SharePoint Integration Overview
This document explains how the Procurement Sciences platform integrates with Microsoft SharePoint, covering how users authenticate, what data permissions are requested, how synced data is stored and protected, and how access to synced content is controlled inside the platform (see Section 5).
Please note: The team is actively working on improvements to how SharePoint changes are reflected in the platform. Until that work is complete, the daily sync has the following known limitations:
File moves and renames produce a duplicate. When a file is moved or renamed in SharePoint, the platform syncs the file at its new location but does not remove the previous copy. Both versions will appear in search, chat, and downloads until the original is manually removed.
File deletions are not detected. When a file is deleted in SharePoint, the corresponding content remains stored in the platform indefinitely and continues to appear in search and chat results.
Folder deletions are not detected. When a folder is deleted in SharePoint, the platform retains all of the files that were inside it, treating them as if no change had occurred.
Folder renames are not detected. Folders retain their original names in the platform after being renamed in SharePoint.
In-document changes are reflected once per day. Updates to the contents of a synced document are picked up on the next scheduled sync (see Section 4 for timing).
1. How Authentication Works
The Procurement Sciences platform connects to SharePoint using OAuth 2.0 with OpenID Connect (OIDC), authenticated through Microsoft Entra ID (formerly Azure Active Directory). This is the same industry-standard authentication framework used across enterprise Microsoft products.
When a user clicks "Connect SharePoint", they are redirected to a Microsoft Entra ID consent screen, where they authorize the application to access their SharePoint data. No user credentials are ever stored or handled by Procurement Sciences. Access is managed entirely through short-lived tokens issued by Microsoft.
Why this is secure:
Access tokens are scoped to specific permissions only. No broad or unnecessary access.
Microsoft Entra ID enforces multi-factor authentication (MFA) and conditional access policies.
Credentials are validated by Microsoft's identity platform, not by Procurement Sciences directly.
2. App Registration: Two Hosting Options
To complete the OAuth setup, an App Registration must exist in Microsoft Entra ID. This registration holds the client credentials and defines what permissions the application can request. Customers choose between two hosting options:
Option A: PSci-Managed (Default)
Procurement Sciences (PSci) hosts and manages the App Registration on the customer's behalf.
PSci handles the client ID, client secret, and API permission configuration.
The customer (or their admin) simply reviews and grants consent through the Microsoft Entra ID portal.
Admin consent may be required if the organization restricts individual user consent. An administrator can grant tenant-wide consent in one step.
Best for: Organizations that want a quick setup without managing their own Entra ID configurations.
Option B: Customer-Managed
The customer hosts and manages their own App Registration within their Entra ID tenant.
Full control over the App Registration’s credentials, API permissions, and Entra access policies.
Enables you to enforce your internal security and regulatory requirements on what the platform is permitted to read from SharePoint.
No dependency on PSci for credential or permission management.
Best for: Organizations with strict security policies or compliance requirements that mandate internal control over OAuth configurations.
Note: These controls govern only what the platform is authorized to read from SharePoint. They do not carry your SharePoint or Entra permissions into the platform. Once content is synced, who can see it inside the platform is governed by the platform’s sharing model and IAM (Section 5) not by SharePoint permissions.
3. SharePoint Permissions
Default Permission Scope
By default, the platform requests the following Microsoft Graph API permissions:
Permission | Purpose |
openid, offline_access | Standard authentication and session management |
User.Read | Read basic user profile information |
Sites.Read.All | Read-only access to all SharePoint sites in the tenant |
Restricting Access to Specific Sites
Organizations that need tighter control can use the Sites.Selected permission instead of Sites.Read.All. This limits access to only the SharePoint sites explicitly approved by an administrator. This controls the source scope only, which SharePoint sites the platform is able to read, and does not control who can see that content inside the platform. Content synced from an approved site remains subject to the platform’s own sharing model (see Section 5).
To request this:
PSci-managed: Submit a request to PSci with the SharePoint Site IDs (UUID format) you want to grant access to. PSci will update the configuration accordingly.
Customer-managed: Update the permissions directly in your Entra ID tenant.
4. Data Sync and Storage
How Data Sync Works
Once authenticated, users can browse their permitted SharePoint sites and select specific files and folders to sync into the Procurement Sciences platform. During sync, file data and metadata are copied from SharePoint into a hosted storage environment.
Sync timing
Initial sync: When a user selects a file or folder, it is queued for sync immediately.
Recurring sync: A scheduled sync runs once per day at 00:00 UTC. During this run, every tracked file is checked against SharePoint and any files whose contents have changed (detected via ETag comparison) are re-downloaded.
Staleness: Because changes are picked up only on the daily run, in-document edits made in SharePoint may take up to ~24 hours to appear in the platform.
Real-time notifications: The platform does not currently subscribe to SharePoint change notifications, so structural changes (moves, renames, deletes) behave as described in the note at the top of this document.
Each customer's data is fully isolated -- stored in a dedicated database and Kubernetes namespace that is not shared with other customers.
What Sync Does Not Cover
A small number of files may be intentionally skipped during sync and shown with a Cancelled status:
Files exceeding the configured size limit (this is a platform-level threshold; contact PSci if you need it raised for a specific use case).
Files in unsupported formats that the platform's storage layer cannot accept.
Cancelled indicates a deliberate skip rather than a transient error; affected files will not be retried automatically.
Storage Infrastructure
Synced data is stored on a Kubernetes-hosted platform backed by Azure Disk (using Persistent Volume Claims). Azure Disk provides a 99.9% availability SLA across Standard HDD, Standard SSD, and Premium SSD tiers.
Security and Encryption
All customer databases are encrypted with AES-256 and are FIPS 140-2 compliant.
Procurement Sciences does not use customer data to train or fine-tune any AI or language models.
5. How Access Is Controlled Inside the Platform
Access to content inside the Procurement Sciences platform is governed by the platform’s own sharing model and identity and access management (IAM), not by your SharePoint or Microsoft Entra permissions. The platform does not mirror SharePoint permissions, and there are no granular, per-user access controls once an integration is shared.
Private vs. Shared integrations
Private integration: Can be created by any user, regardless of role. Synced content stays visible only to the user who created it, as long as it is not shared in the Files Management dashboard.
Shared integration: Can be created only by an Admin or Super Admin. Synced content is exposed to everyone in the division / platform.
Sharing is one-way
Once an integration is shared, it cannot be scoped back to a smaller group. To restrict access again, the user must delete the integration and re-create it as private (or upload the content manually to a private space).
The platform will not warn you when content shared in the platform conflicts with the underlying SharePoint permissions. It is possible to expose content more broadly in the platform than it is shared in SharePoint.
6. Data Control and Retention
Customers retain full control over their synced data at all times:
Deleting data: Files and folders synced from SharePoint can be removed from the platform at any time by the customer.
License expiration or offboarding: When a license expires or a decommissioning request is made, all customer databases and storage environments are scheduled for deletion. Immediate deletion can also be arranged upon request.
Audit logs: A minimal set of audit logs may be retained after deletion solely for compliance purposes.
7. Operational Notes
A few additional behaviors that may be useful when troubleshooting
Connection health: OAuth refresh tokens can be revoked outside of the platform (for example, by a SharePoint admin or an MFA policy change). When this happens, the connection will stop syncing silently. If syncs appear to have stopped, reconnecting the integration in the platform will restore access.
Sync status meaning: A status of Synced indicates the file matched SharePoint as of the most recent sync run. It does not guarantee that the file is currently identical to SharePoint, since changes made between runs are not yet reflected.