Skip to content

Microsoft SharePoint

Corporate Memory can automatically sync selected SharePoint document libraries into your organization's Copilot knowledge base. Once connected, documents added to the designated libraries flow through AI content review and (where flagged) a human approval queue before they become searchable in Copilot, with citations back to the source document.

What It Does

  • Automatic sync. Corporate Memory periodically reads the SharePoint sites and document libraries you designate and picks up new and updated files without manual uploads.
  • Read-only. The integration never writes to, modifies, or deletes anything in SharePoint.
  • Review before publish. Every synced document passes an AI content review. Clean documents are indexed automatically; anything flagged (for example, content that looks sensitive or out of scope) is held in an approval queue for a human reviewer in your organization to approve or reject.
  • Removals are mirrored. If a document is deleted from the designated library, it is removed from the knowledge base on the next sync.

All ingested content is stored in your organization's isolated tenant and is only accessible to your invited users. See SSO & Identity.

Prerequisites

  • A Microsoft 365 tenant with SharePoint Online.
  • A Microsoft 365 administrator who can grant admin consent to an Entra ID (Azure AD) app registration.
  • Microsoft Graph read access for that app registration, scoped to the designated sites (see below).
  • An agreed list of SharePoint sites and document libraries to sync.

Your WorkDone implementation contact will walk your administrator through the app registration and consent process.

Scoping Guidance

Grant access only to designated sites

Do not grant the app registration tenant-wide SharePoint read access. Microsoft Graph supports site-scoped permissions (the Sites.Selected model), which lets your administrator authorize the app for specific sites only. WorkDone recommends (and will help you configure) this model, so the integration can physically read only the sites you have chosen.

Practical recommendations:

  • Start with one site or library containing well-understood, shareable content, and expand scope after you have seen the review flow work.
  • Prefer purpose-built libraries (for example, a "Knowledge Base" library your team curates) over broad, mixed-use sites.
  • Remember that the AI content review and approval queue are a second line of defense, not a substitute for scoping: the cleanest control is not syncing a library at all.

How Documents Flow Into Copilot

  1. Sync. The integration reads new and changed files from the designated libraries.
  2. AI content review. Each document is screened automatically before indexing.
  3. Approval queue. Flagged documents wait in a queue in the portal, where a reviewer with the appropriate role in your organization approves or rejects them. Rejected documents are never indexed.
  4. Indexing. Approved documents are added to your organization's private knowledge store, hosted on Microsoft Azure.
  5. Copilot. Users can now ask questions and receive answers with citations linking back to the source documents.

See the Copilot guide for how search and citations work day to day.

Changing or Revoking Access

You are always in control of scope:

  • Narrow or expand scope. Ask your administrator to adjust which sites the app registration is authorized for, and tell your WorkDone implementation contact so the sync configuration matches. Documents from removed sites are dropped from the knowledge base.
  • Remove individual documents. Delete or move the file out of the synced library; the next sync removes it from the knowledge base. Your admins can also reject or remove documents from the portal.
  • Full revocation. Your Microsoft 365 administrator can revoke the app registration's consent (or delete the enterprise application) in Entra ID at any time. This immediately cuts off all WorkDone access to your tenant; no action from WorkDone is required. Contact support afterward to have already-ingested content purged from your tenant's knowledge base.

Note

Credential and certificate rotation for the app registration can be coordinated with your WorkDone implementation contact whenever your security policy requires it.