Building a Federated Copilot: Part 5, SharePoint Documents Without External Entra Users

Описание и применение

Внешние пользователи могут безопасно читать документы SharePoint через брокерское приложение, использующее сертификатную аутентификацию, разрешение Sites.Selected и строгую проверку метаданных, без создания внешних пользователей Entra.

Задача

Enable external users to read SharePoint documents via a federated Copilot without provisioning external Entra users or granting tenant-wide Graph permissions.

Результат

External users can securely read approved SharePoint documents via a broker application that uses certificate-based authentication, Sites.Selected permissions, and strict metadata/content validation, without provisioning external Entra users or granting tenant-wide Graph permissions.

Рабочий процесс

• Establish a real SharePoint site and entitlement via a trial tenant
• Create a dedicated single-tenant application with Sites.Selected permission and read-only grant on the approved site
• Separate administrative setup from runtime: review and apply site permissions with a plan hash
• Enroll a certificate and keep Graph tokens server-side using client_credentials flow
• Prove transport by performing bounded app-level metadata and content checks on a test file
• Constrain metadata, content, and redirects with strict allowlists and version-bound requests
• Add a separate document grant and PF chain for m365.document.read with independent actor proof
• Ground one actual Copilot answer by combining document and chat chains
• Reduce repeated browser logins carefully

Доказательства

We did not solve that by provisioning external Entra users or sending PF access tokens to Microsoft Graph. Instead, a dedicated Entra application reads an approved SharePoint site.

Источник

We created a dedicated single-tenant application and service principal, requested the Microsoft Graph application permission Sites.Selected, and assigned a read-only grant on the exact approved site.

Источник

The broker uses a dedicated certificate credential. The private key is held in a protected Vault KV record and read through a narrowly scoped, one-use credential reader.

Источник