SharePoint App Delegation

Overview

SharePoint App Delegation in iX Hello Customer (iXHC) is a secure authentication approach that allows iXHC to access SharePoint content through a dedicated Azure/Entra ID application instead of relying on an individual user's account. This enables the platform to ingest, synchronize, and index SharePoint documents for use in AI-powered knowledge and RAG experiences. By using an app identity, access remains centralized, reliable, and easier to manage.

Key Benefits

• Centralized access management through an administrator-approved application.

• Not dependent on individual user accounts, preventing disruptions when users leave the organization.

• Improved security and governance with controlled permissions.

• Reliable document synchronization between SharePoint and iXHC.

• Scalable for enterprise deployments and multiple knowledge sources.

How It Works

• An administrator registers or configures an Azure/Entra ID application.

• Appropriate SharePoint permissions are granted and consented to.

• The application credentials are configured in iXHC.

• iXHC uses the application identity to connect to SharePoint.

• Documents from selected SharePoint sites or libraries are ingested and indexed for AI-powered search and responses.

Organizations use SharePoint App Delegation when building knowledge-based AI assistants that need to access SharePoint documents, policies, manuals, FAQs, or other enterprise content without requiring each user to authenticate separately.

Let's see how SharePoint App Delegation works

Pre-requisites

1. Steps to set up SharePoint Microsoft Entra ID refer to this

2. An active Office 365 Account

   User should have an active Microsoft Office 365 Account. If user does not have an active account, the user can create one at: https://signup.live.com/signup

3. At least one App Registration

   Open your Azure account. If user does not have any App Registration, it can be created by:

   • Enter App Registrations in the Search field at the top of the Azure page.

   • Select the App Registrations icon

   • Click on New Registration button

Step 1: Studio Mode:

Login to the iX Hello application. Under Studio mode choose the organization menu. With an organization menu choose ("Manage Organization Configurations") Administration menu and choose SharePoint Access Type.

In SharePoint Access Type, Organization Type dropdown set to App Delegation and click 'Save SharePoint Access Type'

Once saved, you will be redirected to the My Connections. Click Connections Gallery.

Scroll down and choose Microsoft Office365 SharePoint. Click Connect.

Once you click Next, you will be redirected to the Microsoft Office365 Instance Configuration page.

Before individual users can connect their Microsoft Office 365 SharePoint accounts, an administrator must first configure the organization's SharePoint integration settings in iX Hello Customer.

Until this organization-level setup is completed, users cannot create or use personal SharePoint connections.

Select Set Up Connections to begin the organization-level SharePoint integration process. This setup typically includes:

• Configuring the organization's SharePoint access method (for example, App Delegation).

• Authorizing the Microsoft Office 365 tenant.

• Granting the required SharePoint permissions.

• Saving the integration settings.

After the organization-level configuration is completed, users can create their individual SharePoint connections and access approved SharePoint content within iX Hello Customer.

If you do not have this information ready, please refer to the prerequisites section. The table below explains each of the inputs shown on this screen.

Input	Information
Service Instance Name	You can give any value of your choice.
Client ID	This is your Office 365 Application ID.
Client Secret	This is your application secret value.
Tenant Id	This is the directory ID in Office 365.

Fill the required information and click Connect to Office 365

This will validate the details and if correct, the integration will be saved, and the user will be redirected to a Microsoft connection page:

Once clicked, you will see a success message saying the connection was established successfully.

You have now successfully integrated Office 365 with iX Hello. As this is not user delegation it will not ask you to login to the Office 365, rather it will as the user to click Return to Integration Configuration to return to the connections page. The user should see Microsoft Office 365 SharePoint in the list as shown below:

With App Delegation, a user does not need to provide their individual SharePoint login credentials when setting up a connection. Instead, access is managed at the tenant level through a dedicated SharePoint application.

Steps to follow

1. Connection Setup

   • The app delegation connection is configured using a SharePoint tenant.

   • Individual users are not required to sign in or authorize access using their personal accounts.

2. Site Access

   • The application can access all SharePoint sites that have been explicitly granted permission within the configured tenant.

   • For example, if the tenant has access to 10 SharePoint sites, the bot can retrieve and use content from those 10 sites.

3. Tenant-Based Access Control

   • Access is controlled by the permissions assigned to the SharePoint tenant and application.

   • This ensures a centralized and consistent access management approach.

4. Supporting Multiple Teams

   • If one team requires access to a specific set of SharePoint sites, a dedicated tenant configuration can be created for that team.

   • If another team needs access to a different set of sites, a separate tenant configuration can be set up with the appropriate permissions.

   • This allows teams to maintain access to only the SharePoint content relevant to their use cases.

Comparison with User Delegation

Once the connection has been established, the experience of using SharePoint content is the same for both User Delegation and App Delegation. Refer to this document to build a custom app.

The primary difference lies in how access is granted:

• User Delegation: Access is based on the permissions of the individual user who authenticates.

• App Delegation: Access is based on the permissions granted to the SharePoint application and tenant, without requiring individual user authentication.

Manual SharePoint Site Selection for App Delegation

In the current production version of SharePoint App Delegation, the application can automatically discover and display SharePoint sites that the configured tenant has access to. This simplifies content selection because users do not need to manually provide site information.

However, automatic site discovery requires the Site Discoverability permission.