Setup Overview
- Create a SharePoint app registration — See Azure App Registration → SharePoint
- Configure credentials — In Admin → SharePoint Connection ([
#/admin/sharepointconn]), enter thesharePointClientIdandsharePointClientSecret(or enable managed identity) - Browse and select libraries — The admin UI lets you browse SharePoint sites, select document libraries, and create data sources
- Indexing pipeline — For each selected library, Findable automatically creates an Azure AI Search data source, index, skillset, and indexer
Data Source Naming
SharePoint data source names are derived from the library URL with sanitization:- Leading slashes removed
- Dashes preserved as
-- - URL-encoded spaces (
%20) become-x0020- - Path separators become
- - All lowercase
Authentication Modes
Multi-Library Support
Chats can index an entire SharePoint site (sharePointIndexEntireSite: true) or select specific libraries (sharePointLibraries[]). Each library gets its own indexer and data source.
Document-Level ACL
SharePoint (and OneDrive) indexes always includeUserIds and GroupIds fields in the schema. These fields are harmless when empty and ensure the skillset index projections always match, regardless of whether ACL is enabled.
ACL is controlled by three independent toggles:
When ACL is fully enabled:
- The data source ingests user/group permissions from SharePoint
- The index includes
permissionFilterOption: "enabled"andpermissionFilteron the ACL fields - The client acquires an Azure Search
user_impersonationtoken - Search queries pass the user’s identity for permission filtering
- Only documents the user has access to in SharePoint are returned
UserIdsandGroupIdsfields exist in the index but are empty- No
permissionFilterOptionorpermissionFiltermetadata on the index - No ACL filter is applied at query time — all documents are returned
- Even if
enableAclFilteringwere toggled on against a non-ACL index, the ACL filter includes a public content clause (not UserIds/any() and not GroupIds/any()) that matches all documents with empty ACL fields, so queries still return results
Upgrade note: If upgrading from a version that conditionally excludedUserIds/GroupIdsfrom the index schema, delete all SharePoint search assets (indexes, indexers, skillsets, and data sources) and visit the chat to trigger a rebuild.
SharePoint Entitlement Administration
ForSites.Selected permission mode, use Admin → SharePoint Entitlement ([#/admin/sharepointentitlement], setting key sharePointEntitlement) to grant the SharePoint app access to specific sites. This requires a separate admin client ID (sharePointAdminClientId) with Sites.FullControl.All permission.
See Azure App Registration → SharePoint for full permission details.
SharePoint Data Source Fields
Whentype === 'sharepoint' in IDataSourceConfig: