Add or Edit a SharePoint Server Source

Members of the Administrators and Content Managers built-in groups can include SharePoint on-premises content and make it searchable. In a Coveo-powered search interface, the source content is accessible to either everyone, the source creator only, or specific users as determined by source permissions (see Content Security).

To retrieve SharePoint Online content, you must create a SharePoint Online source.

Source Key Characteristics

Features Supported Additional information
SharePoint version 2019, 2016, 2013, 2010, Foundation 2013, and Foundation 2010  
Searchable content types Sites, sub-sites, public user profiles1, personal websites1, lists, list items, list item attachments, document libraries, document sets, documents, web parts2, and microblog posts and replies.
Content update operations Refresh

Takes place every six hours by default. A rescan or rebuild is required to take account of deleted user profiles.

Rescan Takes place every week by default.
Content security options Determined by source permissions On-premises Active Directory permission systems aren't supported with SharePoint Server sources of the On-Premises type. If you use the Crawling Module, however, Active Directory is supported.
Source creator  

1: Not available in Microsoft SharePoint Foundation.

2: Not all web parts are available in Microsoft SharePoint Foundation 2010 (see Web Parts in SharePoint Foundation).


Active Directory Federation Services

When your SharePoint environment uses ADFS as a trusted identity provider, the ADFS service endpoint URL paths must be enabled (see Enable the ADFS Service Endpoint URL Path).

SharePoint Account Permissions

When you want to include SharePoint content, you must create a specific SharePoint account to be used by the source only. Otherwise, you need to also change the source Password value each time the account password changes to prevent authentication errors (see Username and Password).

  1. Access your SharePoint tenant with an administrator account.

  2. On your SharePoint tenant:

    1. Select or create a user account for the source to use when retrieving your SharePoint content. See the following table to identify the required type of user for your web application enabled authentication.

      SharePoint environment SharePoint web application enabled authentication User type User format
      Classic Windows Windows account


      Claims Windows Windows account
      Okta Okta SSO
    2. Grant appropriate SharePoint permissions to the SharePoint account to ensure it has access to the content that you want to make searchable.

      The following table presents the minimal required permissions that the source account must have to perform specific actions.

      Action to perform Minimal required permission
      Content and security indexing, source refresh, and site collection discovery

      Full Read policy for each web application to make searchable (see Add the Full Read Policy to All SharePoint Tenant Web Applications).

      Personal site, public user profile, and social tags indexing

      When including personal sites or public user profiles, the account used as source credentials must not have a personal site on the SharePoint server being included to prevent failures when attempting to retrieve the list of personal sites.

Add or Edit a SharePoint Server Source

Before you start, ensure that your SharePoint instance meets the source requirements.

When adding a source, in the Add a source of content panel, click the On-Premises or the Crawling Module tab, depending on whether you need to use the Coveo On-Premises Crawling Module to retrieve your content. See Content Retrieval Methods for details.

A SharePoint Server source indexes on-premises (server) content. To retrieve cloud content instead, see Add or Edit a SharePoint Online Source.

“Configuration” Tab

On the Add/Edit a SharePoint Server Source subpage, the Configuration tab is selected by default. It contains your source’s general and authentication information, as well as other parameters.

General Information

Source Name

Enter a name for your source.

A source name can’t be modified once it’s saved, therefore be sure to use a short and descriptive name, using letters, numbers, hyphens (-), and underscores (_). Avoid spaces and other special characters.


Enter one or more URLs corresponding to the desired site collection, lists, websites, and subsites to make searchable. Each URL must include the protocol and tenant name.

  • For a specific web application: https://site:8080/

  • For a specific site collection: https://site:8080/sites/support

  • For a specific website: https://site:8080/sites/support/subsite

  • For a specific list: https://site:8080/sites/support/lists/contacts/allItems.aspx

    A specific folder in a list isn’t supported.


In the drop-down menu, select the option for the content type matching the URLs you specified. By default, Web application is selected.

Available options are the following:

Value Content to make searchable
Web application All site collections of the specified web application
Site collection All web sites of the specified site collection
Web and sub webs Only the specified web site and its sub webs (also known as subsites)
List Only the specified list or document library
Paired Crawling Module

If your source is a Crawling Module source and if you have more than one Crawling Module linked to this organization, select the one with which you want to pair your source. If you change the Crawling Module instance paired with your source, a successful rebuild is required for your change to apply.

Character Optical Recognition (OCR)

If you want Coveo Cloud to extract text from image files or PDF files containing images, check the appropriate box. OCR-extracted text is processed as item data, meaning that it’s fully searchable and will appear in the item Quick View. See Enable Optical Character Recognition for details on this feature.


When adding a source, if you have more than one logical (non-Elasticsearch) index in your organization, select the index in which the retrieved content will be stored (see Leverage Many Coveo Indexes). If your organization only has one index, this drop-down menu isn’t visible and you have no decision to make.

  • To add a source storing content in an index different than default, you need the View access level on the Logical Index domain (see Manage Privileges and Logical Indexes Domain).

  • Once the source is added, you can’t switch to a different index.

“Content Security” Tab

Select who will be able to access the source items through a Coveo-powered search interface. For details on this parameter, see Content Security.

“Authentication” Section

In the Authentication section, you must provide authentication information so that Coveo can access the content you want to make searchable. In the drop-down menu, select the identity provider you use to manage identities in your SharePoint site. Options are:

  • Active Directory On-Premises (available when using the Crawling Module only)

  • Windows (NTLM or Kerberos)

  • ADFS under claims (simple or chained ADFS identity provider)

  • Okta

Depending on the option you choose in the drop-down menu, you must fill or check some of the following boxes.

Username and Password

The username and password of a dedicated SharePoint administrator account that has access to the content to include or, if using Okta, the username of an Okta administrator account. See Source Credentials Leading Practices.


The URL of an ADFS server trusted by SharePoint.

SharePoint Trust Identifier

The SharePoint server relying party trust identifier.

To find your relying party trust identifier:

  1. Access the AD FS 2.0 Management Console (Windows Start menu > All Programs > Administrative Tools > AD FS 2.0 Management).

  2. In AD FS 2.0 Management Console, under Trust Relationships, select Relying Party Trusts.

  3. In the Relying Party Trusts list, find the row for SharePoint. The ADFS relying party trust identifier is the value in the Identifier column.

ADFS Trust Identifier

The relying party trust identifier of the ADFS server acting as an intermediate.

Identity Provider Server URL

The URL of the identity provider used in SharePoint to authenticate users.

You can edit the identity provider server URL in the ADFS settings (see Enable the ADFS Service Endpoint URL Path).

Okta Realm

The SharePoint trusted identity provider realm provided in your Okta application configuration (see Using Okta as a Trusted Identity Provider).


Okta Sign in URL

The URL to which users should be redirected in order to authenticate with Okta (see Using Okta as a Trusted Identity Provider).

Active Directory Username and Active Directory Password

Enter credentials to grant Coveo Cloud access to your Active Directory.

Expand Well-Known SIDs

Check this box if you want the users included in your Active Directory well-known security identifiers to be granted access to the indexed content. Expect an increase in the duration of the security identity provider refresh operation. Supported well-known SIDs are: Everyone, Authenticated Users, Domain Admins, Domain Users, and Anonymous Users.

If your entire content is secured with the Everyone or Authenticated users well-known, it’s more cost-effective resource-wise to index it with a source whose content is accessible to everyone than to expand the well-known with a source that indexes permissions.

Enable TLS

Check this box to use a TLS protocol to retrieve your security identities. If you do, we strongly recommend selecting StartTLS if you can. Since LDAPS is a much older protocol, you should only select this value if StartTLS is incompatible with your environment.

Email Attributes

By default, Coveo Cloud retrieves the email address associated to each security identity from the mail attribute. Optionally, you can specify additional or different attributes to check. Should an attribute contain more than one value, Coveo Cloud uses the first one.

“Content to Include” Section

In the Content to Include section, consider changing the default settings to make additional content searchable.

User Profiles

Check this box to index public SharePoint user profiles.

This box is unavailable if you’ve selected ADFS under claims or Okta as an identity provider.

Personal Sites

When the Scope is Web application, check this box to include SharePoint personal sites.

“Crawling Settings” Section

In the Crawling Settings section, the Reindex all child items on UpdateShallow option allows you to reindex the children of an item that has been updated. This ensures that, if the metadata of the child items contains parent item information, this information stays up to date. However, checking this box significantly impacts the source refresh time. Therefore, if you don’t check it, we recommend scheduling source rescans so that the child items are eventually updated as well.

You change your SharePoint site name. In the metadata of the child items, the site name appears under spsitename. If the box isn’t checked, the children aren’t reindexed and keep an outdated spsitename until the next source rescan or rebuild. However, if the box is checked, the children are updated along with the parent SharePoint site item.

“Access” Tab

In the Access tab, determine whether each group and API key can view or edit the source configuration (see Resource Access):

  1. In the Access Level column, select View or Edit for each available group.

  2. On the left-hand side of the tab, if available, click Groups or API Keys to switch lists.


  1. Finish adding or editing your source:

    • When you want to save your source configuration changes without starting a build/rebuild, such as when you know you want to do other changes soon, click Add Source/Save.

      To add the source content or to make your changes effective, on the Sources page, you must click Launch build or Start required rebuild in the source Status column.


    • When you’re done editing the source and want to make changes effective, click Add and Build Source/Save and Rebuild Source.

      Back on the Sources page, you can review the progress of your source addition or modification.

    Once the source is built or rebuilt, you can review its content in the Content Browser.

  2. Optionally, consider editing or adding mappings.

    You can only manage mapping rules once you build the source (see Refresh, Rescan, or Rebuild Sources).

Additional Adjustments

  1. If your source retrieves your content through the Crawling Module and if access to its content is secured with an Active Directory security identity provider, you must edit the JSON configuration of the security identity provider associated to this source to provide additional information. In the security identity provider JSON configuration, add the following code snippet, in which you replace <HOSTNAME> with either your Active Directory server IP address or domain name to use to connect to your Active Directory.

     "Hostname": {
       "value": "<HOSTNAME>"

    If you provide a domain name and still use the Crawling Module with Docker, ensure that your DNS server can resolve this name.

  2. Moreover, if you checked the Enable TLS box, edit the JSON configuration of your SharePoint source, SharePoint security identity provider, and Active Directory security identity provider to add the following:

     "AlwaysTrustCertificates": {
       "value": "true"

    See Edit a Source JSON Configuration and Edit a Security Identity Provider for detailed instructions.

What’s Next?

Recommended Articles