What makes SharePoint easy or hard to automate
Through Microsoft Graph, SharePoint is three things: sites, lists and document libraries (drives). Lists behave like simple database tables with typed columns. Libraries hold files plus metadata columns. Graph can create and update list items, upload and download files, set metadata, and search across sites. Delta queries return what changed since the last sync, and change notifications can alert a workflow when a list or library changes.
The difficulty is the environment rather than the API. Real SharePoint tenants have years of sites, inconsistent folder structures, broken inheritance on permissions, and duplicate copies of the same policy. An AI assistant built on that will confidently cite the 2019 version. Cleanup and source selection are part of the project.
Permissions are the other hard part. Granting an app tenant-wide read access is easy and risky. The Sites.Selected permission lets an admin grant an app access to specific sites only, which is what we recommend.
The AI layer
SharePoint holds the content. The AI makes it findable and actionable:
- Answering questions. Retrieval over chosen libraries, with citations, turns a search problem into a one-line answer.
- Filling metadata. Models can classify documents and fill library columns such as document type, client and expiry date, which also improves search.
- Routing documents. Contracts, invoices and requests arriving in a library get extracted, summarized and sent to the right reviewer.
Choose sources deliberately. Fewer, current, well-owned libraries produce better answers than indexing everything.
Limits to plan around
- Throttling. SharePoint throttles per app and tenant and returns 429 or 503 with a Retry-After header. Large initial indexing jobs must pace themselves and run off-hours.
- Permission complexity. Broken inheritance and sharing links make “who can see this” hard to compute. Test the assistant with accounts that have limited access.
- Subscription lifetimes. Graph change notification subscriptions on lists last under 30 days and must be renewed. Pair them with delta queries.
- Legacy auth. Anything still using ACS secrets or SharePoint Add-ins needs moving to Entra ID apps.
How Lumeor typically connects it
We usually register one Entra ID app per integration with Sites.Selected, granted to the specific sites in scope. Workflow automations run in n8n or Power Automate. Knowledge assistants run as a small service that syncs chosen libraries with delta queries into a vector store, storing permissions with each chunk, and serves answers through a Microsoft Teams bot. See the RAG knowledge assistant guide, Microsoft 365 Copilot vs ChatGPT Enterprise, and what a RAG assistant costs.