Skip to main content

SharePoint connector

Updated

Get answers from your latest SharePoint documents in the assistant, using only the files you can already open.

Overview

With the SharePoint connector, the assistant searches and reads your organization's SharePoint when you ask, using your own Microsoft permissions. Every answer draws on the current version of each document.

Your IT team sets up read-only access once. You then choose the sites and folders the assistant can use, and each fact links back to its source in SharePoint.

Availability: The SharePoint connector is available to selected customers. To find out if it's right for your organization, contact your Customer Success Manager.

Looking for the library sync? The SharePoint sync is a separate integration that copies a library into AutogenAI. It's still available. See How is this different from the SharePoint sync? for how the two differ.

Key benefits

  • Always current. Answers come from the latest version in SharePoint, with no library to sync or refresh.
  • Your permissions apply. The assistant only reads files you can already open.
  • You stay in control. Choose which sites, libraries and folders the assistant can use.
  • Read-only, approved by IT. Your IT team sets up read-only access once, in your own Microsoft tenant, and can revoke it at any time.
  • Every fact sourced. Each answer links to the SharePoint document it came from.

Before you start

The SharePoint connector works with commercial Microsoft 365 only.

Your IT team needs

  • A Microsoft Entra admin role that can create app registrations and grant admin consent, such as Application Administrator, Cloud Application Administrator or Global Administrator
  • The setup guide and callback URL from your customer success contact
  • A way to create a one-time link to your client secret, so you can share it without sending the value itself

Your users need

  • A Microsoft work account in your organization's tenant
  • Access to the SharePoint sites they want to use

Not supported: FedStart, GCC High and OneDrive.

Set up the connector (IT admin)

You register your own app in your Microsoft Entra tenant, so you own the registration, its secret and who can sign in. Your customer success contact will guide you through each step.

  1. Register a single-tenant web app in Microsoft Entra.
  2. Add the redirect URI for your AutogenAI environment. It must match the callback URL you were given, character for character.
  3. Add three delegated Microsoft Graph permissions: Sites.Read.All, Files.Read.All and offline_access.
  4. Grant admin consent for your organization.
  5. Create a client secret and note its expiration date.
  6. Reply on your support ticket with the client ID, tenant ID, secret expiration date and a one-time link to the secret value, all in one message. Never send the secret value itself, and never by email or Slack.
  7. AutogenAI configures your environment, then turns the connector on for your pilot users.

Keep the connection running: Client secrets expire, up to 24 months after creation. Before yours expires, send a new secret for the same app registration, the same way as before. If it lapses, every user's connection stops. Your customer success contact will remind you two months ahead.

Optional controls in Entra

  • Set Assignment required and assign only the users or groups who should connect
  • Apply Conditional Access and MFA
  • Review sign-in logs
  • Revoke consent or sessions at any time

Connect your account and choose locations

Once your IT team has set things up, each user connects their own account. One person's connection can't be used by anyone else.

  1. Go to Settings > Integrations > SharePoint and select Connect.
  2. Sign in with your Microsoft work account.
  3. Pick the sites, document libraries, folders or files the assistant may use.
  4. Save your selection.

Your selection is saved to your account and applies to every session. If you pick nothing, the assistant reads nothing.

Tip: If you can open a lot of sites, expand the site and library first, then type part of a folder or file name in the picker's search box to filter what's loaded. The picker loads sites in parallel, so it opens faster in large tenants.

To disconnect: Disconnect from Settings > Integrations > SharePoint. This deletes your sign-in tokens.

Use SharePoint in the assistant

  1. Start a new assistant session.
  2. Select SharePoint as a source alongside the others.
  3. Ask your question, for example about a specific folder.
  4. When the assistant asks to use SharePoint, choose Deny, Allow Once or Allow Per Session.
  5. Open the linked source to check the document in SharePoint.

The assistant has six read-only operations, all limited to the locations you approved:

  • Search for documents
  • Read a document's text
  • Download a file of up to 4 MB
  • List sites
  • List a site's document libraries
  • List a folder

Tips for better answers

  • Choose Allow Per Session at the first prompt to avoid repeated approvals
  • Search matches keywords, so use the same wording your documents use
  • If search finds nothing, ask the assistant to browse a named folder
  • For long requests, work one folder at a time

Admin controls: Organization admins can set each SharePoint operation to Needs approval or Deny, or turn the integration off for everyone, in Settings > Integrations.

Copy SharePoint files into a project

Projects don't read SharePoint live. Instead, you copy files into the project library, and activities and the storyboard first draft use them like any upload.

  1. Open the project setup wizard and select the SharePoint tab in the Add sources window. Or, in an existing project, open the project library menu and select Add from SharePoint.
  2. Sign in with your Microsoft account if you haven't connected yet.
  3. Pick the files or folders to copy. Picking a folder copies every file in it, including subfolders.
  4. Start the import and keep the window open until it finishes.

Imported files are parsed like any upload, your organization's anonymization settings apply, and they show a SharePoint icon in the library.

Import limits and behavior

  • Up to 100 files per import, counting every file in picked folders and subfolders. Over 100, nothing is copied.
  • Files over 100 MB can't be imported.
  • Only file types the Upload tab accepts are copied. Others are skipped.
  • SharePoint's folder structure is kept, starting at the folder or library you picked. Files with the same name in different subfolders both come through.
  • Copies don't update when the file changes in SharePoint. Import it again to replace the copy.
  • Everyone on the project can open the copies, including people who can't open the originals in SharePoint.
  • The import runs in your browser, four files at a time, and can't be canceled.
  • An activity's own Add sources window doesn't offer SharePoint. Use the project library or setup wizard.
  • For folders already synced to a library, add them from Libraries instead so they stay up to date.

Permissions, security and data handling

The connector is read-only and can only reach what the signed-in user can already open.

  • Delegated permissions only. Sites.Read.All, Files.Read.All and offline_access. There are no application permissions, so nothing runs without a signed-in user.
  • No write access. The assistant can't change, share or delete anything in SharePoint.
  • Your tenant, your rules. Conditional Access and MFA apply, and your IT team can revoke access in Entra at any time.
  • No library copy for the Assistant. Nothing is crawled, indexed or copied in advance. Documents are read when a request needs them.
  • Files you copy into projects are stored. They're processed like any upload.
  • Document text goes to the AI model. Text read for a request goes to the AI model already configured for your environment, as uploaded documents do. The model never connects to Microsoft or SharePoint.
  • What AutogenAI stores. Each user's Microsoft tokens (encrypted, and deleted when the user disconnects), each user's approved locations, and your client secret (encrypted).
  • Logging. One line per operation, covering the operation, search terms, IDs and folder paths, outcome and result counts. No document content, tokens or email addresses.
  • In transit. Connections over the internet use HTTPS.

Revoking access

  • In Microsoft Entra: disable the enterprise application, remove a user's assignment, revoke sessions or remove consent
  • In AutogenAI: users can disconnect, and organization admins can disable the integration for everyone

Supported files and limitations

The assistant can read text from: plain text, JSON, PDF, Word, PowerPoint and Excel files.

Known limitations

  • Keyword matching. Search finds documents that contain the words in your question. An acronym and its spelled-out term can miss each other, so use your documents' wording.
  • Markdown and CSV files can't be read. To use them, upload them to a library or copy them into a project library.
  • Scans and large files. Image-only scans have no text to read and very large Excel workbooks may be refused. For the download limit, see Use SharePoint in the assistant.
  • Metadata isn't read. Tags, columns, content type and author aren't available. The assistant reads file names, links, sizes, modified dates and document text.
  • SharePoint only. For unsupported platforms, see Before you start.
  • Picker search only covers what you've expanded. Search doesn't find items outside folders you've already expanded, and the picker may show a "Reconnect SharePoint" error even though your connection is working.
  • Renamed or moved folders drop out of your selection until you approve them again. Approved files keep working after a rename or move.
  • Very long requests can stop partway. Each operation can run up to 10 times per answer. To split long requests, see Tips for better answers.
  • Approvals repeat each session. To avoid repeated prompts, see Tips for better answers. A prompt left unanswered for 60 seconds is denied.
  • Testing needs your own tenant. You can only connect an account in your organization's Microsoft tenant.

Troubleshooting and FAQ

Why does it say "Connection Expired"?

Your Microsoft access was revoked or your sign-in lapsed. Reconnect in Settings > Integrations. If every user sees this at once, ask your IT team to check whether the client secret has expired.

Why did my search return nothing?

Usually no locations are approved yet, or the documents don't contain the words you used. Check your SharePoint selection in the source picker. For other fixes, see Tips for better answers.

Why does the assistant keep asking for approval?

Each SharePoint operation needs your approval in every new session. To avoid repeated prompts, see Tips for better answers.

How is this different from the SharePoint sync?

The SharePoint sync copies a library into AutogenAI, where it's processed and indexed. The SharePoint Connector reads documents from SharePoint when a request needs them, as you, and keeps no copy for the Assistant.

Does it respect SharePoint permissions?

Yes. Every call runs as the signed-in user, so the Assistant can never read more than you can open.

Can it change anything in SharePoint?

No. All operations and permissions are read-only.

Why does the setup need the ".All" permissions?

Microsoft's search needs them to search files. The Assistant still only reaches what you can open, and you narrow that further by choosing locations.

Does it work with libraries in other geographies?

Yes. The location picker lists sites in every geography you can open.

 

Still stuck? Contact your Customer Success Manager or AutogenAI support.

Related to

Related articles