> ## Documentation Index
> Fetch the complete documentation index at: https://prismeai-legacy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# SharePoint Connector

> Synchronize Microsoft SharePoint document libraries with AI Knowledge and enforce per-user access control at query time

The SharePoint connector lets you index documents from a Microsoft SharePoint Online library into your AI Knowledge project. Once synced, documents are available for RAG queries — and per-user permissions from SharePoint are enforced at query time through Permission-Based Access Validation (PBAV).

## Overview

<CardGroup cols={3}>
  <Card title="Document Sync" icon="arrows-rotate">
    Import files from a SharePoint document library into your knowledge base with incremental updates.
  </Card>

  <Card title="Access Control" icon="shield-halved">
    Each user's SharePoint permissions are checked at query time — users only see RAG results from files they can access.
  </Card>

  <Card title="Supported Formats" icon="file">
    PDF, Word, PowerPoint, Excel, CSV, plain text, and Markdown files are indexed automatically.
  </Card>
</CardGroup>

## Authentication Modes

The connector supports two authentication modes, configured by your platform administrator:

<Tabs>
  <Tab title="Delegated (default)">
    Each user connects their own Microsoft account via OAuth. The connector respects per-user SharePoint permissions at query time through [PBAV](#permission-based-access-validation-pbav).

    * Users must individually click **Connect with Microsoft** before syncing or querying
    * RAG results are filtered per-user: you only see content from files you can access in SharePoint
    * Best for organizations that need to enforce document-level access control
  </Tab>

  <Tab title="Service Account">
    The connector uses workspace-level credentials configured by the platform administrator. No per-user OAuth is required.

    * The "Connect with Microsoft" section is hidden from the connector card
    * PBAV is disabled — all synced documents are visible to all project users
    * Best for teams where all users should access the entire library
    * An info banner on the connector card indicates that service account mode is active
  </Tab>
</Tabs>

The sections below describe the **delegated** flow. If your connector is in service account mode, skip to [Configuring the Connector](#configuring-the-connector) — no Microsoft sign-in is needed.

## Connecting Your Microsoft Account

Before configuring the connector in delegated mode, connect your Microsoft account to authorize access to SharePoint.

<Steps>
  <Step title="Open the Connectors Tab">
    In your AI Knowledge project, go to **Advanced > Connectors**. The SharePoint connector card displays your current connection status.
  </Step>

  <Step title="Connect with Microsoft">
    In the **Microsoft Connection** section of the SharePoint card, click **Connect with Microsoft**. A popup opens to the Microsoft sign-in page.

    Sign in with your organizational Microsoft account and consent to the requested permissions (read-only access to your SharePoint files and sites).
  </Step>

  <Step title="Confirm Connection">
    After successful sign-in, the popup closes automatically and the connector card updates to show **Connected** with an expiration date. The OAuth session uses refresh tokens and remains valid for up to 90 days.
  </Step>
</Steps>

<Note>
  Each user connects their own Microsoft account independently. The connector uses delegated OAuth, meaning all SharePoint operations respect the signed-in user's permissions.
</Note>

## Configuring the Connector

<Steps>
  <Step title="Open Configuration">
    Click the **Configure** button on the SharePoint connector card. A configuration dialog opens.
  </Step>

  <Step title="Select a SharePoint Site">
    The dialog loads the list of SharePoint sites accessible to your account. Select the site containing the documents to sync.

    If no sites appear, your Microsoft account may not have access to any SharePoint sites — contact your SharePoint administrator.
  </Step>

  <Step title="Select a Document Library">
    After selecting a site, the dialog loads available document libraries (drives). Choose the library to sync.

    A confirmation banner shows the selected site and library.
  </Step>

  <Step title="Save">
    Click **Save** to enable the connector with the chosen configuration. The connector card updates to show the selected site, library, and status as **Enabled**.
  </Step>
</Steps>

## Syncing Documents

Click **Sync Now** on the connector card to start a synchronization. The card shows real-time progress as files are discovered, filtered, and indexed.

### What Happens During Sync

1. **File discovery** — The connector recursively lists all files in the configured library, traversing subfolders
2. **File filtering** — Only supported file types are indexed (see table below); other files are skipped
3. **Incremental sync** — Files are compared by their `cTag` (content tag). Files whose content has not changed since the last sync are skipped
4. **Indexing** — New or modified files are downloaded and indexed into the knowledge base
5. **Deletion detection** — Files that no longer exist in SharePoint are removed from the knowledge base

### Supported File Types

<table>
  <thead>
    <tr>
      <th>Format</th>
      <th>MIME Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>PDF</td>
      <td><code>application/pdf</code></td>
    </tr>

    <tr>
      <td>Word (.docx)</td>
      <td><code>application/vnd.openxmlformats-officedocument.wordprocessingml.document</code></td>
    </tr>

    <tr>
      <td>Word (.doc)</td>
      <td><code>application/msword</code></td>
    </tr>

    <tr>
      <td>PowerPoint (.pptx)</td>
      <td><code>application/vnd.openxmlformats-officedocument.presentationml.presentation</code></td>
    </tr>

    <tr>
      <td>Excel (.xlsx)</td>
      <td><code>application/vnd.openxmlformats-officedocument.spreadsheetml.sheet</code></td>
    </tr>

    <tr>
      <td>CSV</td>
      <td><code>text/csv</code></td>
    </tr>

    <tr>
      <td>Plain text</td>
      <td><code>text/plain</code></td>
    </tr>

    <tr>
      <td>Markdown</td>
      <td><code>text/markdown</code></td>
    </tr>
  </tbody>
</table>

### Sync Results

After sync completes, the connector card shows a summary:

* **Indexed** — files that were new or updated and successfully processed
* **Unchanged** — files skipped because their content hasn't changed
* **Deleted** — files removed from the knowledge base because they no longer exist in SharePoint
* **Errors** — files that failed to index (e.g. missing download URL)
* **Skipped** — files with unsupported file types

## Permission-Based Access Validation (PBAV)

<Note>
  PBAV only applies in **delegated** authentication mode. In service account mode, PBAV is disabled and all synced documents are visible to all users.
</Note>

PBAV ensures that RAG query results respect each user's SharePoint permissions. It operates transparently at query time — no additional configuration is needed beyond connecting Microsoft accounts.

### How It Works

1. A user submits a query to the AI Knowledge agent
2. The RAG pipeline retrieves relevant document chunks, some of which may come from SharePoint
3. For each SharePoint chunk, the system calls the MCP server's `validateUserAccessDelegated` tool, which probes the file using the querying user's delegated OAuth token
4. Chunks from files the user cannot access are removed before the LLM generates a response

### User Experience

The behavior varies depending on the user's authentication state:

<table>
  <thead>
    <tr>
      <th>State</th>
      <th>Behavior</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><strong>Not connected</strong></td>
      <td>All SharePoint chunks are removed. The agent response includes a prompt to connect with Microsoft.</td>
    </tr>

    <tr>
      <td><strong>Connected — partial access</strong></td>
      <td>Only accessible chunks are included. A warning is appended: "Some documents are not accessible to you; you do not have permission to read them."</td>
    </tr>

    <tr>
      <td><strong>Connected — full access</strong></td>
      <td>All relevant chunks are included. No warnings.</td>
    </tr>
  </tbody>
</table>

<Note>
  PBAV uses a **fail-closed** approach. If the MCP server is unreachable or returns an error, all SharePoint chunks are removed from the response rather than being shown without access checks.
</Note>

### Non-SharePoint Documents

PBAV only applies to documents that originated from the SharePoint connector (identified by their `sharepoint` tag). Documents from other sources (file uploads, web crawls, etc.) are not affected and pass through unchanged.

## Disconnecting / Disabling

### Disconnecting Your Microsoft Account

To disconnect your personal OAuth session:

1. Go to **Advanced > Connectors**
2. In the **Microsoft Connection** section, click **Disconnect**

This revokes your delegated tokens. PBAV will treat you as unauthenticated until you reconnect.

### Disabling the Connector

To disable the SharePoint connector entirely for a project:

1. Go to **Advanced > Connectors**
2. Click **Configure** on the SharePoint card
3. Click **Disable this connector**
4. Confirm the action

<Warning>
  Disabling the connector permanently deletes all documents imported from SharePoint from the knowledge base. This action cannot be undone.
</Warning>

## Troubleshooting

<Accordion title="No sites appear in the configuration dropdown">
  Your Microsoft account does not have access to any SharePoint sites, or the OAuth token has expired.

  **Fix**: Verify your SharePoint access by navigating to SharePoint directly in a browser. If your OAuth session is expired, disconnect and reconnect your Microsoft account.
</Accordion>

<Accordion title="Sync completes with 0 indexed files">
  This can happen if all files in the library are in unsupported formats, or if all files are unchanged since the last sync.

  **Fix**: Check the sync summary — a high "skipped" count indicates unsupported file types. A high "unchanged" count means an incremental sync detected no changes.
</Accordion>

<Accordion title="Files limit reached during sync">
  Your AI Knowledge project has reached its maximum document count.

  **Fix**: Remove unused documents from the project or contact your administrator to increase the limit.
</Accordion>

<Accordion title="Agent asks me to connect to Microsoft when I ask a question">
  PBAV detected SharePoint chunks in the RAG results but your OAuth session is missing or expired.

  **Fix**: Go to **Advanced > Connectors** and click **Connect with Microsoft** to establish or refresh your OAuth session.
</Accordion>

<Accordion title="Partial access warning in agent responses">
  You are connected but do not have access to some of the SharePoint files referenced in the RAG results.

  **Fix**: This is expected behavior — PBAV is correctly filtering results based on your SharePoint permissions. Contact your SharePoint administrator if you believe you should have access to the restricted files.
</Accordion>

## Next Steps

<CardGroup cols={2}>
  <Card title="RAG Configuration" icon="sliders" href="rag-configuration">
    Fine-tune how your agent retrieves and ranks document chunks
  </Card>

  <Card title="Document Management" icon="folder-open" href="document-management">
    Manage all documents in your knowledge base, including synced SharePoint files
  </Card>

  <Card title="Self-Hosting Setup" icon="server" href="/self-hosting/configuration/ai-knowledge-sharepoint-connector">
    Deploy the SharePoint MCP server and register an Azure AD application (platform admins)
  </Card>
</CardGroup>