AI and SharePoint.

What Microsoft’s AI already does with SharePoint

Microsoft Copilot (formerly Microsoft 365 Copilot; licences may still show the old name) answers from SharePoint, OneDrive, mail and Teams when a user holds a Copilot licence. Without one, Copilot Chat is “primarily web grounded” and does not search your organisation’s files. NZ list prices on 19 October 2026, excluding GST and paid yearly: the Copilot Business add-on is NZ$34.00 per user per month (NZ$29.14 for the first year on commitments made July to December 2026), Business Standard with Copilot is NZ$38.00, and the enterprise add-on is NZ$48.50.

Copilot Studio agents can also use SharePoint as a knowledge source. For staff without a Copilot licence, Microsoft’s billing table makes a tenant-grounded generative answer 12 Copilot Credits (10 for Graph grounding plus 2), about US$0.12 at the US$0.01 pay-as-you-go rate. Our Microsoft Copilot guide covers licensing in more depth.

Copilot shows people what they can already open. If the HR site is shared with everyone, Copilot will find it. Permission clean-up belongs in the project plan.

Integration routes and when to use each

Automation 1: permission-aware search over selected sites

Inputs

Document libraries on three named sites (Policies, Projects, Templates), synced with Graph delta queries.

Permissions

An app registration with Sites.Selected. An administrator grants a read role on those three sites; the rest of the tenant stays invisible to the app.

Model step

Retrieve passages and answer with citations: file name, link and modified date.

Access check

Before showing a result, confirm the asking user can open that item with a delegated call, and drop it if not. In delegated mode Graph intersects app and user permissions.

Human review

Answers are read-only. Questions with no supporting source are logged for content owners.

Failure and recovery

If delta returns 410 Gone, Microsoft’s guidance is a full re-enumeration, then a comparison with your index.

The delta API can mark sharing changes with Prefer: deltashowsharingchanges, but Microsoft says processing permissions correctly needs Sites.FullControl.All. For most NZ organisations a per-result access check is safer than giving a search app full control. Our private AI search guide covers the index side.

Automation 2: classify incoming documents with approval

1. Trigger. A file lands in an “Incoming” library (Power Automate trigger or delta poll).
2. Propose metadata. The model suggests Document Type (choice), Client (lookup), Expiry (date) and an AI Confidence number, and sets Review Status to “AI suggested”.
3. Validate. Values must match existing choices and the client list; anything unknown goes to review.
4. Approve. A reviewer works from a view filtered to “AI suggested” and corrects or approves.
5. Write back. On approval, columns are set and the file moves to its target library. The app holds a write role on that one list through Lists.SelectedOperations.Selected.

Selected permissions on lists, items or files break inheritance, so watch SharePoint’s limits on unique permissions.

Permissions and approval design

Prefer delegated access for anything user-facing, because the app can never exceed the person’s own rights. For background jobs, use Selected scopes rather than Sites.Read.All or Files.Read.All. Each Selected grant needs three things (consent, a resource role, a token carrying the scope), and an administrator can remove one site’s grant or revoke consent entirely. Keep approval for any move, rename or column change, as described in our AI integration approach.

On privacy, Microsoft says prompts, responses and Graph data under enterprise data protection are not used to train foundation models and that it acts as a processor. You remain responsible under the Privacy Act 2020. New Zealand is a Microsoft 365 local region for data at rest, but Copilot inference may run in other regions; see data residency for AI systems.

Costs and limits

• Graph throttling: 130,000 requests per 10 seconds per app across tenants, with lower SharePoint-specific limits; throttled calls return 429 with Retry-After.
• Custom search, worked example: 2,000 questions a month at 6,000 input and 400 output tokens on Claude Sonnet 5.5 (US$2 and US$10 per million) is about 2,000 × US$0.016 = US$32 a month, before hosting.

Where it goes wrong

• Oversharing made visible. AI finds files that were always technically open. Audit “everyone” permissions first.
• Path assumptions. Delta results omit paths, and renaming a folder does not return its children. Track items by ID.
• Initial crawl throttling. Large first syncs hit 429s; respect Retry-After and spread the load.
• Scanned PDFs. Image-only files return no text; see OCR versus vision models.

For the wider Microsoft stack, read our Microsoft 365 and Microsoft Teams guides.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.