a connection pointed at another.
• Register the app in your government tenant, at portal.azure.us rather than entra.microsoft.com.
• Use the Certificate option. Government tenants generally require a certificate rather than a client secret.

Smartcard sign-in (CAC or PIV) isn't involved here. That's for interactive human logins, and these imports run unattended on a schedule.

Troubleshooting

If validating a connection or running an import fails, the message points at what to fix.

Two more things are worth checking when an import that used to work stops working. Client secrets expire, which looks like an authentication failure rather than a permission problem. And if you're using Sites.Selected, a spreadsheet that somebody moved to a different SharePoint site is now on a site the app was never granted, which looks like a permission problem rather than a missing file.

Glossary of Microsoft Terms

Microsoft Entra is the part of Microsoft 365 where you manage apps and sign-ins. It used to be called Azure Active Directory, so you may still see it referred to as Azure AD.

An app registration is an identity you create in Entra so that an outside tool — here, Spider Impact — can reach your Microsoft 365 data on its own, without a person signing in.

The Application (client) ID identifies your app, and the Directory (tenant) ID identifies your Microsoft 365 organization. Both are on the app registration's Overview page, and Spider Impact needs both.

A client secret is a password-like string your app uses to prove its identity. It's the simplest credential to set up, but it expires and has to be replaced.

A certificate is a more secure alternative to a secret, and the option most US Government tenants require. Entra gets the public certificate; Spider Impact gets the certificate together with its private key in one PEM file.

Admin consent is a Microsoft 365 administrator's one-time approval that switches a permission on so the app can actually use it. A permission that's been added but not consented to does nothing.

Sites.Selected and Files.Read.All are the two permission choices for the app. Sites.Selected is the most secure: the app can read only the specific SharePoint sites you explicitly grant it, and each one takes a short command. Files.Read.All is the simplest: no per-site step, but the app can read files across your whole organization, including personal OneDrive files and Teams chat files.

A cloud environment is which Microsoft 365 cloud your organization is on: Commercial, which is the standard one, or the US Government clouds GCC High and DoD.