Brisbane Transport Museum

QOCS - Brisbane Transport Museum

Operational data for admissions, cash, stock, and daily Square reporting.

SharePoint report storage

Configure where generated PDFs are uploaded, how overnight report emails behave, and follow the Microsoft app registration steps needed for Graph app-only access.

Square setup Generated reports

Report storage and email

Overnight cash email

Link-based delivery is the default. Attachment fallback is available but should stay off unless there is a clear operational reason.

Open reports list

Graph environment

Values can come from the server environment or the manual fields on this page. Secret values are never shown here.

  • MS_TENANT_ID: missing
  • MS_CLIENT_ID: missing
  • MS_CLIENT_SECRET: missing
  • MS_SHAREPOINT_SITE_ID: missing
  • MS_DRIVE_ID: missing

The document library ID may be supplied as MS_DRIVE_ID or MS_DOCUMENT_LIBRARY_ID.

Microsoft Graph credentials

These fields are available for hosted setups where environment variables are hard to manage. If the same value is set in the server environment, the environment value wins.

Microsoft app registration setup

1. Register app

In Microsoft Entra ID, create an app registration for this reporting app. Copy the tenant ID and client ID.

2. Create secret

Create a client secret in Certificates and secrets. Store the secret in the server environment only.

3. Grant Graph access

Use Microsoft Graph application permission Sites.Selected where practical, then grant this app write access only to the required SharePoint site. Use Sites.ReadWrite.All only as a temporary setup fallback.

4. Find site and drive IDs

Use Graph to retrieve the SharePoint site ID and document library drive ID, then set them as environment variables.

Environment entries

Use your host's environment variable system. Do not paste these secrets into the app form.

MS_TENANT_ID=00000000-0000-0000-0000-000000000000
MS_CLIENT_ID=00000000-0000-0000-0000-000000000000
MS_CLIENT_SECRET=replace-with-client-secret
MS_SHAREPOINT_SITE_ID=tenant.sharepoint.com,site-guid,web-guid
MS_DRIVE_ID=drive-or-document-library-id

ID discovery

With a Graph token, these calls return the IDs this app needs.

curl -H "Authorization: Bearer $GRAPH_TOKEN" \
  "https://graph.microsoft.com/v1.0/sites/{tenant}.sharepoint.com:/sites/{site-name}"

curl -H "Authorization: Bearer $GRAPH_TOKEN" \
  "https://graph.microsoft.com/v1.0/sites/$MS_SHAREPOINT_SITE_ID/drives"

Sites.Selected site grant

After admin consent for Sites.Selected, grant this app write access to the target site. Microsoft Graph PowerShell can do this: 

Grant-MgSitePermission -SiteId "<site-id>" -Roles @("write") -GrantedToIdentities @(
  @{ Application = @{ Id = "<client-id>"; DisplayName = "QOCS Square Analytics" } }
)

Do not use Files.ReadWrite.AppFolder for this integration. Reports are stored in a normal Teams/SharePoint document library, not the app's special approot folder. More detail is available in docs/sharepoint-setup.md.