---
title: "Templates (Microsoft Graph)"
description: "How to enable the Templates feature on an on-premises Signer: DOCX to PDF conversion through Microsoft Graph and SharePoint, the prerequisites and the four settings of the Graph section."
canonical: "https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/modelos"
locale: "en"
product: "Signer"
last_updated: "2026-10-22"
---

# Templates (Microsoft Graph)

The **Templates** feature creates documents from Word (DOCX) templates with fields the user fills in when creating
the document. To produce the PDF, Signer converts the DOCX with Microsoft Graph and a SharePoint site.

The feature is off by default. Signer only shows the **Templates** option when the four settings of the `Graph`
section are filled in.

## Prerequisites

* A Microsoft 365 tenant with SharePoint Online.
* Permission to create a SharePoint site and an app registration in Microsoft Entra ID.
* Outbound access from the Signer server to `login.microsoftonline.com` and `graph.microsoft.com`.

## 1. Create a SharePoint site

1. Create a SharePoint site used only by Signer, for example `signer-templates`.
1. Write down the tenant name (the part before `.sharepoint.com`) and the site name.

## 2. Register an app in Microsoft Entra ID

1. In the Azure portal, open **Microsoft Entra ID** and then **App registrations**.
1. Click **New registration**, name the app (for example, *Signer Templates*) and click **Register**.
1. Write down the **Application (client) ID**.
1. In **Certificates & secrets**, create a client secret and write down its **Value**.
1. In **API permissions**, add a Microsoft Graph *Application permission* that allows reading and writing files on
   the site created in step 1.
1. Click **Grant admin consent**.

> **Warning**
>
> The client secret has an expiry date. When it expires, the conversion stops working. Write down the date and create
> a new secret before it expires.

## 3. Get the site DriveId

The `DriveId` identifies the site's document library.

1. Request an access token from Entra ID. Replace `<tenant>`, `<client-id>` and `<client-secret>` with your values:

   ```sh
   curl -X POST https://login.microsoftonline.com/<tenant>.onmicrosoft.com/oauth2/v2.0/token \
     -d client_id=<client-id> \
     -d client_secret=<client-secret> \
     -d scope=https://graph.microsoft.com/.default \
     -d grant_type=client_credentials
   ```

1. Copy the `access_token` value from the response.
1. Query the site drive. Replace `<tenant>`, `<site>` and `<token>`:

   ```sh
   curl -H "Authorization: Bearer <token>" \
     "https://graph.microsoft.com/v1.0/sites/<tenant>.sharepoint.com:/sites/<site>:/drive"
   ```

1. Write down the `id` field of the response. That is the `DriveId`.

If the second call answers `403`, the app has no permission on the site. Review step 2.

## 4. Configure Signer

In the `Graph` section, enter the four values and restart the application:

```json
"Graph": {
  "DomainName": "yourcompany.onmicrosoft.com",
  "ClientId": "<application-client-id>",
  "ClientSecret": "<client-secret>",
  "DriveId": "<drive-id>"
}
```

`DomainName` is the tenant domain in Entra ID (for example, `yourcompany.onmicrosoft.com` or a verified domain of
the tenant). In environment variables, use `Graph__DomainName`, `Graph__ClientId`, `Graph__ClientSecret` and
`Graph__DriveId`. See the [*Graph* settings](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/settings#graph).

## 5. Test

1. Sign in to Signer and start creating a document.
1. Check that the **Templates** button shows next to the add files button.
1. Create a template with a test DOCX file and generate a document from it.

If the option does not show, check that the four settings are filled in. If the conversion fails, look for the
Microsoft Graph error in the application log. The most common causes are an expired client secret and a missing
app permission on the site.

## See also

* [Signer settings](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/settings)