How to Connect Multiple SharePoint Sites to Codex
Codex ships no SharePoint connector at all, so reaching your own company’s sites and two client tenants from one session is a question of which MCP server you register, and Carly is the one that holds them all. Authorize each Microsoft identity in Carly, register one server, and the Codex CLI can search, read or write in whichever tenant and site you name. Carly holds your Gmail and Outlook mailboxes, both sets of calendars and your drives in the same place.
What one chat can do afterwards
- Search your own tenant’s sites and a client’s in the same question.
- Show the source tenant and site on every document it returns.
- Upload, move, share or delete inside the library you name.
- Create and update list items in the site you name.
- Add a third tenant with a Connect click, not another consent negotiation.
- Act when a signed contract lands in a library, with no terminal open.
Nothing is merged. Each Microsoft identity keeps its own authorization, and every tenant stays individually addressable.
Three Microsoft things get confused here
- Work IQ SharePoint, Microsoft’s first-party server inside Agent 365. Real, in preview, unreachable from Codex: it wants a Microsoft 365 Copilot license and the admin center, Copilot Studio or Foundry as its client. The SharePoint MCP guide covers it.
- The ChatGPT SharePoint connector, which lives in ChatGPT’s settings and never reads your local Codex config. It indexes several sites but authorizes one Microsoft identity and reads without writing, as multiple SharePoint sites in ChatGPT sets out.
- An MCP server you register yourself, the path that works in the Codex CLI.
Codex carries no Microsoft page at all, and we probed it properly
OpenAI’s Codex documentation index has zero entries for SharePoint, OneDrive, Microsoft, Outlook or Teams. That absence is a finding rather than a failed search: the same index returns GitHub, Linear and Slack, so the probe locates third-party pages when they exist. The plugins documentation matches, naming Codex Security, Gmail, Google Drive and Slack as plugins and GitHub, Slack and Google Drive as connectors. No Microsoft storage anywhere.
Since July 9, 2026 apps ship inside "plugins," listed in one directory spanning ChatGPT and Codex. Existing connections kept working and nothing needed resubmitting; what changed is the packaging and the storefront, not the protocol.
Plugins reach Codex in the ChatGPT desktop app and a /plugins browser in the CLI. The IDE extension does not support them at all. MCP servers are the wider cut, read by every surface.
1. Sort your sites and tenants
| What you have | Native path in Codex |
|---|---|
| Several sites in one tenant | Only through a server you register |
| Sites across two or more tenants | No connector at all |
| Writing files into a document library | No |
| Creating lists and columns | No |
| A personal Microsoft account | Not applicable, personal accounts have no SharePoint |
| Microsoft’s official Work IQ server | Copilot license, and Codex is not a supported client |
| Something to happen when a document lands | No, nothing watches |
2. Connect each tenant to Carly
- Sign in at carlyassistant.com.
- Open carlyassistant.com/integrations.
- Find SharePoint and click Connect.
- Sign in to the first Microsoft identity and approve access.
- Confirm which tenant the connection landed in.
Repeat for every additional tenant, using a private window if Microsoft preselects the previous identity. Each tenant approves independently, so one client’s administrators declining does not block the others.
3. Register Carly as an MCP server
The CLI route is the shortest:
codex mcp add carly --url https://carlyassistant.com/mcp/Servers added this way land in ~/.codex/config.toml at user scope. The hand-written equivalent:
[mcp_servers.carly]
url = "https://carlyassistant.com/mcp/"
default_tools_approval_mode = "writes"A url key is what makes this a streamable HTTP server; a command key would make it stdio. Codex has no transport field to set, and adding one is a configuration error rather than a hint. Set the approval mode from the start: reads run, and anything that changes a site or a library stops for confirmation.
Then authenticate:
codex mcp login carlySign in to the Carly workspace holding the tenants. Codex supports OAuth and bearer tokens against remote HTTP MCP servers, so no secret sits in a config file. Verify with:
codex mcp list4. Test each site read-only
Start a new session so the tools load. Codex loads a newly registered server’s tools at session start, not mid-session.
In
fictional.iris.hoffman@datadog.com, resolve the site atcontoso.sharepoint.com/sites/marketing, list its document libraries, and change nothing.
In
fictional.iris.hoffman@cloudflare.com, find the newest document in the Compliance library mentioning “SOC 2” and name the tenant it came from. Read only.
Then the question a single identity cannot answer:
Search both tenants for documents mentioning “renewal” updated in the last 30 days, and show the source tenant and site on every row.
5. Name the tenant and site on every write
Treat
fictional.iris.hoffman@datadog.comas Internal andfictional.iris.hoffman@cloudflare.comas Client. State the target account and site before any upload, list edit, delete or share, and never write to an account or site I have not named.
Then per action:
Upload the build report to the Q3 library on the Internal marketing site only.
Add a row to the Renewals list on the Client compliance site, and show me the values before you write them.
The community server route, and what it costs
For completeness, there is a generic Graph-backed community server, @softeria/ms-365-mcp-server, which does reach SharePoint and does support several signed-in tenants. Its README never mentions Codex, so compatibility is an inference rather than a vendor promise. Three traps make it expensive to run, and they are the reason most people who try it conclude SharePoint is locked down when it never was.
Organization mode is not optional and does not stop you. There is no sharepoint preset; SharePoint lives inside work, which requires organization mode enabled from the start. Leave the flag off and the server prints a warning and starts anyway. Sign-in then skips the work-scoped permission fields, so the tools appear in Codex, look healthy, and fail against Graph later with an error that points nowhere useful.
The obvious preset asks your admin for 22 permissions it does not need. Turning on --preset work by itself loads 156 Graph tools and requests 22 delegated permissions that genuinely do require administrator consent, not one of them a SharePoint permission. They arrive from the Teams, directory and meetings tools bundled into the same preset, among them User.Read.All, Directory.Read.All, Group.Read.All and ChannelMessage.Read.All. The refusal that comes back has nothing to do with the sites you wanted.
The permissions you actually need are not admin territory, and it is easy to under-ask. Microsoft’s Graph permissions reference lists delegated Sites.Read.All, Sites.ReadWrite.All, Sites.Manage.All and Sites.Selected as not requiring admin consent, against User.Read.All and Directory.Read.All in the same table which do. Delegated is the operative word: Sites.Read.All reads site collections “on behalf of the signed-in user”, never exceeding what that person can already open. But Sites.ReadWrite.All does not imply Sites.Manage.All, so list and column creation tools vanish with no error unless you name it, and a tool filter of sharepoint|site|drive silently drops upload-file-content, leaving you able to read, move and delete but not upload.
On top of that, every tenant needs its own device-code sign-in at the terminal, every tenant’s user-consent policy decides whether you self-consent or bounce to an administrator, and a cross-tenant question becomes a fan-out of per-tenant calls.
Nothing fires when a document lands
MCP servers wait to be asked. The protocol has no scheduler and no event mechanism — its maintainers acknowledge that change detection today means polling — so an MCP connection can answer a question but cannot notice something on its own.
The Triggers and Events working group charter is dated March 2026 and its events item still sits at the ideating stage with no champion, so this is not a next-release matter.
Graph webhook tools do not rescue it. create-subscription needs an HTTPS notification URL that validates with a token echo, meaning a public endpoint you host, and nothing it sends arrives in a Codex session. The delta tools are polls you start. Worth stating plainly because the opposite is widely repeated: the Codex sandbox does not gate MCP either. Approvals do, and turning on network access will not revive a server that failed to load.
Codex versus Carly on SharePoint
| Need | Codex alone | Carly MCP server |
|---|---|---|
| Read every site in one tenant | Only via a server you register | Yes |
| Reach sites across two or more tenants | Not natively | Yes, one connection each |
| Upload, move, delete, share in a library | Depends on the server | Yes |
| Create and edit list items | Depends on the scopes you asked for | Yes |
| Answer one question across two tenants at once | A sequence of per-tenant calls | One request |
| Setup cost per extra tenant | A terminal sign-in and a consent negotiation | A Connect click |
| Act when a document lands in a library | No, nothing watches | Yes |
| Run when nothing is open | No, you are at the keyboard | Yes |
The work that repeats around SharePoint is the work nobody is present for: a signed contract lands in a library and needs its renewal date on a calendar, a row in a tracking list, and a summary to the account owner. Carly authorizes each Microsoft identity as its own connection, so one question spans your tenant and two client tenants without a per-account fan-out, and its workflows begin at the event rather than at a prompt. Carly reaches roughly 260 apps natively and anything else with a public API through your own key, so a document is rarely the last step in the chain.
Free Zapier-style workflows; AI agents from $35/month. Connect the tenants at carlyassistant.com/integrations, then point Codex at carlyassistant.com/mcp.
Quick fixes
| Problem | Fix |
|---|---|
| No tools appear after registering the server | Start a new Codex session; tools load at session start |
codex mcp login carly never completes | Finish the browser OAuth flow, then rerun codex mcp list |
| Codex rejected the config | Remove any type key. Codex selects stdio from command and streamable HTTP from url |
| Your admin was asked for Teams and directory permissions | That is --preset work on the community server, which requests 22 admin-level scopes |
| A tenant blocks the sign-in | That tenant restricts user consent; ask its Microsoft 365 administrator to approve |
| Codex writes into the wrong tenant | Use the full address and site in the prompt and require both in every answer |
Frequently asked questions
Does Codex have a native SharePoint integration?
No. OpenAI’s Codex documentation index carries no SharePoint, OneDrive or Microsoft entry, while it does carry GitHub, Linear and Slack pages, and the plugins documentation names only Gmail, Google Drive, Slack and Codex Security. Codex reaches SharePoint through an MCP server you register yourself.
How many SharePoint sites and tenants can Codex reach?
Every site the authorized account can open, in every tenant you connect. Within a tenant there is no site-selection step, because the delegated permission covers all site collections on behalf of that user, and the tenant count is a Carly setting rather than a Codex one.
Does my administrator have to approve this?
Only if the tenant’s policy says so. Microsoft’s Graph permissions reference lists delegated Sites.Read.All, Sites.ReadWrite.All, Sites.Manage.All and Sites.Selected as not requiring admin consent, so a refusal comes from that tenant’s user-consent policy rather than from the permission. Each tenant decides separately.
Can Codex notice when a document lands in a library?
No. Graph subscriptions push to a public HTTPS endpoint you would have to host, and the delta tools are polls you initiate. Nothing arrives in a Codex session on its own, which is why the watching half runs in a Carly workflow.
Why not use Microsoft’s official SharePoint MCP server?
Because Codex is not a supported client. Work IQ SharePoint requires a Microsoft 365 Copilot license and lists the admin center, Copilot Studio and Foundry as its clients, capping file operations at 5 MB in preview.
Related: Codex MCP servers · Multiple OneDrive accounts in Codex · Multiple Outlook accounts in Codex · Multiple SharePoint sites in Claude · SharePoint MCP · MCP servers · Best AI assistants for multiple Microsoft accounts · SharePoint integration
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
