SharePoint connector

Ingest files and folders directly from SharePoint without re-uploading. How an admin grants access, what we can and can't see, and how to keep documents in sync.

The SharePoint connector lets your team pull documents from Microsoft 365 SharePoint sites directly into Knowledge — no more downloading from SharePoint and re-uploading. You can ingest one file at a time, browse a folder and tick which files to add, or track a folder so a single click keeps Knowledge in sync with what's currently on SharePoint.

Permission model in one sentence: the app uses Microsoft Graph's Sites.Selected permission, which means we cannot read anything in your tenant until your admin explicitly grants Knowledge access to specific sites — one site at a time, fully revocable. See Security & scope below.

What you can do

Workflow	Who	Where in the app
Ingest one file by pasting its SharePoint link	Any signed-in user	Upload tab → Or fetch from SharePoint or OneDrive
Browse a folder, pick files, ingest in bulk	Any signed-in user	Upload tab → Or fetch from SharePoint or OneDrive → paste a folder URL
Track a folder + click "Sync now" to add new files and replace updated ones	Tenant admin sets up; anyone uses	Folder browse pane → Track this folder. Manage at Sources in the sidebar.
Re-pull one document if it changed at the source	Anyone who can manage the document	Library → row → Sync button

Looking for the tracked-folders list, Sync now / Edit projects, or OneDrive? Those live in their own home now — see Sources & sync. This page covers SharePoint-specific admin setup and the security model.

One-time admin setup (~2 minutes)

A tenant admin (an admin in Knowledge and a SharePoint / Global admin in your Microsoft 365 tenant) does this once per Microsoft 365 tenant, then again briefly per site you want to connect.

Step 1 — Connect SharePoint

Open Settings → SharePoint connector.
Click Connect SharePoint. You'll be redirected to Microsoft to sign in as your tenant admin.
Microsoft shows a consent prompt for "Olyteck Ask – Document Sync" requesting Sites.Selected (application) and Sites.FullControl.All (delegated). Accept.
You're redirected back to Knowledge. The connector card shows Microsoft admin consent recorded.

What that consent screen means. Sites.Selected is the gold-standard "least-privilege" SharePoint permission — by itself it grants no data access at all. It only lets the app be granted access to specific sites later. Sites.FullControl.All is delegated only, which means it can only act as the signed-in admin themselves, only when the admin is interactively present. We use it for exactly one thing: when an admin clicks Grant access on a site row, we receive a short-lived token that we use once to call POST /sites/{id}/permissions, then discard. The token is never stored.

Step 2 — Add a site (and grant access in one click)

In the same card, paste a SharePoint site URL — e.g. https://contoso.sharepoint.com/sites/Cyber. The URL should be the site root, not a specific document or page.
Click Add & grant. You're redirected to Microsoft again, sign in as admin, and Knowledge is granted read on that site only.
The row appears under the connector with status ACCESS GRANTED. Any user in your Knowledge tenant can now ingest files from this SharePoint site.

Repeat Step 2 for each additional site you want to connect. There is no cap on the number of sites.

Teams files come for free. Files attached in a Microsoft Teams channel live on the team's underlying SharePoint site. Connect that team's SharePoint URL once (you can find it via Teams → channel → Files → Open in SharePoint) and every file in every channel of that team is reachable through this connector.

Ingest a single file

In SharePoint, open the file (or right-click it in the document library) and click Copy link.
In Knowledge, go to Upload. Expand Or fetch from SharePoint or OneDrive.
Paste the link. Click Fetch. The provider is detected from the URL host — no need to choose SharePoint vs OneDrive yourself.

A job appears in the Jobs view, processes through extraction → embedding, and the document lands in your Library within ~30 seconds. If the file is bigger or the queue is busy this can take a couple of minutes.

The SharePoint URL must point at a file, not a site or a folder. A file URL typically looks like:

https://contoso.sharepoint.com/:w:/s/Cyber/IQ...?e=... (Word)
https://contoso.sharepoint.com/:x:/s/Cyber/IQ...?e=... (Excel)
https://contoso.sharepoint.com/:b:/s/Cyber/IQ...?e=... (PDF / binary)
https://contoso.sharepoint.com/:p:/s/Cyber/IQ...?e=... (PowerPoint)
or a direct path like /sites/Cyber/Shared%20Documents/your-file.docx

Browse a folder and pick files

If you paste a folder URL (it'll contain :f:/s/) Knowledge opens a small picker showing every supported file in that folder plus any sub-folders:

Click Open on a sub-folder to navigate into it; use ← Up in the breadcrumb to go back.
Tick the files you want and click Ingest N files (the label shows the live checkbox count and disables at zero).
To grab everything at once, click Ingest entire folder. If sub-folders are present, you'll be asked whether to recurse (max 5 levels, 1000 files, dot-prefixed folders skipped).
If the folder has more than 200 items, a Load more button appears. Up to 10 pages (2 000 items) per folder; for larger folders, navigate into a sub-folder instead.
Only PDF, DOCX, XLSX, PPTX, TXT, CSV, and MD files appear in the list. Other types (videos, OneNote notebooks, links, …) are filtered out.

Keep things in sync — tracked folders

Tracked folders, edit destination projects, sync-now, and auto-delete are all covered in detail under Sources & sync. Short version for SharePoint:

Browse a folder via Upload → Or fetch from SharePoint or OneDrive. Pick destination projects at the top of the Upload tab first if you want auto-assignment.
Click Track this folder in the folder pane.
Choose auto-delete behaviour in the modal (off = safer; on = active mirror).
The folder appears under Sources in the sidebar. Click Sync now there to reconcile against SharePoint.

Cost control. Knowledge caps daily SharePoint fetches per workspace (default: 50 on Starter, 500 on Pro). A big bulk-sync will respect that cap and queue the rest for tomorrow. Unchanged files cost nothing — they're detected with a cheap eTag comparison and never re-downloaded or re-embedded.

Security & scope — what we can and cannot read

What permissions does the connector actually have?

Permission	Type	Used for	Data access
`Sites.Selected`	Application (background)	Reading files from sites your admin explicitly granted	Only the sites listed in Settings → SharePoint connector with status ACCESS GRANTED. Zero access to any other site, list, file, or user in your Microsoft 365 tenant.
`Sites.FullControl.All`	Delegated (interactive only)	Allowing an admin to click Grant / Revoke from within Knowledge	Acts only as the signed-in admin themselves, only during the short consent window. We obtain a one-hour delegated token, use it for the single grant or revoke API call, and immediately discard it. No refresh token. The permission is dormant whenever an admin isn't actively granting/revoking.

What the connector cannot do

Cannot list any site outside the ones your admin granted. Try and Microsoft Graph returns 403.
Cannot read another user's OneDrive or Teams chat attachments (those need different permissions, not granted).
Cannot write to SharePoint. The grant is read only.
Cannot modify, delete, or share anything in SharePoint. The grant explicitly does not include those rights.
Cannot read user mailboxes, calendars, or Entra directory data. The app has no Mail/User/Directory permissions.
Cannot bypass SharePoint permissions on a granted site. If you granted Knowledge access to site A, it can read files in site A. It still cannot read files in site B, even if site B happens to be in the same M365 tenant.

What happens to a SharePoint file after it's ingested?

The file content is downloaded once over HTTPS, broken into text chunks, vector-embedded, and stored in your tenant's database. The original binary is also kept in your tenant's private storage so the document can be re-displayed later. Both live in the same isolated tenant boundary as everything else you've uploaded directly. They never leave that boundary except to send extracted text to your chosen LLM provider at query time (this is the same path as any other document in Knowledge — see sub-processors).

How is the audit trail recorded?

Every Graph API call (token request, share resolve, driveItem fetch, folder list, grant, revoke) is recorded in our audit log with the action, tenant, calling user, target endpoint, and HTTP result. The audit log is queryable by tenant admins on request.

What can the customer revoke, and how fast?

Per-site grant — click Revoke access at Microsoft on any site row in Settings → SharePoint connector. The admin signs in once; we call the Microsoft Graph DELETE permissions endpoint with the admin's delegated token, then discard the token. Immediate — Knowledge can no longer read that site as soon as the call returns.
Remove site from Knowledge only — click Remove from Ask. This forgets the site in Knowledge but leaves the Microsoft grant in place. Useful if you want to pause access temporarily without re-consenting later.
Remove the app entirely from your Microsoft tenant — Entra portal → Enterprise applications → Olyteck Ask – Document Sync → Delete. Immediate and covers every site.
Stop tracking a folder — Sources → row → Stop tracking. The folder is forgotten by Knowledge. Existing documents stay in your Library and the Microsoft grant on the parent site is unchanged.

Where are credentials stored?

The app's client secret lives in private/.env on the Knowledge server (chmod 600) and is encrypted in our nightly backups.
The 1-hour application access token is cached in the database to avoid round-trips to Microsoft on every call. There is no refresh token because the OAuth client_credentials flow doesn't issue one — we re-request when the cached token nears expiry.
The delegated Sites.FullControl.All token used for grant/revoke is never persisted: it lives in memory for one HTTP request and is wiped immediately after.

Troubleshooting

"Failed: parent SharePoint site is not connected to your Ask tenant"

You pasted a file URL whose parent site has not been granted to Knowledge yet. Ask your admin to add the site under Settings → SharePoint connector → Add & grant. The site URL is the bit before /Shared%20Documents/ or /SitePages/ — usually https://yourtenant.sharepoint.com/sites/<sitename>.

"That looks like a site URL, not a file URL"

Knowledge needs a link to a file, not the site root. In SharePoint, open the file, click Share or right-click → Copy link, then paste that URL.

"could not obtain a download URL — file may be IRM-protected, oversized, or a non-binary type"

Microsoft refuses to issue a download URL for files protected by Information Rights Management (IRM), for OneNote notebooks (no binary form), and for files over 4 GB. Re-export the document to a non-IRM PDF/DOCX, or contact your SharePoint admin.

"That is a folder, not a file"

You pasted a folder share link into the file-ingest field. Either paste it again in the same field (Knowledge auto-detects folders and opens the picker), or open one file inside and paste its link.

"daily get cap reached"

Each Knowledge tenant has a daily limit on SharePoint downloads to keep costs sane. Default is 50 per day on Starter, 500 on Pro. Wait until tomorrow or upgrade your plan.