A neighborhood library wants a staff-facing question-and-answer assistant for opening hours, room-use rules, and exceptional closures. Its SharePoint site contains approved public policies as well as historical drafts and internal operations notes. Microsoft Copilot Studio can use SharePoint as an agent knowledge source and generate answers from indexed content, but a fluent reply is not proof that the correct policy was found or that the user’s permissions were respected. This hypothetical walkthrough builds a small review-first workflow for a single approved policy area. It deliberately uses fictional hours and documents rather than claiming to have configured a live library agent.
Map the approved documents before connecting anything
Create a one-page source inventory with the approved policy title, SharePoint location, effective date, approving team, and person responsible for updates. Separate current public operating rules from draft summer schedules, closed meeting notes, and staff-only access instructions. In the fictional example, the approved page lists public hours as 9 a.m. to 5 p.m., while an old draft proposes 8 a.m. to 6 p.m. The latter is useful as a deliberate test case but should not be offered to the chatbot as equally authoritative. Remove it from the scoped source collection or arrange clearly enforceable access boundaries before proceeding.
Confirm Copilot Studio and tenant permissions
Ask the Microsoft 365 administrator which environment, licensing entitlements, and security restrictions apply to this agent. Microsoft documents SharePoint knowledge connections in Copilot Studio, but specific authentication pathways differ by channel and environment. An answer generated in a maker preview is not a substitute for checking the eventual Teams or web-channel identity. In the planned workflow, the agent is for authorized staff; it should never gain broad SharePoint rights merely to answer a convenience question. Record the target channel, whether Microsoft authentication is enabled, and the account types that must be included in permission tests.
Connect a narrow SharePoint knowledge source
Open the agent in Copilot Studio. From Overview or Knowledge, choose Add knowledge, select SharePoint, and provide the approved site or folder URL. Microsoft’s SharePoint guidance explains that a registered site URL can include subpaths, not parent sites or unrelated siblings. That matters when the approved policies share a parent with confidential minutes. Start with the narrowest valid scope, give the source a precise name and description, and review available knowledge filters. Avoid connecting the top-level intranet just to save setup time. The content behind links in indexed pages is not automatically crawled as if those linked destinations had been separately registered.
Configure citations and an explicit uncertain-answer path
Tell the agent to ground policy answers in the connected approved material, provide a source pointer where supported, and say when the approved documents do not establish an answer. Microsoft notes that generative answers may include citations, but their rendering varies by channel and response customization. Do not build a rigid format instruction that strips citation markers. If an answer has no reliable supporting page, the intended response is to consult the facilities lead, not to infer a plausible holiday schedule. Keep the escalation contact in an approved document, rather than embedding an individual’s private phone number in an unrestricted prompt.
Test contradictory schedules with concrete questions
Run a small question matrix: ‘What time does the library close on Tuesday?’, ‘May volunteers use the study room after closing?’, and ‘Are we open on a specific holiday not covered by the published notice?’ For the illustrated scenario, an answer that repeats 8–6 from the draft is a failure; an answer that cites the approved 9–5 page is a candidate for review. Check the citation target, effective date, and exact language. A correct number without a correct source does not establish trustworthiness. Record unanswered questions as gaps in the source set or agent behavior, rather than silently broadening its general-knowledge permissions.
Verify role-based access with two identities
Have an authorized administrator test the agent with appropriately provisioned staff and restricted test identities. Microsoft states that the SharePoint connection can query according to the signed-in user’s permissions; the knowledge source should not elevate their effective access. Ask the restricted tester about an internal closure memo and verify that no confidential details are returned. Use synthetic or explicitly approved test records, not actual personal data. Authentication and source-sharing settings both matter, especially when an agent is later published outside its original preview channel. A successful maker test is insufficient evidence of role isolation in deployment.
Check retrieval gaps instead of fabricating a policy
A missing answer may result from a document format, indexing delay, scope, identity, or configuration problem. Inspect the documented SharePoint-source requirements and the agent’s knowledge and web-search settings before editing content. If general web search is enabled, an answer may be relevant but not authoritative for this particular library. For a controlled policy assistant, distinguish current local policy from broad external suggestions. A test question about an unannounced storm closure should produce an explicit unknown, a link to the public notice page, and the prescribed contact process—not a generated assurance that the library will remain open.
Review the release copy with a policy owner
Prepare a short proof sheet: tested question, proposed answer, linked source, approval owner, source effective date, and observed issue. Ask the library operations lead to verify that approved hours, room rules, and emergency contact wording match the source. Review that an out-of-scope question produces the agreed fallback. Do not publish or promote the assistant until the owner has verified the exact channel and permission behavior, not merely its friendly tone. This example does not claim that any real library approved an agent, and the diagrams depict decision paths rather than screens captured from Microsoft services.
Maintain the agent after policy revisions
Assign a person to check the knowledge collection when published hours change, a holiday notice is issued, or a SharePoint page is archived. Update the source inventory and rerun the question matrix. Preserve the old test answers for comparison without retaining confidential conversation logs longer than policy permits. A newly edited document can make a previous answer stale even if its wording looks credible. Put an owner and next-review date on the agent itself. Copilot Studio can reduce navigation work, but the library remains responsible for authoritative information, privacy, and timely corrections.
How We Research
We reviewed these named official developer resources: Microsoft Learn — Add SharePoint as a knowledge source; Microsoft Learn — Choose knowledge sources for agents; Microsoft Learn — Knowledge sources summary and citations. We checked the documented feature entry points, eligible platforms, administrator or licensing controls, and known sharing or source limitations against the tutorial steps. Editorial examples were designed as hypothetical failure-mode checks, not reports of hands-on testing. We did not have a live account, source files from a museum or nonprofit, user interviews, access to private records, or measured model outputs. Every illustration is original explanatory artwork rather than a vendor screenshot or measured before/after result. Features and entitlements can change. A responsible editor should confirm current product documentation, applicable organizational policy, and the original evidence before putting the workflow into consequential use.
Frequently Asked Questions
No. Scope and the chatting user’s permissions matter. Microsoft describes searching the registered site or folder and subpaths rather than unrelated parent or sibling sites.
No. Authentication and guest limitations vary by channel. Use test identities and the current Microsoft configuration guidance before making it available.
The answer should explicitly say the approved sources do not establish holiday hours and direct the visitor or staff member to the designated update channel.
No. A citation is a starting point. Inspect the linked effective document, confirm it supports the exact statement, and check that the page is approved.
Prefer an approved and tightly scoped source set. If drafts are retained for records, establish strong access and filtering boundaries and test contradictions before release.