Today's task
Build an internal "how do we do things here?" agent that answers staff questions from documents in SharePoint. Then run a simple test that shows why permissions are the most important part of AI readiness.
Steps
- Create a test SharePoint folder. Make a folder (or a small site) with three short documents:
- a PTO or time-off policy
- a "how to request a new laptop" procedure
- one document marked Managers only that you share with yourself and no one else
-
Create a new agent in Copilot Studio called something like Team Helpdesk, with instructions such as:
Answer employee questions using our internal policies and procedures. Always cite the document you used. If the answer isn't in our documents, say so and suggest contacting the office manager.
-
Add SharePoint as knowledge. Point it at the folder or site you created.
- Make sure the agent signs users in. In the agent's Settings → Security → Authentication, choose Authenticate with Microsoft. The agent then answers using each person's own access to SharePoint.
- Test as yourself. Ask about PTO, laptops and something from the Managers only document. You should get all three.
- Publish and share with one colleague. Authentication changes only take effect after you publish, and the test pane always runs as you. Publish the agent, share it with one colleague, and have them open it in Teams or Microsoft 365 Copilot.
- Have your colleague ask the same questions. They should not get answers from the Managers only document.
What to notice
The agent didn't need special rules to protect the manager document. It inherited SharePoint permissions. That's great news, and also the risk: if a sensitive file is shared with "Everyone" or a whole-company link, the agent can surface it to everyone.
Governance tip: Before you connect any agent (or Microsoft 365 Copilot) to company data, look for oversharing. Sites shared with "Everyone except external users", old "anyone with the link" files, and forgotten HR or finance folders are the usual culprits.
Go further
- Knowledge sources in Copilot Studio
- Our AI Governance page covers data-protection controls like sensitivity labels and DLP.