Index-Time ACLs or Live Checks: A One-Folder Test for SharePoint AI Assistants

Every assistant that answers from SharePoint works from an index: a copy of your documents, split into passages. What matters for access control is whether that index also stores who may see each passage.

Design 1: the permission list lives in the index

Azure AI Search has a SharePoint indexer with permission metadata ingestion, a preview feature of Azure AI Search, not of Microsoft Copilot. During ingestion the indexer "computes the effective ACL for each file" and "stores the permissions as metadata on each indexed document". At query time the engine matches the asking person against that stored list.

That list is a snapshot. Microsoft documents what refreshes it:

• Unique permissions: "Starting in the 2026-05-01-preview REST API, ACL changes for items with unique permissions are detected and refreshed on each successful indexer run."
• Group membership: Microsoft Entra group memberships and SharePoint site groups are resolved at query time, so removing someone from a group does not wait for an indexer run.
• Inheritance: "Parent-scope permission changes aren't picked up automatically on subsequent indexer runs." A change on a site, library, list or folder waits for a resync, a document reset or an edit to the file itself.

Inheritance is the SharePoint default; removing a person from a library is a parent-scope change. Microsoft's warning is literal: "If you change SharePoint permissions without triggering an update mechanism, the index serves stale ACL data for previously ingested files."

Design 2: no permission list in the index

The other design stores nothing about access: after ranking, the tool asks Microsoft 365, for each candidate document, whether this person may open it now.

The call runs as the person. In the OAuth 2.0 on-behalf-of flow "the intent is to pass a user's identity and permissions through the request chain", and in delegated access "the application can't access anything the signed-in user couldn't access".

There is no copy to refresh; the costs move to question time:

• Time. Every question adds Microsoft Graph calls, so the check has to be limited to the documents that can reach the answer, and bounded.
• Failure. If Graph is slow or returns an error, a strict design leaves that document out, possibly the one that mattered most.

Azure AI Search also fails closed, for the whole query: "If ACL evaluation fails (for example, the Graph API is unavailable), the service returns 5xx and does not return a partially filtered result set."

Neither design repairs permissions that are too wide: Microsoft's deployment guidance for Microsoft Copilot starts with "remediating oversharing".

The test: one person, one folder

An afternoon's work, plus indexing time, and no vendor needed:

1. In an indexed library, create a test folder. Grant permission on it directly, by name, to a test person with no other access to that site: no group, no single-file share.
2. Add one document that answers a specific question, for example a fictional payment term. After the next indexing run, ask as that person and confirm the document appears in the answer or its sources.
3. Remove the person's permission on the folder itself, without editing the file: only what the file inherits changes, the parent-scope case.
4. Wait for the next indexing run, or longer than your vendor's stated refresh interval.
5. Once SharePoint refuses the person the file, ask again as that person, in a new chat.

If the document still appears, the assistant is most likely serving a stored permission list that nobody refreshed. If it is gone, note how long that took and whether anyone had to run anything.

Removing the person from a group tests a different path: Azure AI Search resolves group membership at query time.

Kaspars Jurjāns has worked with SharePoint since 2006 and builds Answergrove, an assistant that uses the second design. The Microsoft sources and what remains unknown are in the full article: What Happens to AI Answers When SharePoint Permissions Change After Indexing?. The live check is described at Answergrove.