Unknown Errors From Agent With SharePoint Knowledge For All Users...Except One?

Question

Unknown Errors From Agent With SharePoint Knowledge For All Users...Except One?

Chris Domino 10

Hello!

Problem Statement

We are experiencing an issue with an Azure AI Foundry Project that has an agent with a SharePoint knowledge connection. All users interacting with this agent in the playground (except folks having global privileged Azure roles) experience it throwing a generic error. I turned on logging, but don't any telemetry providing more details in app insights.

I can't untangle the permissions for the admin users from whom it works. They don't have explicit rights to the SharePoint site (but I do) and do not have any unique Foundry roles. Furthermore, the AI works for these admins even when the Custom Authentication settings (see below) are not attached to an Entra ID app, which why I believe that this is a permission issue.

User's image

Our Configuration

This is all in an active "Microsoft Sponsorship" subscription - not sure if that adds a wrinkle.
Foundry instance and project created via Azure CLI with the following permissions assigned to the project's managed identity as well as an Entra ID app registration.

User's image

SharePoint team site created at https://<tenant>.sharepoint.com/sites/<site>
PDF (of a profile/resume) uploaded to the default "Shared Documents" document library at https://<tenant>.sharepoint.com/sites/<site>/Shared%20Documents/<file>.pdf
Manually created an agent called "SharePoint-Agent" in the foundry project and created a connection to the SharePoint site with the following custom keys:
- type: sharepoint_grounding
- site_url: https://netorg14925960.sharepoint.com/sites/nexus-sharepoint-poc/Shared%20Documents [marked as secret]

Failed Attempts To Resolve

Tried many additional permissions.
Added the following keys to the authentication settings for the SharePoint connection per https://learn.microsoft.com/en-us/answers/questions/5552880/unable-to-create-a-sharepoint-connection-in-azure.
- App Id: <Entra ID app id (guid)>
- Secret: <Entra ID app registration secret> [marked as a secret]
The responder to the question linked in the previous bullet (which was indeed helpful in general) mentions, per the Foundry Project documentation, that these SharePoint site collections need to have the /Teams/ managed path, not /sites/ as is the default.
- I created https://<tenant>.sharepoint.com/teams/<site>
- Then updated the same files to this site collection's Shared Documents
- The behavior was different, but throws the same error whenever it tries to use the SharePoint knowledge connection
- It should be noted that SharePoint connections which worked for my admin users indeed used the /sites/ managed path. It then follows, would this work for the root collection (https://<tenant>.sharepoint.com with no extra pathing)?

Please let us know what we are missing here! Thanks so much!

Ravada Shivaprasad 1,965 Reputation points Microsoft External Staff Moderator

2025-09-29T23:39:45.6233333+00:00

Hello Chris Domino

The issue occurs because the SharePoint connector in Azure AI Foundry requires proper authentication and site configuration, while global admins bypass these checks due to elevated privileges. To fix this, ensure the SharePoint site uses the /teams/ managed path instead of /sites/, as the connector expects modern team sites. Update the Foundry connection with the correct site_url. Configure authentication by attaching an Entra ID app registration with Sites.Selected and Files.Read.All Microsoft Graph permissions, grant admin consent, and explicitly grant the app access to the SharePoint site using Microsoft Graph API (POST /sites/{site-id}/permissions with roles: ["read"]). If user-specific access is required, enable On-Behalf-Of (OBO) authentication in the Foundry project settings. The project’s managed identity or app registration must also have access to the site for the connector to function correctly.

Application Insights does not capture downstream SharePoint API errors, so enable Diagnostic Settings on the Foundry project and hub to send logs to Log Analytics or Storage and use Azure Monitor for dependency and token-level traces. After applying these changes, test with a non-admin user who has read access to confirm the fix. For detailed guidance, refer to SharePoint tool for Azure AI Foundry, Create Permission, and follow below Trouble shooting steps.

it's crucial to ensure you're using a modern team site. The URL must begin with /teams/, like https://microsoft.sharepoint.com/teams/your-site-name. If your site uses /sites/, it's likely a classic communication site or a different template, which the connection tool may not recognize properly—this mismatch often causes endpoint and credential issues. To fix this, create a new site using the Team Site template and use its URL in the connection tool.

Next, verify your Microsoft Entra ID app registration. The connection authenticates as an application, not a user, so you must register an app and assign it the Sites. Selected application permission for SharePoint. After adding the permission, don’t forget to grant admin consent in the Entra portal. Then, use the app’s Client ID and secret when configuring the connection in AI Foundry. Microsoft’s documentation explains this in detail: Use the Microsoft SharePoint tool (preview).

To test your setup, try accessing the SharePoint site using Graph Explorer at https://developer.microsoft.com/en-us/graph/graph-explorer. Run a simple call like https://graph.microsoft.com/v1.0/sites/root. If this fails, the issue likely extends beyond AI Foundry.

Also, check the certificate of your SharePoint site. Occasionally, custom or expired certificates can interfere with the authentication handshake. Though rare, this has resolved odd issues in the past.

If none of these steps work, it’s time to open a support ticket. Microsoft support can access backend logs and pinpoint the exact cause of the validation failure. You've already done a thorough job troubleshooting—this final step can bring clarity. These steps ensure the SharePoint knowledge connection works for all users, not just global admins.

Hope it helps!

Thank you
Ravada Shivaprasad 1,965 Reputation points Microsoft External Staff Moderator

2025-09-30T23:19:33.28+00:00

Hello Chris Domino

Do you get any chance to check above response?

Thank you
Manas Mohanty 13,340 Reputation points Moderator

2025-10-08T10:37:47.79+00:00

Hello Chris Domino

We could not hear from you. Hope you appreciated the inputs.

Temporarily closing the case. Please reply to reopen it.Thank you
Chris Domino 10 Reputation points

2025-10-14T17:59:57.8766667+00:00

Thank you so much @Ravada Shivaprasad , and @Manas Mohanty ! I set myself up to follow this question, but didn't get notifications that I was receiving responses; apologies for not following up. Let me get with my team and review your guidance ASAP! Much appreciated!

2 answers

Your answer

Ravada Shivaprasad 1,965 Reputation points Microsoft External Staff Moderator

2025-09-30T23:19:33.28+00:00

Hello Chris Domino

Do you get any chance to check above response?

Thank you
Manas Mohanty 13,340 Reputation points Moderator

2025-10-08T10:37:47.79+00:00

Hello Chris Domino

We could not hear from you. Hope you appreciated the inputs.

Temporarily closing the case. Please reply to reopen it.Thank you
Chris Domino 10 Reputation points

2025-10-14T17:59:57.8766667+00:00

Thank you so much @Ravada Shivaprasad , and @Manas Mohanty ! I set myself up to follow this question, but didn't get notifications that I was receiving responses; apologies for not following up. Let me get with my team and review your guidance ASAP! Much appreciated!

Answer 1

Chris Domino 10

Okay we got this working. @Manas Mohanty pointed us in the right direction in the above thread. In addition to the Azure roles and SharePoint permissions, here's the final set of config that got this working:

The SharePoint site needs to be modern (i.e. created under the /teams/ managed path)
You do NOT need to reference an Entra Id app in the SharePoint connection UI; just the absolute site/doc lib/folder URL marked as a secret.
The current user needs a Copilot license.

Answer 2

Manas Mohanty 13,340 Moderator

Hello Chris Domino

I am trying to grasp authentication used here along the other threads.

Wanted to let you know that we need users to have Share pointer reader on Share point and Azure AI Account user role in minimum for Azure AI foundry resource.

Attached end to end tutorial Fabric Data agent as alternate

Please help me details requested in private message for further assistance.

Thank you

Chris Domino 10 Reputation points

2025-10-17T16:34:47.2833333+00:00

hey @Manas Mohanty

okay we are getting close! i think the only thing we're missing now is the exact key/value pairs for the custom auth connection. we have site_url and need to know the key names for the entea id "app id" and "client secret" (i didn't see this in the article you posted above).

now using a modern team site under /teams/ is giving us a more specific error in foundry, so we're on the right path.

thanks again manas!
Chris Domino 10 Reputation points

2025-10-17T16:40:25.3766667+00:00

hey @Ravada Shivaprasad -

here is the new error from my post above, by the way. we are still awaiting admin consent for Files.Read.All but i wanted to try it out in the meantime just to see. thanks again for your help!

tool_user_error: Error: sharepoint_tool_forbidden_access; Authorization Failed - User does not have valid license RunId: run_1ImZJhVfwElzJoNF3OVr8ZcH
Chris Domino 10 Reputation points

2025-10-17T16:46:01.17+00:00
steps taken:

add permissions mentioned above to entra id app (already had Sites.Selected; still awaiting admin consent for Files.All.Read)

create a new modern SP site under the "/teams/" managed path

grant our entra id read access to the site via PnP PowerShell

create a new foundry knowledge connection with

site_url: absolute url to new modern site (marked as secret)

type: sharepoint_grounding (added automatically after creating the connection)

App Id (what is the correct key?): guid to entra id app

Secret (what is the correct key?): *** (marked as secret)
Manas Mohanty 13,340 Reputation points Moderator

2025-10-17T17:01:51.91+00:00

Chris Domino

Regarding below error

tool_user_error: Error: sharepoint_tool_forbidden_access; Authorization Failed - User does not have valid license RunId: run_1ImZJhVfwElzJoNF3OVr8ZcH

Developers and end users have Microsoft 365 Copilot license, as required by Microsoft 365 Copilot API.

Reference -https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/tools/sharepoint#prerequisites
Chris Domino 10 Reputation points

2025-10-20T21:11:09.23+00:00

got it - will take a look and circle back! thanks!

Share via

Unknown Errors From Agent With SharePoint Knowledge For All Users...Except One?

Problem Statement

Failed Attempts To Resolve

2 answers

Your answer