Step-by-Step Guide: Configuring Container Types in SharePoint Embedded
Tags: sharepoint, embedded
Published: 2024-03-12 07:30:00

Setting up **SharePoint Embedded** can be a bit confusing. *Microsoft* hasn't updated the documentation properly because it's still in *Feature Preview*.

That's where this article comes in handy. This **4-step guide** is based on my experience and the current existing documentation. It helped me build my first application using **SharePoint Embedded**.

Follow these steps, and you'll be on your way to developing your solution using **SharePoint Embedded** features:

1. Obtain a _Microsoft 365_ Tenant Admin Account
2. Configure a new *Entra ID* Application
3. Create a New **Container Type**
4. Register the **Container Type** with the consuming tenant

> _**Want to learn more about SharePoint Embedded?** I've written more articles explaining what it is and how you can leverage its features to enhance your content management. **Check them out here:** [https://intranetfromthetrenches.substack.com/t/sharepoint-embedded](https://intranetfromthetrenches.substack.com/t/sharepoint-embedded)_


## Step 1 - Obtain a Microsoft 365 Tenant Admin Account

To create a new **Container Type**, you need the admin tenant account for _Microsoft 365_. Reach out to your IT team or the individuals managing your _Microsoft 365_ account to help you out.


## Step 2 - Configure a new Entra ID Application

### Step 2.1 - Create a new application

Here's how to create a new *Entra ID* (formerly known as *Azure AD*) application. It allows to authenticate and obtain the necessary permissions for accessing *Microsoft Graph*:

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) using the *Microsoft 365* tenant admin account.
1. Navigate to the *Identity* section on the left and select *Applications*. Then, click on *App registrations* and choose the _New registration_ button at the top.
![Entra ID Application Page](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F646e7fd2-6f9a-428f-b370-b757cd3cf942_1200x600.png)
1. On the *Register an application* page,
	1. Provide a unique name for the application.
	2. Under the _Redirect URI (optional)_ section, select _Single-page application_ from the _Add a platform_ dropdown menu. Then, enter `http://localhost:3000` in the textbox.
	![Entra ID Application Register Page](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F9724af8c-a137-447a-a90f-691ed7218089_1200x600.png)
1. Click on the _Register_ button at the bottom left corner of the page.


### Step 2.2 - Setting the API Permissions for the application

This step is essential for configuring the permissions for the app. It will allow the creation and access to the **Container Type** and its containers. Likewise, for any other required permissions, make sure they are added accordingly.

> *Ensure to include the **Files.ReadWrite.All** permission if you plan to work with files before going with these steps.*

Here's how to proceed:

1. Navigate to your application page.
2. Click on the _Manifest_ option under the _Manage_ section in the left-hand side menu.
![API Permissions Menu](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fbcdd91fa-60c1-494c-b006-df3fda77ecb8_1200x600.png)
3. Locate the property **requiredResourceAccess**. Under the _Microsoft Graph_ group, with **resourceAppId** equal to **00000003-0000-0000-c000-000000000000**, add the following items to allow application and delegated permissions for the _FileStorageContainer.Selected_ claim.
```JSON
{
	"resourceAppId": "00000003-0000-0000-c000-000000000000",
	"resourceAccess": [
		{
			"id": "085ca537-6565-41c2-aca7-db852babc212",
			"type": "Scope"
		},
		{
			"id": "40dc41bc-0f7e-42ff-89bd-d9516947e474",
			"type": "Role"
		}
	]
}
```
4. Next, add a new **resourceAppId** for *SharePoint Online*, which is **00000003-0000-0ff1-ce00-000000000000**. Then, add the specified permissions. They enable application and delegated permissions for the _Container.Selected_ claim.
```JSON
{
	"resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
	"resourceAccess": [
		{
			"id": "4d114b1a-3649-4764-9dfb-be1e236ff371",
			"type": "Scope"
		},
		{
			"id": "19766c1b-905b-43af-8756-06526ab42875",
			"type": "Role"
		}
	]
}
```
5. Confirm you have the same configuration as the following screenshot. Then, click on the *Save* button at the top,
![API Permissions Manifest](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6c974fe1-86c8-49f1-a9c1-34a663c4cad0_1200x600.png)
6. Click on _API Permissions_ under the _Manage_ section in the left-hand side menu.
7. Scroll down to find the link to the *Enterprise applications* option at the bottom of the page, then click on it.
![API Permissions Page](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F7a934a1a-c997-4a9d-aa37-fabaf8db56ca_1200x600.png)
8. Click the _Grant admin consent_ button in the middle of the page to approve the permissions added in the manifest.
![API Permissions Grant Access](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa8be8cf3-7f93-4185-9f22-83cf2e365530_1200x600.png)

> **If you find the need to add more permissions after completing these steps, proceed as usual to add them. Afterwards, ensure that the SharePoint Embedded permissions are retained. If not, repeat these steps.**


### Step 2.3 - Creating a Client Secret

This step is optional but I encourage doing it. It will save you time when developing your applications. Here are the steps:

1. Navigate to your application page.
2. Click on _Certificates and secrets_ under the _Manage_ section on the left-hand side menu.
![Client Secret Page](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F79049e34-678f-4a01-8e07-c61909e1001d_1200x600.png)
3. On the _Certificates & Secrets_ page, select the _Client Secrets_ tab and then click on the _New client secret_ button.
4. Provide a description, and choose an expiration duration. Then click on the _Add_ button at the bottom of the page.
![Client Secret Configuration](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd5e1fb2a-88cb-476a-a7d7-989258a1a506_1200x600.png)

> **Once the secret is created, it will be displayed only once. Be sure to copy it as the client secret into your local text file for later use in this module. Failure to do so will require generating a new secret and removing the previous one.**


### Step 2.4 - Create a self-signed certificate

To register the new **Container Type** in the consumer tenant, a certificate is necessary as part of the registration process.

Follow these steps for creating and configuring it in the application:

1. Download the *PowerShell* script [**Create-OpenSslScript.ps1**](https://gist.github.com/jaloplo/724f28db17fab829457528fe8d5ad5ac) from my *Gist* repository.
2. Execute the script to generate the *openssl* script. It serves for creating the certificate public and private keys.

```PowerShell
> $Path = "Set the location where public and private key files will be generated"
> $Name = "Set the name for the public and private key files"
> $OutFile = "Set the path and name for the openssl script to be generated"
  
> Create-OpenSslScript.ps1 -Path $Path -Name $Name -OutFile $OutFile
```
![OpenSsl PowerShell Script execution](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3d1d6106-bcfa-4eaf-b5eb-fc4f13c6014d_1200x600.png)
3. You should have a new script similar to the following.
![OpenSsl script example](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F4b234a3b-7d54-427b-87d3-e6680402a8d6_1200x600.png)
4. Run the script using the *openssl* tool. In my case, it is located in my *git* installation folder, *%PROGRAMFILES%\Git\mingw64\bin*.
![OpenSsl Console](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F56e6b981-1570-4722-86a0-e0232a56a69f_1200x600.png)
5. Navigate to your application page.
6. Click on _Certificates and secrets_ under the _Manage_ section on the left-hand side menu.
![Certificates and Secrets Page](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6ba9a612-3e32-497a-a1e3-41723538718f_1200x600.png)
7. On the _Certificates & Secrets_ page, select the _Certificates_ tab and then click on the _Upload certificate_ button.
8. Choose the previously generated *\*.crt* file, then click on the _Add_ button at the bottom of the page.
9. Copy the *Thumbprint* displayed after uploading the certificate.
![Certificate and Secrets Thumbprint](https://substackcdn.com/image/fetch/w_1456,c_limit,f_webp,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F11591e41-7375-4e74-a10f-66cce26799bf_1200x600.png)


## Step 3 - Create a New Container Type

This step involves generating a new **Container Type**, which can be done using the *SharePoint Online PowerShell* module.

Here's what you need to do:

1. Obtain the *SharePoint Online* central administration URL. Something similar to `https://<your tenant name>-admin.sharepoint.com`.
2. Retrieve the application ID from the one created in Step 2.1.
3. From your *Azure* tenant, open the *Azure Subscription* service. Locate the one where **SharePoint Embedded** is configured. Take note of the Id of the subscription service.
4. From your *Azure* tenant, get the resource group name where **SharePoint Embedded** costs will be managed.
5. Identify the region of the previous resource group.
6. Download the following script, [**Create-SPOContainerType.ps1.**](https://gist.github.com/jaloplo/2d99c237741a10e121462b86ba3cfb2a) Then, execute it, providing all the necessary data for creating a trial container.

```PowerShell
> .\Create-SPOContainerType.ps1 -SpoAdminUrl "https://<your tenant name>-admin.sharepoint.com"  `
                                -ContainerTypeName "MyFirstsContainerType" `
                                -EntraAppId "<your Entra ID application id>" `
                                -AzureSubscriptionId "<your Azure Subscription id>" `
                                -ResourceGroupName "<your Resource Group name>" `
                                -ResourceGroupRegion "<your Resource Group region>"
```

The *PowerShell* script will then display the details for your new **Container Type**. Be sure to copy the **ContainerTypeId** for future reference.

```
Container Type ID:
===========================================================
ContainerTypeId     : 9ae8f98e-29fd-45a4-b6b6-5a514a7ffd50
ContainerTypeName   : MyFirstsContainerType
OwningApplicationId : 520e6e65-1143-4c87-a7d3-baf242915dbb
Classification      : Trial
AzureSubscriptionId : 7cf6d692-d6e1-4067-89e2-eef1e49b7a64
ResourceGroup       :
Region              :
```


## Step 4 - Register the Container Type with the Consumer Tenant

The final step is to register the **Container Type** in the consumer tenant. I've prepared a *PowerShell* script to handle all the necessary operations.

Here's what you need to provide to the script:

1. Obtain the application ID from the one created in Step 2.1.
2. Retrieve the **Container Type ID** from Step 3.
3. Find the location of the *PEM* file generated in Step 2.4.
4. Obtain the certificate *thumbprint* obtained in Step 2.4.
5. Obtain the consumer tenant ID and URL.

Now, download the following script, [**Register-SPOContainerType.ps1**](https://gist.github.com/jaloplo/6612a9842202fcf00099f41437086aad). Then, execute it, providing all the data.

```PowerShell
> .\Register-SPOContainerType.ps1 -ClientId "<your Entra ID application id>" `
                                  -ContainerTypeId "<your Container Type id>" `
                                  -PemCertificationFilePath "<your local path to the PEM file>" `
                                  -ConsumerTenantId "<your tenant id>" `
                                  -ConsumerTenantUrl "https://<your tenant name>.sharepoint.com" `
                                  -Thumbprint "<your Entra ID certificate thumbprint>"
```

After running the script, you'll have an app ready for managing and accessing the **SharePoint Embedded** containers.


## Final thoughts

By following these steps, you can set up your **SharePoint Embedded** application for the first time. As you've seen, it's quite straightforward.

Have you something in mind to start developing? Share your thoughts below.

If you find this information useful, feel free to share it with your colleagues.


## References

- *Create-OpenSslScript.ps1: [https://gist.github.com/jaloplo/724f28db17fab829457528fe8d5ad5ac](https://gist.github.com/jaloplo/724f28db17fab829457528fe8d5ad5ac)*
- *Create-SPOContainerType.ps1: [https://gist.github.com/jaloplo/2d99c237741a10e121462b86ba3cfb2a#file-create-spocontainertype-ps1](https://gist.github.com/jaloplo/2d99c237741a10e121462b86ba3cfb2a#file-create-spocontainertype-ps1)*
- *Register-SPOContainerType.ps1: [https://gist.github.com/jaloplo/6612a9842202fcf00099f41437086aad#file-register-spocontainertype-ps1](https://gist.github.com/jaloplo/6612a9842202fcf00099f41437086aad#file-register-spocontainertype-ps1)*
- *SharePoint Embedded Container Types: [https://github.com/SharePoint/sp-dev-docs/blob/main/docs/embedded/concepts/app-concepts/containertypes.md](https://github.com/SharePoint/sp-dev-docs/blob/main/docs/embedded/concepts/app-concepts/containertypes.md)*
- *Setup and configure the SharePoint Embedded environment and web app project: [https://learn.microsoft.com/en-us/training/modules/sharepoint-embedded-create-app/3-exercise-set-up-configure-sharepoint-embedded](https://learn.microsoft.com/en-us/training/modules/sharepoint-embedded-create-app/3-exercise-set-up-configure-sharepoint-embedded)*
- *SharePoint-Embedded-Samples: [https://github.com/microsoft/SharePoint-Embedded-Samples](https://github.com/microsoft/SharePoint-Embedded-Samples)*
- *Microsoft identity platform and the OAuth 2.0 client credentials flow: [https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow)*
- *Microsoft identity platform application authentication certificate credentials: [https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials](https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials)*