Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

SharePoint Configuration

The SharePoint integration in our application is designed to authenticate users and retrieve SharePoint content for processing (read-only access). The app does not modify SharePoint content or manage tenant configurations.

Required Permissions

Permission

Type

Purpose & Usage

User.Read

Delegated

Required for OAuth authentication to identify the signed-in user.

Sites.Read.All

Delegated

Allows read-only access to SharePoint sites for discovering sites, libraries, and content.

Files.Read.All

Delegated

Enables reading SharePoint files to retrieve documents for processing and generating embeddings.

GroupMember.Read.All

Delegated

Required only if specificAccessControl is enabled; used to check SharePoint group memberships and enforce access control.

Not Required Permissions

Permission

Reason

Directory.Read.All (Delegated & Application)

Full directory access is not needed; we only require user-level info.

Group.Read.All (Delegated & Application)

Reading all Microsoft 365 groups is unnecessary; access control uses GroupMember.Read.All only.

Sites.FullControl.All (Delegated)

App does not modify SharePoint sites or content.

Sites.Manage.All (Delegated)

App does not manage site settings or configuration.

GroupMember.Read.All (Application)

The integration operates in delegated user context

Key Notes

  • The frontend only requests openid profile email offline_access for authentication.

Callback:

Production:

  • US instance: https://us.knowledge.ixhello.com/connectors/oauth/callback

  • EU instance: https://eu.knowledge.ixhello.com/connectors/oauth/callback

Development / Pre-production (add these to the same Azure AD App Registration):

  • https://kbot-dev.concentrix.com/connectors/oauth/callback

  • https://kbot-preprod.concentrix.com/connectors/oauth/callback

  • https://kbot-dev.concentrix.com/

  • https://kbot-preprod.concentrix.com/

⚠️ Important: The dev/preprod redirect URIs above must be added to the client's production Azure AD App Registration — the same one that contains the production redirect URIs. This allows our dev/preprod environments to authenticate against the client's SharePoint tenant for debugging and troubleshooting purposes. Access remains fully controlled by environment-specific credentials (client ID + secret), so adding these URIs does not grant any unauthorized access.

Pre-requisites

  1. An active SharePoint Account

User should have an active Microsoft SharePoint Account. If user does not have an active account, the user can create one at: https://signup.live.com/signup

  1. At least one App Registration

Open your Azure account. If user does not have any App Registration, it can be created by:

a. Enter App Registrations in the Search field at the top of the Azure page.

b. Select the App Registrations icon

c. Click on New Registration button

d. Enter a Name and select Accounts in this organizational directory only. Press Register.

Application (Client) ID, Tenant ID, Client Secret, Permissions & Authentication

  1. To be able to connect to SharePoint from the iX Hello platform, one application registration is required, and the user should have permissions to view and execute SharePoint functions. Once the application registration is successful, you can copy the information as described in the steps below:

  2. User will need to visit the newly created application and note the following information as highlighted with red marker. The Application ID and Tenant ID can be found inside the red contour.

  1. On the left navigation menu, click Certificates & Secrets. Click on New client secret:

  1. A popup will appear. Fill-in the necessary information as shown and press Next:

  1. App expiration can be customized as shown below:

  1. After user clicks Add, the application secret will appear as shown below. Copy the value and store it in a safe location. This information can only be seen once. If this value is lost, it will be necessary to create a new secret.

  1. User should now have Client ID, Tenant ID, and Client Secret.

  2. User will now need to create App permission. On left navigation menu, click API permissions, then click Add a permission.

  1. For SharePoint permissions, the user will need to have the following delegated permissions:

Sites.ReadWrite.All

offline_access

To obtain these permissions, do the following:

  • Click Add a permission

  • Click Microsoft Graph option at top

  • Click Delegated permissions

  1. The user will then be able to see the list of permissions that are offered to registered application. Find the permissions stated above and check them. Finally click on Add permissions button to complete the permission as shown in picture below

  1. For authentication, the user has to provide redirect URL. This is where SharePoint will redirect after authentication is complete. To setup the redirect URL, click Authentication on the left navigation menu and then click Add a platform on the body and then select Web. Follow the subsequent screenshots as shown below:

  1. Add the Redirect URL under the Configure Web portion. Enter the value https://bots.ixHello.com/OAuthCode/Redirect and press Configure

  1. Once the platform is added, user should see redirect URIs as below:

  1. You have now successfully configured App on Azure. Follow the steps below to connect KBOT with SharePoint

Setup connection to SharePoint in KBOT

  1. Login to the iX Hello KBOT portal at

  2. Once clicked on the link you will be navigated to the KBOT home page.

  3. As an administrator, you can configure external data sources such as Confluence, SharePoint, and Salesforce for content ingestion. When a new application is created, these integrations are typically not configured by default. To enable data ingestion from these platforms, the required connection details must be added through the Configure Data Sources page.

  1. Navigate to Configure Data Source Menu and click on "Add Configuration" button.

Once clicked, you will see the Add Configuration pop-up is open, allowing an administrator to add a new data source connection.

The selected Data Source Type is SharePoint.

The configuration requires the following information:

Field
Description

Data Source Type

Select the platform to connect, such as Confluence, SharePoint, or Salesforce.

Base URL

The URL of the SharePoint site to be connected.

Client ID

The Application (Client) ID generated from Azure/Entra ID.

Tenant ID

The Azure/Entra tenant identifier associated with the organization.

Client Secret

The secret key used to authenticate and authorize access to SharePoint.

Available Actions

  • Save – Stores the configuration and establishes the connection.

  • Cancel – Closes the dialog without saving changes.

Once clicked on save you will see the SharePoint Configuration added to the list in the configuration data source.

Navigate to the Knowledge Bots menu and click on the upload button, you will see the list of Data sources and choose SharePoint.

Paste the SharePoint URL to which you have access to and click on 'Get Data'

After entering a SharePoint URL that the administrator has access to, selecting Get Data initiates a connection process between the platform and the SharePoint site. Once the connection is successfully established, the platform retrieves the available files and folders from the specified location.

The retrieved content is displayed in a hierarchical folder structure, mirroring the organization of folders and subfolders within SharePoint. Similar to Windows File Explorer, folders can contain nested folders, creating parent-child relationships that make it easier to navigate and manage the content being ingested.

Administrators can:

  • Select all retrieved content for ingestion.

  • Deselect specific files or folders that should not be included.

  • Review the folder hierarchy before proceeding with ingestion.

Data available/pulled from SharePoint:

Enforce Access Control

The Enforce Access Control option ensures that users can only access information from content repositories for which they already have permissions.

For example:

  • An administrator may have permission to access and ingest content from a particular SharePoint site.

  • The content can be successfully indexed because the administrator has the necessary access rights.

  • However, users who do not have access to that SharePoint site will not receive responses based on the restricted content, even though it has been ingested into the platform.

  • Only users with the appropriate permissions to the original SharePoint location will be able to retrieve answers derived from that content.

This feature helps maintain existing security and permission boundaries while enabling knowledge retrieval across connected data sources.

Advanced Settings for Data Source Ingestion

The Data Masking functionality works consistently across all supported data source types. The same data masking rules configured at the Knowledge Bot (K-Bot) level are applied during content ingestion, helping ensure that sensitive information is protected before it becomes available for retrieval.

Web Scraping Recurrence

For supported data sources such as URLs, SharePoint, Salesforce, and Confluence, administrators can configure a Web Scraping Recurrence schedule.

This feature allows the platform to automatically re-scan and re-ingest content at predefined intervals, such as:

  • Daily

  • Every 2 days

  • Every 4 days

  • Custom recurrence schedules

Automatic re-scraping ensures that any updates made to documents, pages, or records in the source system are reflected in the platform without requiring manual intervention. When new information is added or existing content is modified, the latest version is automatically retrieved and incorporated into the knowledge base during the next scheduled ingestion cycle.

This helps keep the knowledge repository up to date and ensures users receive responses based on the most current information available.

Chunking Configuration

For SharePoint content ingestion, administrators can configure word-based chunking settings.

Chunking is the process of splitting large documents into smaller sections before they are indexed and processed by the AI model. Administrators can define:

  • The maximum number of words per chunk.

  • How content should be divided for indexing and retrieval.

Proper chunk sizing can improve search accuracy and contextual understanding by ensuring information is broken into manageable and meaningful segments.

Chunk Overlap

The Chunk Overlap setting determines how much content is shared between consecutive chunks.

For example:

  • If a chunk contains 200 words and the overlap is set to 10 words, the last 10 words of the first chunk will also appear at the beginning of the next chunk.

This overlap helps preserve context across chunk boundaries and can improve retrieval quality by ensuring important information is not lost when content is divided into multiple segments. As a result, the AI model is often better able to understand relationships between adjacent sections of a document and generate more accurate responses.

Last updated

Was this helpful?