> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gurubase.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SharePoint (Entra ID)

> Verify who is asking with a signed Microsoft Entra ID token, and scope documents to their directory groups

## Introduction

When your Guru runs inside SharePoint, the page itself can tell Gurubase who the visitor
is. A page can claim anything, so those claims are never trusted for access decisions.

This integration closes that gap. The SharePoint page obtains a token signed by Microsoft
Entra ID, Gurubase verifies it server side, and the identity in that token **replaces**
whatever the page said. The group memberships inside the verified token then decide which
data sources the answer may draw on.

<Note>
  The Entra ID application this uses belongs to **you**, in your own tenant. Gurubase never
  holds credentials for your directory, and the token itself is never stored: it is
  verified, read, and discarded within the request.
</Note>

***

## What you need

* A Microsoft 365 tenant with SharePoint Online.
* Permission to create an app registration in Microsoft Entra ID.
* Permission to upload a package to your tenant App Catalog, or someone who can.

No Microsoft Graph permissions and no admin consent are required. The token is issued to
your own application, and Gurubase only reads it.

***

## Setup

<Steps>
  <Step title="Register an application in Microsoft Entra ID">
    In the [Entra admin center](https://entra.microsoft.com), go to **Applications → App
    registrations → New registration**. Name it something recognisable, for example
    `Gurubase Ask AI`, and register it.

    On the app's **Overview** page, copy the **Directory (tenant) ID** and the **Application
    (client) ID**.

    Then open **Expose an API** and set an **Application ID URI**. Accepting the default
    `api://<client-id>` is fine. Add a scope named `user_impersonation` so SharePoint can
    request a token on the user's behalf.

    Finally, open **Token configuration** and add the **groups** claim, choosing **Security
    groups**. Without this the token carries no group memberships and every verified user
    falls back to sources visible to everyone.
  </Step>

  <Step title="Connect it in Gurubase">
    Open your guru, go to **Integrations → Identity → SharePoint (Entra ID)** and fill in:

    * **Directory (tenant) ID** — from the previous step. Only tokens issued by this directory
      are accepted.
    * **Application ID URI** — either the bare client ID or the full `api://` form; both are
      accepted.

    Leave **Require verified identity** off for now. See
    [Enforcement](#enforcement) below for when to turn it on.

    Click **Connect**.
  </Step>

  <Step title="Install the SharePoint package">
    The integration page has a download link for the Gurubase SharePoint package
    (`.sppkg`). Upload it to your tenant **App Catalog** and approve it for the whole tenant
    when prompted.

    The package contains two components. The **Application Customizer** puts the assistant on
    every page in the tenant. The **web part**, listed as **Gurubase Ask AI** when you add a
    web part to a page, places it on one page only.
  </Step>

  <Step title="Point the package at your application">
    In the package configuration, set the identity resource to the same **Application ID URI**
    you entered in Gurubase. SharePoint then issues a token for that application on each page
    load and hands it to the assistant.
  </Step>
</Steps>

***

## Mapping directory groups to content groups

A verified token carries the user's Entra ID security group IDs. To act on them, tell
Gurubase which of your content groups each directory group corresponds to.

Open **Team → Groups**, edit a group, and paste the directory group's **object ID** into
**Directory group IDs**, one per line. A group can map to several directory groups.

Once mapped, a user whose verified token carries that directory group joins the content
group for the duration of their request, and sees every data source scoped to it. See
[Groups & Content Access Control](/guides/groups) for how source visibility works.

Anything not mapped is ignored: unknown IDs, IDs belonging to another guru's groups, and
tokens with no group claim all fall back to sources visible to everyone. Access is never
widened by a value Gurubase does not recognise.

<Note>
  Entra ID replaces the groups claim with a pointer when a user belongs to more groups than
  fit in a token. Gurubase treats that case as "no groups" and logs a warning rather than
  guessing. If your users are in very many groups, use a
  [group filter](https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims)
  in the app's token configuration so only the relevant groups are emitted.
</Note>

***

## Enforcement

**Require verified identity** decides what happens to a request that arrives without a
valid token.

| Setting       | Request with a valid token            | Request without one                       |
| ------------- | ------------------------------------- | ----------------------------------------- |
| Off (default) | Answered, scoped to the user's groups | Answered from sources visible to everyone |
| On            | Answered, scoped to the user's groups | Rejected with `401`                       |

Leave it **off** while the SharePoint package is still reaching people. Turning it on
before everyone has it makes the assistant look broken for anyone who is missing it.

Turn it on once rollout is complete and you want the assistant to answer only people the
directory can vouch for.

<Warning>
  Disconnecting the integration stops all verification. Every request then falls back to
  sources visible to everyone, including requests that would previously have been rejected.
  Gurubase asks for confirmation before disconnecting for exactly this reason.
</Warning>

***

## What gets verified

For every token, Gurubase checks that:

* the signature matches Microsoft's published signing keys for the tenant,
* the tenant matches the Directory (tenant) ID on the integration,
* the audience matches the Application ID URI on the integration,
* the issuer belongs to that same tenant,
* the token has not expired.

A token that fails any of these is treated as absent, not as an identity. Failures are
logged without the token value.