SharePoint: what this connector can do

Member·6 minutes to read

What this page is for

docs/connectors/sharepoint.md is the setup guide for whoever runs your organisation's Botseon deployment — creating the vendor application and entering its credentials. This page is the other half: what SharePoint actually lets a bot do once it is connected to your account, what it asks you for along the way, its limits, and how to take the connection away again, in Botseon and at Microsoft.

Search and read documents across the SharePoint sites you can open, and save files there with your approval.

What a bot can do with it

Read — SharePoint tells a bot things, nothing changes

Tool	What it does
`sharepoint.search_files`	Search documents across the SharePoint sites the account can open; each result names its site.
`sharepoint.list_sites`	Find SharePoint sites the account can open, by name.
`sharepoint.list_libraries`	List the document libraries of one site, each with the label an upload names.
`sharepoint.list_folder`	List the files and folders in a library, or in one folder of it.
`sharepoint.read_file`	Read a file in a library as text.

Write — SharePoint lets a bot change things

Tool	What it does
`sharepoint.upload_file`	Save a file the bot wrote into a library folder.

The permissions it asks for, in plain words

Every call a bot makes through this connector is tagged with what kind of thing it is. Only the tags below ever apply here — a tag this connector's tools never carry is not listed, because it can never ask you for it.

read — Looks something up. Nothing changes, and nothing is sent anywhere. A bot never has to ask first for this.
write — Changes something inside the connected account — creates, edits or files something. Asks you first, unless you have told Botseon to always allow that exact action.

The first sign-in asks Microsoft for reading only. Saving files needs one more step: press Allow sending on the account, and Microsoft asks you once more, on the same account.

Limits

SharePoint reaches only the sites and files your own Microsoft account can already open — a bot never sees more than you do. Nothing outside the tools listed above is possible through this connector, however a bot is asked to use it.

An upload never replaces an existing file: a file with the same name in that folder makes the save refuse.
An upload refuses if the folder's label has changed since you approved it.
Your organisation's admin can narrow where bots look with a list of allowed sites (Organisation → Policies → SharePoint sites). When that list is set, a site outside it is refused, even if your account can open it.

SharePoint for the whole team

In a team, an admin can connect SharePoint once for everyone, on Organisation → Team connectors → SharePoint for the whole team: choose Delegated or Application permissions, type the team's Microsoft tenant ID, optionally tick Allow write access, and press Connect team. Microsoft then asks an administrator of that tenant to approve; on the way back the team connection shows Connected.

Delegated — each member signs in with their own Microsoft account the first time a bot uses SharePoint, and the bot sees only the sites that account can open.
Application — bots use the team's own access, with no sign-in of yours, and see only the sites the admin picked in the site picker on the same page.
Without Allow write access, no bot can save files to SharePoint for anyone on the team, even a member who pressed Allow sending on their own account.
Until the setup is finished, a bot asked to use SharePoint answers "This team does not have the SharePoint integration". If you are an admin, the answer also carries a link back to Team connectors so you can finish it.

With no team setup at all, SharePoint works on your own account exactly as described above.

Application-level consent can fail at Microsoft with a redirect error, AADSTS50011 ("the redirect URI specified in the request does not match"). The workaround is Delegated permissions: choose Delegated on Team connectors and press Connect team again. Members then sign in with their own Microsoft accounts the first time a bot uses SharePoint.

SharePoint is also only ever as wide as the scopes your organisation's connected app actually requests — the exact scopes are on the operator's own setup page, docs/connectors/sharepoint.md, because narrowing or widening them is a decision for whoever runs your deployment, not for this page.

Disconnecting

In Botseon

Open Plugins from the sidebar, press this connector's card to open its detail page, and under Accounts press the ✕ next to the account (its label is "Remove account" and the name of the account), then Revoke and remove to confirm — or Uninstall to remove the plugin and every account connected to it at once. Either one revokes the stored connection immediately: nothing more is read or changed through it from that moment on. Install a plugin walks through the same screen step by step.

At Microsoft

Removing the account in Botseon also asks Microsoft to revoke the token, when this deployment's connector is configured with a revoke URL. Confirm the grant is actually gone by opening Microsoft's own account settings — the connected-apps, security or authorised-apps page covers it — and removing Botseon there too if it still shows up. That is also where you can revoke access without going through Botseon at all, which is worth knowing if you ever lose access to your Botseon account.

What Botseon keeps, and how your data is used

Whatever a bot reads or writes through this connector becomes part of your conversations and the record of that run — the same records, and the same retention schedule, as everything else a bot works on. Botseon is the processor for that content; your organisation decides what it may read and remember, and can delete it sooner than the schedule would on its own.

Your data is sent to a model provider only to produce the bot's answer, and for nothing else — it is not used to train any model. The Privacy Policy's Models and How long we keep it sections have the full detail, including exactly how long each kind of record is kept for.