Building a Federated Copilot: Part 5, SharePoint Documents Without External Entra Users

说明与用途

外部用户可以通过使用证书身份验证、Sites.Selected 权限和严格的元数据检查的代理应用程序安全地读取 SharePoint 文档，而无需为外部 Entra 用户提供权限。

问题

Enable external users to read SharePoint documents via a federated Copilot without provisioning external Entra users or granting tenant-wide Graph permissions.

结果

External users can securely read approved SharePoint documents via a broker application that uses certificate-based authentication, Sites.Selected permissions, and strict metadata/content validation, without provisioning external Entra users or granting tenant-wide Graph permissions.

工作流

• Establish a real SharePoint site and entitlement via a trial tenant
• Create a dedicated single-tenant application with Sites.Selected permission and read-only grant on the approved site
• Separate administrative setup from runtime: review and apply site permissions with a plan hash
• Enroll a certificate and keep Graph tokens server-side using client_credentials flow
• Prove transport by performing bounded app-level metadata and content checks on a test file
• Constrain metadata, content, and redirects with strict allowlists and version-bound requests
• Add a separate document grant and PF chain for m365.document.read with independent actor proof
• Ground one actual Copilot answer by combining document and chat chains
• Reduce repeated browser logins carefully

证据

We did not solve that by provisioning external Entra users or sending PF access tokens to Microsoft Graph. Instead, a dedicated Entra application reads an approved SharePoint site.

来源

We created a dedicated single-tenant application and service principal, requested the Microsoft Graph application permission Sites.Selected, and assigned a read-only grant on the exact approved site.

来源

The broker uses a dedicated certificate credential. The private key is held in a protected Vault KV record and read through a narrowly scoped, one-use credential reader.

来源