SharePoint setup

The Intric SharePoint integration uses Microsoft Graph with the Sites.Selected permission scope for access to SharePoint data. This means:

• Zero access by default: without explicit configuration, the app has no permissions to any SharePoint sites or their content
• Site-level control: an Entra tenant admin chooses exactly which sites the app can access. The app cannot see or interact with any other sites
• Delegated permissions: the app acts on behalf of the signed-in user. Even within a granted site, the user can only access files and folders they already have permission to view in SharePoint
• Search enabled: once a site is granted, users can search across files within that site

When a user connects, Intric asks for the delegated permissions Sites.Selected, User.Read and offline_access. Microsoft requires administrator consent for Sites.Selected, so grant it for the Intric app in Entra (Enterprise applications → Intric → Permissions → Grant admin consent) before users connect.

Granting access to individual sites is done through Microsoft Graph Explorer (https://developer.microsoft.com/graph/graph-explorer) or equivalent tooling. You must be an admin in your Entra tenant to complete these steps.

Step 1: Find your site(s)

Prerequisite: You need Sites.Read.All consented in Graph Explorer for this step.

Search for sites using a keyword:

GET https://graph.microsoft.com/v1.0/sites?search=marketing

Example response:

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites",
  "value": [
    {
      "id": "example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740",
      "displayName": "Marketing Site",
      "name": "marketing",
      "webUrl": "https://example.sharepoint.com/sites/marketing",
      "createdDateTime": "2023-01-15T10:30:00Z"
    }
  ]
}

From the response, note the id field of the site you want to grant access to. In this example, the site ID is:

example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740

You can use ?search=* to list all sites.

Step 2: Grant the Intric app access to the site

Prerequisite: You need Sites.FullControl.All consented in Graph Explorer for this step.

The Intric SharePoint app has the following configuration:

Field	Value
Application ID	a1162fb9-a25e-4bd3-9c55-e7a46a085536
Display name	Intric

Using the site ID from Step 1:

POST https://graph.microsoft.com/v1.0/sites/example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740/permissions
Content-Type: application/json

{
  "roles": ["read"],
  "grantedToIdentities": [{
    "application": {
      "id": "a1162fb9-a25e-4bd3-9c55-e7a46a085536",
      "displayName": "Intric"
    }
  }]
}

Use "roles": ["read"]. Every SharePoint action in Intric is read-only, so "write" would grant the app more than it uses.

Repeat for each site you want to grant access to.

Step 3: Add the sites in Intric

Once you’ve granted the Intric app access to your SharePoint site(s) in Microsoft Graph, add those sites to Intric:

1. Open Admin, and under Platform select AI Tools
2. Open SharePoint and switch on Available to your organisation
3. Open Allowed sites and click Add site
4. Fill in the three fields:
   • Name — the name users and the assistant see for the site
   • Site ID — the id of the site you granted access to in Step 2
   • Description — optional, but worth writing: the assistant reads it to decide which site to look in, so say what the site contains

Site ID format:

• Use the full site identifier string from Microsoft Graph—the id field—not the site URL from the browser
• It is made of three parts separated by commas: the site collection hostname, the site collection ID and the site ID
• Example: example.sharepoint.com,da60e844-ba1d-49bc-b4d4-d5e36bae9019,712a596e-90a1-49e3-9b48-bfa80bee8740

Repeat this for each site you want to make available in Intric.

Once configured, the assistant finds the document libraries, folders, and files within the granted site(s) by itself. Users who connect their Microsoft accounts can then use these sites in conversations with assistants that have the SharePoint integration enabled.

Every site you add is available to every assistant with SharePoint, unless the assistant’s builder narrows it down under Configure → Restrict to specific sites.

Step 4: Check capabilities and classification

On the same panel, Capabilities lists the four actions — List drives, List files, Get file content and Search. All four are read-only and set to Auto by default, so they run without asking the user. You can switch any of them to Ask or Off; see Capabilities and approval.

You can also give the integration a Security classification, so that only assistants in spaces with a matching classification can use it.

Revoking access

To remove the app’s access to a site, first list the permissions:

GET https://graph.microsoft.com/v1.0/sites/{siteId}/permissions

Find the permission entry for the Intric app, then delete it:

DELETE https://graph.microsoft.com/v1.0/sites/{siteId}/permissions/{permissionId}

The app will immediately lose access to that site and all its contents.