SharePoint
Most organisations have a decade of documents in SharePoint and no reliable way to find anything in it. The knowledge exists; the retrieval does not.
Most organisations have a decade of documents in SharePoint and no reliable way to find anything in it. The knowledge exists; the retrieval does not.
What SharePoint holds, and why that matters here
SharePoint is where policies, procedures, templates and accumulated organisational knowledge usually live. The problem is never that the content is missing — it is that finding it requires knowing where somebody filed it years ago.
That failure has a measurable cost: people ask colleagues instead of searching, the same questions circulate indefinitely, and staff act on outdated copies they saved locally because finding the current one was too hard.
- Policies and procedures — the authoritative versions, wherever they were filed.
- Templates and forms — what people need and cannot locate.
- Departmental content — knowledge held by teams rather than centrally.
- Document libraries — structured collections with their metadata.
- Version history — which version is current, which matters more than most searches admit.
Questions SharePoint lets Elbi answer
What is the policy on this?
Answered from the current document rather than from memory or a saved copy.
Where is the template?
Located and provided rather than described.
What is the procedure?
The steps, in order, from the authoritative source.
Is this the current version?
Version state, which prevents acting on superseded material.
Who owns this document?
Ownership metadata for follow-up.
What changed?
Version history where it matters for compliance.
How Elbi reads SharePoint
- Through Microsoft Graph, under your tenant's controlSharePoint Online content is reached through Microsoft Graph, under an app registration in your own Entra tenant. The permissions are listed on that registration and granted by your administrator, so the security team reviews one concrete list.
- Scoped to named sitesMicrosoft Graph offers a Sites.Selected permission, which gives an application access only to the sites an administrator names rather than to every site in the tenant. It is the natural way to begin with one or two libraries.
- Trimmed to the person askingEach answer is limited to documents the asker could open themselves, including folders and items with unique permissions. Access granted through sharing links counts as well, which is why overshared content is worth finding before launch.
- The published version, not the draftLibraries with versioning keep major, published versions and minor, draft ones. Elbi answers from the published version, so a draft saved last night does not become policy this morning.
- Answers point to their sourceAn answer names the document and library it came from, so the reader can open the original and the document owner can see which of their files is being relied on.
- Nothing is editedElbi does not create, edit, move or check out documents. Keeping content current stays with the document owners and your existing approval workflow.
Scope and control on a SharePoint connection
| Direction of access | Read-only. Elbi retrieves and cites documents; it does not create, edit or move them, and it leaves version history and approvals untouched. |
|---|---|
| Who can see what | SharePoint's own permissions — site, library, folder and item, including broken inheritance and sharing links — decide what each person's answer may draw on. |
| Credentials | The app registration and its secret or certificate live in your Entra tenant. You can rotate the credential, shorten the list of selected sites or withdraw consent entirely, and each change takes effect without involving us. |
| Where data goes | Documents are read when a question needs them and stay where they are. Message content is destroyed within 24 hours, generally once the conversation finishes, and is never passed to an external AI service. |
| Audit | Microsoft Purview's audit log can record file access in SharePoint, and Elbi's own records can show which document supported which answer. |
| If SharePoint is unreachable | Elbi says it cannot reach the library and does not answer policy questions from memory. |
What this replaces
The value here is unusual because the content is already good — organisations invest heavily in writing policies and procedures, and then that investment sits unused because retrieval is harder than asking a colleague.
A conversational layer converts existing content into answered questions without new content being written. That is a rare position: the work has been done and only the interface is missing.
The second effect is version discipline. Where people save local copies because finding the current version is hard, they act on stale material — a genuine compliance risk. An assistant that reliably returns the current version removes the reason those copies exist.
Who gains most from a connected SharePoint
Any large organisation
A decade of policy content nobody can find.
Regulated sectors
Version currency, where acting on superseded procedure has consequences.
HR and compliance
Policy questions that currently route to a person.
Distributed teams
Consistent answers regardless of who is asked.
Getting value from SharePoint
Start with one library that already attracts a steady stream of internal questions — usually HR policies or IT how-to guides — and whose owner keeps it current. A library with a clear owner and a habit of publishing finished versions gives good answers from the first day; a sprawling team site full of drafts does not.
Before connecting, run an oversharing check. Any assistant that respects permissions will surface everything a person can technically open, including files shared with the whole organisation years ago and forgotten. SharePoint's admin tooling includes reports that help find these, and fixing the worst cases first protects both the pilot and the organisation.
Then compare what people actually ask with what the library contains. The gaps — questions with no document behind them — are as useful as the answers, because they tell document owners what to write next. Where two documents disagree, the conflict surfaces in the answers, and that is worth treating as a finding to fix rather than a fault in the assistant.
What connecting SharePoint involves
- Choose the first sites and librariesName them explicitly. A short list keeps the security review concrete and the first answers good.
- Register the app and grant site accessYour administrator registers the application in Entra, consents to Sites.Selected, and then grants read access to each named site.
- Check permissions on those sitesLook for broken inheritance, grants to "Everyone except external users" and old sharing links. Whatever SharePoint shows to everyone, Elbi can answer for everyone.
- Confirm versioning and metadataMake sure the libraries separate published from draft, and agree which metadata — owner, review date, department — should accompany answers.
- Decide on labelled and scanned filesFiles encrypted by sensitivity labels, and scanned PDFs, each need a decision: include, exclude, or include once scan quality has been checked.
- Test with real questions and real peopleAsk as an ordinary member of staff, then as someone in HR, and confirm that each sees only what SharePoint itself would show them.
Documents, personal data and the PDPL
SharePoint usually holds more personal data than its owners assume. Alongside the policies sit CVs, scanned IDs, employment contracts, performance reviews, customer correspondence and spreadsheets exported from other systems. Under the Personal Data Protection Law, making any of that answerable is processing, even where permissions technically allow it.
The practical rule is to connect libraries by purpose, not by convenience. A policies library has a clear purpose; an HR team site that mixes policy with personnel files does not, and should be excluded or split before it is connected.
Document metadata is personal data too, since the author and last editor are recorded on every file. Showing the document owner so people can follow up is useful; revealing who last edited a sensitive file rarely is.
What organisations typically see
How Microsoft's own tools and other assistants compare
SharePoint's built-in search finds documents; it does not answer questions from them. Microsoft 365 Copilot does answer from SharePoint content within the permissions of the licensed user, and for organisations whose staff all work inside Microsoft 365 it is an obvious option to evaluate.
An assistant such as Elbi is usually considered for a different shape of problem: when the same assistant must also answer from systems outside Microsoft 365 — an HR platform, a service desk, a line-of-business database — within one conversation.
Whatever the tool, one question is worth asking directly: does it copy documents into an index of its own, and if so, how does that copy keep pace with SharePoint's permissions and deletions? A restricted or deleted file should stop being answerable when SharePoint says so.
Common questions
Yes. People see only what they can already see, established through their existing sign-in.
Version handling is part of deployment — returning the current version reliably is much of the value.
Yes, including Arabic scans, though quality depends on the original.
No. With the Sites.Selected permission, access is limited to the sites your administrator names, and widening it is a deliberate step on your side.
No. The connection is read-only; documents are created, edited and approved in SharePoint by their owners.
They will be answerable to everyone, because SharePoint says everyone may see them. Tidying overshared content before launch is one of the most useful preparations there is.
Turn your SharePoint libraries into answers
Elbi answering from the current version of your documents, in Arabic and English, within SharePoint's own permissions.