What breaks when one AI assistant meets 865 SharePoint project sites

I have worked with SharePoint since 2006. The environment I run today holds 865 SharePoint sites and about 400,000 documents in four languages, and the private AI assistant there went live in about eight working days.

The hard part was permissions, not the model. Here are four engineering lessons from that rollout and one check you can run in your own tenant.

1. Inheritance breaks one folder at a time

SharePoint permissions flow downward by default. Microsoft Support explains that, by default, content in a site collection inherits its permission settings from the site directly above it.

A project team breaks that inheritance the moment a folder is shared with one subcontractor. From then on that folder carries its own permissions.

Multiply that by several hundred projects over several years and nobody can say from memory who may open what.

2. The assistant answers correctly from the wrong documents

Microsoft's deployment guidance for Microsoft Copilot describes the assistant as "grounding responses in the data users already have permission to access". The same logic applies to any assistant you place alongside it.

If the permissions are wrong, the assistant answers correctly from the wrong documents.

In the environment I run, permissions are therefore checked before the answer. A person gets answers only from documents they may open.

3. A delta indexer can lose documents and report nothing

Between 24 August and 2 September 2026, about 30 documents and about 20 deletions never reached the index. Index cycles took 20 to 87 minutes, and one cycle hit the job timeout of 5,400 seconds.

Any indexer built on Microsoft Graph delta can make the same mistake. Microsoft documents the change feed as follows:

"Deleted items are returned with the deleted facet. Items with this property set should be removed from your local state."

"After you have finished receiving all the changes, you may apply them to your local state."

If an indexer stores the new deltaLink before it has actually processed every item, a file that failed for an infrastructure reason is simply gone from the feed. Nothing reports it.

What changed afterwards is a design rule, not a patch. A failed file no longer disappears silently; it goes on a list with its reason, and the change feed does not move forward when the failure is in the infrastructure.

4. Languages are configuration

Construction in the Nordics and Baltics is multilingual: the contract may be in one language, the site diary in another, and the HSE plan in a third. In this environment the assistant is configured for four languages.

Test it with real project files from your own tenant rather than assuming it.

The check: site permissions report

The tool is the site permissions report in SharePoint Advanced Management. Microsoft lists it as available when "At least one user in your organization is assigned a Microsoft Copilot license", or with the SharePoint Advanced Management Plan 1 add-on.

1. Sign in to the SharePoint admin center as SharePoint administrator.
2. Expand Reports and select Data access governance.
3. Under "Site permissions across your organization" select View reports, then Create report.

Microsoft states that "The first report takes up to 5 days to complete, regardless of your organization's size", that "Subsequent reports complete within 24 hours", and that "You can run reports again every 30 days".

Download the CSV. The column "Items with unique permissions count" is described as "Extent of broken inheritance", and "Number of users having access" gives the unique users per site. Sort by both and you have the project sites to review first.

If you have neither licence, Active sites in the SharePoint admin center shows site-level membership per site under the Membership tab, but not item-level unique permissions.

The report counts. It does not tell you whether a given permission is wrong. That judgement still needs a person who knows the projects.

The full account, with all Microsoft sources and the limits of what I know, is in AI for Construction Firms on Microsoft 365: What 865 SharePoint Sites Taught Me About Rolling It Out.

Drafted with AI assistance, checked against the cited Microsoft sources and approved by Kaspars Jurjāns.