Unable to use SharePoint Tool

Question

I am having difficulty verifying whether the SharePoint tool has the required permissions to access the SharePoint site. I understand that the SharePoint tool requires user identity authentication (identity passthrough) and that application-only authentication is not supported, which can result in authentication failures.

However, I have not been able to find a way to validate this within either the new Azure AI Foundry experience or the classic experience.

I have verified the following:

• The user account being used has a valid Microsoft 365 Copilot license.
• The SharePoint site and the Azure AI Foundry project are in the same tenant.
• The account being used is my own account and has access to the SharePoint sites and documents. The account is also a SharePoint Global Administrator.
• The agent works successfully when the SharePoint tool is removed or disabled.
• I tested with both Claude models and GPT models, and both produce the same error when the SharePoint tool is enabled.

When I navigate to Azure AI Foundry and open the SharePoint tool configuration, I only see the tool name, project connection ID, and SharePoint site URL. I do not see any option to validate permissions, review the authentication method being used, verify OBO/identity passthrough configuration, or confirm whether the tool can successfully access the SharePoint site.

Because of this, I am unable to determine whether the issue is related to permissions, authentication, or the SharePoint grounding preview service itself.

Is there another way to verify that the SharePoint tool has access to the configured SharePoint site? Specifically:

• Is there a method to validate that identity passthrough/OBO authentication is functioning correctly?
• Is there a location where the SharePoint tool's effective Graph or SharePoint permissions can be reviewed?
• Are there diagnostic logs available that show whether the SharePoint tool can successfully authenticate and retrieve content from the site?

Any guidance would be greatly appreciated, as I am currently unable to find any additional permission or authentication details within Azure AI Foundry.

Thank you very much for your assistance.

Answer 1

Hello @Zyrka Admin

Based on the information you've provided, you've already validated the most common prerequisites (Copilot license, same tenant, site access, and behavior with/without the SharePoint tool). Unfortunately, the current SharePoint grounding experience in Azure AI Foundry provides very limited visibility into authentication and authorization internals.

A few points that may help narrow down the issue:

• There is currently no built-in validation button in the SharePoint tool configuration to test identity passthrough/OBO authentication directly.
• The tool does not expose the effective Microsoft Graph or SharePoint permissions being used for a specific request.
• Detailed authentication traces for SharePoint grounding are generally not surfaced in the Azure AI Foundry UI, making it difficult to distinguish between permission, authentication, and service-side issues.

Since the same agent functions correctly when the SharePoint tool is disabled and you've confirmed direct user access to the target site, this may indicate either:

• A problem with the identity passthrough flow between the agent and SharePoint,
• A limitation or issue within the SharePoint grounding preview service,
• Or a tenant/configuration-related issue that is not exposed through the current diagnostics experience.

To help investigate further, could you provide:

• The exact error message returned when the SharePoint tool is enabled?
• Whether the failure occurs during agent creation, testing, or only when querying SharePoint content?
• Any correlation/request IDs visible in Azure AI Foundry or browser developer tools?

Those details may help determine whether this is an authentication problem, a content retrieval issue, or a service-side defect that requires Microsoft support involvement.

Thanks.

Answer 2

I think you can check Entra sign‑in logs for Azure OpenAI Service → SharePoint Online OBO and “token issued” shows the tool authenticated or no entry means it didn’t and re‑saving the SharePoint tool config lets u run the same check again.

Answer 3

Hello @Zyrka Admin

Based on your description, you've already ruled out the most common configuration issues (same tenant, user has access to the SharePoint site, Microsoft 365 Copilot license assigned, and the issue only occurs when the SharePoint tool is enabled).

One important point is that the SharePoint tool in Azure AI Foundry uses delegated user authentication (identity passthrough/OBO) rather than application-only permissions. Currently, Azure AI Foundry does not expose a built-in interface to validate the effective delegated permissions, inspect the OBO token, or perform a "Test Connection" against the configured SharePoint site.

To narrow down the issue, I recommend checking the following:

• Microsoft Entra ID sign-in logs to determine whether the delegated authentication request is succeeding or failing. The logs may indicate whether the OBO flow completed successfully or whether token issuance was blocked.
• Azure AI Foundry project diagnostics and activity logs for any authentication or tool invocation failures.
• Whether the configured SharePoint URL is supported by the SharePoint grounding tool (for example, using the site root rather than a document or library URL).
• Whether Conditional Access, authentication context, or tenant policies are preventing delegated access even though the user can access the site interactively.

Unfortunately, there isn't currently a location in Azure AI Foundry that displays:

• The effective Microsoft Graph or SharePoint permissions granted to the SharePoint tool.
• The delegated access token used during tool execution.
• A built-in authentication or connectivity test for the SharePoint tool.

If no authentication failures appear in the Entra sign-in logs and the agent consistently fails only when the SharePoint tool is enabled, this may indicate a limitation or issue with the SharePoint grounding service itself rather than a permission problem.

At this point, I'd recommend that a Microsoft moderator confirm:

• Whether there is a supported method to validate the SharePoint tool's delegated/OBO authentication.
• Whether diagnostic logging is available for SharePoint tool authentication and content retrieval.
• Whether there are any known issues affecting the SharePoint grounding tool in Azure AI Foundry.
• Whether additional diagnostic logging can be enabled to identify the exact authentication or authorization failure.

Hopefully, a Microsoft moderator or the Azure AI Foundry product team can clarify whether there is a supported way to inspect the SharePoint tool's effective delegated permissions or enable more detailed authentication diagnostics.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.