Building a Federated Copilot: Part 5, SharePoint Documents Without External Entra Users

Description and use

External users can securely read SharePoint documents via a broker app using certificate authentication, Sites.Selected permissions, and strict metadata checks, without provisioning external Entra users.

Problem

Enable external users to read SharePoint documents via a federated Copilot without provisioning external Entra users or granting tenant-wide Graph permissions.

Outcome

External users can securely read approved SharePoint documents via a broker application that uses certificate-based authentication, Sites.Selected permissions, and strict metadata/content validation, without provisioning external Entra users or granting tenant-wide Graph permissions.

Workflow

• Establish a real SharePoint site and entitlement via a trial tenant
• Create a dedicated single-tenant application with Sites.Selected permission and read-only grant on the approved site
• Separate administrative setup from runtime: review and apply site permissions with a plan hash
• Enroll a certificate and keep Graph tokens server-side using client_credentials flow
• Prove transport by performing bounded app-level metadata and content checks on a test file
• Constrain metadata, content, and redirects with strict allowlists and version-bound requests
• Add a separate document grant and PF chain for m365.document.read with independent actor proof
• Ground one actual Copilot answer by combining document and chat chains
• Reduce repeated browser logins carefully

Evidence

We did not solve that by provisioning external Entra users or sending PF access tokens to Microsoft Graph. Instead, a dedicated Entra application reads an approved SharePoint site.

Source

We created a dedicated single-tenant application and service principal, requested the Microsoft Graph application permission Sites.Selected, and assigned a read-only grant on the exact approved site.

Source

The broker uses a dedicated certificate credential. The private key is held in a protected Vault KV record and read through a narrowly scoped, one-use credential reader.

Source