This article is for Workspace owners, since they configure this in the workspace settings. Workspace members don't need to set anything up. |
Introduction
By default, users connect connectors through Pipedream's OAuth app, our connector provider. With "Bring your own app", you register an OAuth app in your own identity provider (for example a Microsoft Entra app registration) and Sana uses it for every user in the workspace. This solves the following key problems:
Security and compliance. Users sign in to an app your organization owns and has approved, not a third-party app.
Control over permissions. You choose which scopes the app requests so you can control what you give Sana access to.
Set up instructions
In your identity provider, create an OAuth app (e.g. a OneDrive app in Microsoft Entra), grant the scopes and generate a client id and secret.
In Sana, go to Workspace settings > Connectors and click “New connector”.
If the chosen connector supports bring your own app, a step with the title “OAuth” will be available at the end of the set up
Select "Bring your own app" and enter the client ID, client secret and scopes.
Click “Save client” to generate a Redirect URL.
Copy the Redirect URL and add it to your OAuth app as a redirect URI instead of the application you are creating the app for, e.g. Entra for OneDrive.
Click Enable. The connector is now enabled in your workspace and configured to use your custom OAuth app. New connections configured by users in the user settings now go through your OAuth app.
Supported connectors
We currently support bringing your own OAuth app for the following connectors:
OneDrive
SharePoint
Microsoft Teams
Outlook Email
Outlook Calendar
ServiceNow
Known limitations
Changing the Client ID points users to a different app, so users who already connected this connector will need to reconnect and the Redirect URL must be added to the new app.
Switching back your connector's OAuth setting from “Bring your own” to "Pipedream" deletes your OAuth app configuration from Sana. Users who connected through it will need to reconnect.
The client secret is never shown again after saving. To rotate it, enter a new one. Leave the field blank to keep the current one.
Microsoft connectors require a multi-tenant OAuth app, single-tenant apps are not supported. In Microsoft Entra, set your app's Supported account types to "Multitenant". You can still limit it to your own tenant ID to ensure that a multi-tenant app is only available to your organization.
For Microsoft apps, the scopes you enter in Sana only control what the consent screen requests — they don't limit the resulting token, since Microsoft Entra includes every permission the app registration has already been consented for. Make sure the scopes you enter in Sana match those configured in Entra.
FAQ
Q: Do workspace members need to do anything?
A: No. They connect the way they always do. The sign-in screen just shows your organization's app.
Q: Who owns creating a custom OAuth app?
A: The customer owns creating and maintaining the custom OAuth app they choose to bring into Sana. If they do not wish to create and maintain an OAuth app we recommend using the existing OAuth apps and not using this feature.
Q: What happens if I remove a scope?
A: Tools that need that scope may stop working. Keep the pre-filled list unless you have a reason to restrict it.
Q: How do I go back to the default setup?
A: There are two ways of doing this, either you delete the connection in the workspace settings and create a new one. Or, you go into the existing connector and modify it. But note that changing this will force all the existing users with connections to have to reconnect.
Q: Why does a user's connection still work on the old OAuth app if I updated it after they connected?
A: When a user connects, the provider gives their connection an access token issued by the OAuth app configured at that moment and they usually have an expiry date as well. Sana keeps using that token until it expires, regardless of what you've changed since. How long that takes depends on the provider, often around an hour.