Skip to main content

​
Introduction

When your Guru runs inside SharePoint, the page itself can tell Gurubase who the visitor is. A page can claim anything, so those claims are never trusted for access decisions. This integration closes that gap. The SharePoint page obtains a token signed by Microsoft Entra ID, Gurubase verifies it server side, and the identity in that token replaces whatever the page said. The group memberships inside the verified token then decide which data sources the answer may draw on.
The Entra ID application this uses belongs to you, in your own tenant. Gurubase never holds credentials for your directory, and the token itself is never stored: it is verified, read, and discarded within the request.

​
What you need

  • A Microsoft 365 tenant with SharePoint Online.
  • Permission to create an app registration in Microsoft Entra ID.
  • Permission to upload a package to your tenant App Catalog, or someone who can.
No Microsoft Graph permissions and no admin consent are required. The token is issued to your own application, and Gurubase only reads it.

​
Setup

1

Register an application in Microsoft Entra ID

In the Entra admin center, go to Applications → App registrations → New registration. Name it something recognisable, for example Gurubase Ask AI, and register it.On the app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID.Then open Expose an API and set an Application ID URI. Accepting the default api://<client-id> is fine. Add a scope named user_impersonation so SharePoint can request a token on the user’s behalf.Finally, open Token configuration and add the groups claim, choosing Security groups. Without this the token carries no group memberships and every verified user falls back to sources visible to everyone.
2

Connect it in Gurubase

Open your guru, go to Integrations → Identity → SharePoint (Entra ID) and fill in:
  • Directory (tenant) ID — from the previous step. Only tokens issued by this directory are accepted.
  • Application ID URI — either the bare client ID or the full api:// form; both are accepted.
Leave Require verified identity off for now. See Enforcement below for when to turn it on.Click Connect.
3

Install the SharePoint package

The integration page has a download link for the Gurubase SharePoint package (.sppkg). Upload it to your tenant App Catalog and approve it for the whole tenant when prompted.The package contains two components. The Application Customizer puts the assistant on every page in the tenant. The web part, listed as Gurubase Ask AI when you add a web part to a page, places it on one page only.
4

Point the package at your application

In the package configuration, set the identity resource to the same Application ID URI you entered in Gurubase. SharePoint then issues a token for that application on each page load and hands it to the assistant.

​
Mapping directory groups to content groups

A verified token carries the user’s Entra ID security group IDs. To act on them, tell Gurubase which of your content groups each directory group corresponds to. Open Team → Groups, edit a group, and paste the directory group’s object ID into Directory group IDs, one per line. A group can map to several directory groups. Once mapped, a user whose verified token carries that directory group joins the content group for the duration of their request, and sees every data source scoped to it. See Groups & Content Access Control for how source visibility works. Anything not mapped is ignored: unknown IDs, IDs belonging to another guru’s groups, and tokens with no group claim all fall back to sources visible to everyone. Access is never widened by a value Gurubase does not recognise.
Entra ID replaces the groups claim with a pointer when a user belongs to more groups than fit in a token. Gurubase treats that case as “no groups” and logs a warning rather than guessing. If your users are in very many groups, use a group filter in the app’s token configuration so only the relevant groups are emitted.

​
Enforcement

Require verified identity decides what happens to a request that arrives without a valid token. Leave it off while the SharePoint package is still reaching people. Turning it on before everyone has it makes the assistant look broken for anyone who is missing it. Turn it on once rollout is complete and you want the assistant to answer only people the directory can vouch for.
Disconnecting the integration stops all verification. Every request then falls back to sources visible to everyone, including requests that would previously have been rejected. Gurubase asks for confirmation before disconnecting for exactly this reason.

​
What gets verified

For every token, Gurubase checks that:
  • the signature matches Microsoft’s published signing keys for the tenant,
  • the tenant matches the Directory (tenant) ID on the integration,
  • the audience matches the Application ID URI on the integration,
  • the issuer belongs to that same tenant,
  • the token has not expired.
A token that fails any of these is treated as absent, not as an identity. Failures are logged without the token value.