Copilot Agent not consistently Respecting SharePoint Document Permission
Hi everyone, I have created a Copilot agent that answers questions based on documents stored in SharePoint, and I want the agent to respect the user's SharePoint permissions. For example: I have two documents: Document A and Document B. User A has access to Document A but does not have access to Document B. When User A asks a question related to Document A, the agent should provide an answer. When User A asks a question related to Document B, the agent should not provide any information because User A does not have permission to access that document in SharePoint. However, I am experiencing inconsistent behavior. Sometimes the Copilot agent correctly respects the SharePoint permissions, but at other times it provides an answer from a document that the user does not have access to in SharePoint. In some cases, even users who do have access to a document do not receive an answer from it. I am using Microsoft authentication and SharePoint as the knowledge source. Has anyone experienced this issue with Copilot Studio and SharePoint security trimming? Could this be related to indexing, caching, authentication, permissions propagation, or the way the agent retrieves documents? I would appreciate any guidance on how to ensure that the Copilot agent consistently respects the user's SharePoint permissions when retrieving and answering from documents.Who Can Access What? Designing RBAC and Identity in Azure
Who should be allowed to access an Azure resource? Azure makes it easy to create resources. The harder question comes afterwards: who should be allowed to access them? A Function App may need to read secrets from Key Vault. A Logic App may need to call APIs through API Management. A developer may need to deploy to Dev but have no access to Production. A CI/CD pipeline may need to deploy infrastructure without becoming an Owner of the entire subscription. This is where Azure Role-Based Access Control (RBAC) and Managed Identity become critical. In this article, I look at how to design access around people, applications and deployment pipelines, while keeping permissions as narrow as practical. The article covers: Azure RBAC and access scopes Least-privilege access Managed Identities Developer vs Production access boundaries Application identities CI/CD deployment permissions RBAC vs API authentication Privileged access and PIM Common RBAC design mistakes One of the key principles is simple: Give an identity only the permissions it actually needs. For example, if a Function App only needs to read secrets from Key Vault, giving it Contributor access to the entire Resource Group solves the problem with a much broader permission than necessary. Good RBAC design is not about assigning more permissions. It is about understanding: Who needs access? Why do they need it? What exactly do they need to do? At what scope should access be granted? How can that access be managed securely over time? I would be interested to hear how others approach RBAC and identity design in enterprise Azure environments. Full article: https://www.linkedin.com/pulse/who-can-access-what-designing-rbac-identity-azure-chethan-raj-ud6gc/
Need Help: Accessing 'Shared' DriveItem Property in SharePoint Without Delta API
Hello everyone! I am attempting to retrieve all root drive items from a folder, including the 'Shared' property of each drive item. However, even when I explicitly include the 'shared' attribute in my QueryOption object, it does not seem to reflect any changes. It always returns an object with the "Scope" property set to "user", even if the default permissions have not been altered for the item. Interestingly, when utilizing the Delta API, the behavior observed is that only items with set permissions (beyond the default ones) return a valid, non-null "Shared" object with the "Scope" property set to 'user'. Conversely, items without set permissions (i.e., default permissions only) return a null "Shared" object. This difference effectively helps in determining whether each item was actually shared. The reason I need to specifically fetch a list of ROOT drive items for a folder, rather than utilizing the Delta API to track changes (which could potentially traverse through sub-folders and their children/grandchildren on an initial query), is due to the requirement to perform a clean fetch of all items for specific SharePoint site libraries. These libraries often contain thousands of subfolders and files, while we are only interested in the root items of a particular folder for caching purposes. The Delta API variant could potentially take over an hour per folder to traverse through, which is not feasible for our needs. Unless there's a way to restrict Delta API calls to only directly access a root folder's children, I'm seeking alternative solutions. Here is my Select query option (C#) : new QueryOption("select", " id, name, createdDateTime, lastModifiedBy, lastModifiedDateTime, size, parentReference, permissions, sharepointIds, file, eTag, webDavUrl, deleted, folder, shared") As you can see I've included the 'shared' attribute in this query. My Graph API request (C#) : driveItemRequest.ItemWithPath(formattedPath).Children.Request(options) Is there any way I can obtain the desired "Shared" property without resorting to the Delta API for all root items in a folder? Alternatively, is there a method involving Permissions endpoints that I can use to achieve a similar result? At this stage, I am only in need of a boolean flag indicating whether permissions have been modified or not, as mentioned earlier. Thanks in advance to anyone who can offer any guidance on this matter ! Kind regards, Facundo.How to know if I can trust an SPFX webpart?
I am in the process of implementing an spfx webpart but before I need to make sure it is not a security threat. From researching I was not able to find if there is any way to run a check or provide a validation that the webpart is safe for the organization as it does ask for Graph API permissions, I do not think there is any issues with it, but I need to be able to have cleareance. This is the webpart: https://github.com/pnp/sp-dev-fx-webparts/tree/main/samples/react-accordion-dynamic-sectionUnable to share screen on MS Teams in Google Chrome 109.0.5414 on Ubuntu 22.10
Hello, I have not been able to share the screen (or other windows) like I used to share with MS Teams running inside Google Chrome 109.0.5414 on Ubuntu 22.10. The only thing I can share is other tabs inside Google Chrome. The same thing is happening inside Chromium 109.0.5414. The strange thing is that Google Chrome and Chromium display the following message: "Go to Security & Privacy > Screen Recording to give permission and start sharing." But I do not have these Security & Privacy Settings. I am not using macOS, where I know about these settings. On Linux, there are no such settings. Are there any other options on a Linux System to set to make sharing screens possible once more? Thanks in advance. Details: - Ubuntu 22.10 with GNOME 43.1, Wayland - Chromium 109.0.5414 (via snap) and Google Chrome 109.0.5414 (via dpkg/apt)
List, prevent add only one item
Hi! I'm using sharepoint online and, i need to build a new list with the item-level permission, that is, each member can create items, but can only change and see the ones he created himself, this configuration is already defined.works fine. My question is, members can only add 1 item, only owners can add multiple items. How do I do that? With power auto? Any ideas or examples to explore? PS: The option to approve is also active.
Team Site Permission Not Showing New Group
HI, I have a Modern Team Site and have default permission groups (Owner, Member, Visitor). For the new requirement I have created a new group with new permission level (New Group Test). But when I add users from home page this new group is not showing. There's only Owner and Member. I need to assign some users to this new group. I know I can directly add the users in the group in the first screenshot. But is it possible to make that group available in the home page as in the second screenshot? Or by default it only shows Member and Owner option? ThanksCortana keeps saying you haven't turned on all required permissions
my Mic is connected, I can talk to Cortana and use my Mic on all applications, but in Cortana settings in a yellow text it says "you haven't turned on all required permissions". in Settings, all the permissions are given to Cortana. Anyone else experiencing this? I'm on Dev build 21286 insider. if you do please add your details and problem recreation to the feedback: https://aka.ms/AAasugm
