The real problem: finding a reliable answer without opening access too widely

An organisation generally does not need “another chatbot”, but rather a controlled path between a question, an approved source and a useful action. An employee wants to know the purchasing procedure, reimbursement policy, intervention method or applicable clause. The assistant must find the right information, cite its source, respect permissions and acknowledge when the answer cannot be established.

Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.

Broadest controls available on the platform. SOP, wiki and RAG foundation shows how to structure this knowledge before exposing it to an assistant. This article covers the next step: choosing the architecture that makes it usable.

SharePoint Agent, Copilot Studio and custom RAG: three levels of control

All three approaches can answer questions using internal documents, but they do not place the product boundary in the same place. SharePoint Agent prioritises proximity to the content. Copilot Studio adds orchestration and distribution. Custom RAG gives you control over the entire technical chain.

SharePoint Agent: a conversational layer close to the site

4. Company-owned device

This option speeds up the pilot when the organisation already works in Microsoft 365 and primarily wants to search, explain or summarise. It is less suitable for a public interface, numerous systems, complex approvals or rich business logic.

Copilot Studio: knowledge, conversations and actions

Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.

The product is aimed at scenarios that go beyond consulting a single document space: answer a question and then create a ticket, collect missing data, trigger a workflow with approval or hand the case over to a human. It provides a low-code framework, but does not eliminate the need for design, security, environment management and testing.

Custom RAG: end-to-end controlled architecture

A custom solution allows you to choose the connectors, ingestion pipeline, document segmentation, metadata, search engine, model, guardrails, interface and observability. It can combine SharePoint, ERP, CRM, SQL database, extranet, multilingual data or product content. It also provides finer control over synchronisation frequency and classification rules.

This freedom creates additional responsibility: permissions applied during retrieval, monitored updates, protected indexes and evaluated responses. Microsoft Foundry recommends access control during retrieval and Microsoft Entra ID rather than API keys in production with Azure AI Search.

Comparison: which approach matches your needs?

4. Company-owned device A small team gains nothing from operating a complex platform for fifteen stable procedures. Conversely, an agent intended for several departments should not remain a personal configuration that is difficult to inventory.

Permissions: the agent cannot fix an overly open SharePoint environment

The first control is to check what users can already access without AI. An agent that respects permissions can nevertheless make it easier to reveal a document that was accessible by mistake. Conversational search reduces the effort required to discover information: it therefore makes excessive permissions more visible and potentially more damaging.

Inventory sites, groups, “anyone with the link” links, guests, sensitive libraries and inheritance exceptions. Identify HR, legal, financial, medical or customer-related content. Correct permissions before the pilot and test with several real profiles: employee, manager, contractor, guest and administrator. A test team that uses only privileged accounts validates nothing.

Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.

Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.

Prepare content before measuring the agent’s intelligence

Four access and management models with Microsoft Intune A folder full of duplicates, unreadable scans and contradictory drafts produces ambiguous search results. Designate one source of truth for each process, archive obsolete versions and specify an owner, validation date, next review, audience and status for each document.

4. Company-owned device

Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.

Rollout plan

Four access and management models with Microsoft Intune

An association with an internal manual on a single site

The team wants to find reimbursement rules, templates and onboarding procedures. The documents are approved, few in number and accessible to the same members. A targeted SharePoint Agent is a good first test. The pilot should primarily check guests, older versions and multilingual content.

A multi-site group that wants to open and route requests

The assistant consults procedures, asks for the site, creates a ticket, selects a team and sometimes obtains approval. Copilot Studio combines conversation and workflow more effectively. Development, testing and production remain separate.

A manufacturer with SharePoint, ERP and technical datasheets

Purchase, logistics and personal use policy needed.

A healthcare organisation with sensitive procedures

The requirement may appear to be documentary, but user profiles, confidentiality obligations, audit trails and approvals change the decision. Start with a restricted base of non-clinical procedures, without patient data. Whatever the platform, involve the DPO, security team and business owner; clearly define prohibited uses and human handover.

GVISION presents its approach to connecting documents, agents, automations and human approvals on the page Autonomous AI agents and MCP protocol. The value of a neutral assessment is precisely to avoid turning every case into custom development if a simpler Microsoft option is sufficient.

Decision tree: four questions to ask before choosing

4. Company-owned device A reversible choice is often preferable: test with a limited corpus, observe usage, then move to Copilot Studio or a dedicated architecture if the actual requirements exceed the initial framework.

1. 4. Company-owned device If so, and if the assistant mainly needs to answer questions, test SharePoint Agent.
2. Does the assistant need to perform actions or combine multiple channels? If so, assess Copilot Studio.
3. Is a specific interface, indexing approach, model or hosting environment required? If so, consider custom RAG.
4. Can the team operate the solution for three years? 4. Company-owned device

Build a useful six-step pilot

A good pilot validates a business decision using real permissions and real documents; it is not designed to impress during a demonstration.

1. Choose a frequent and limited question

Select a process whose owner is available. Avoid “all the company’s knowledge”. Describe users, languages, time lost and the step that follows the answer.

2. Reduce and qualify the corpus

Keep the necessary documents, remove duplicates and drafts, check OCR and add metadata and dates. Document exclusions. A small, consistent knowledge base makes troubleshooting easier.

3. Define permissions and identity

List authorised groups and test accounts. Check external links and historical access. For a custom architecture, design filtering at retrieval time. Never place confidentiality solely in a text instruction such as “do not show secret documents”.

Mobile Application Management applies rules to work applications and business data without placing the whole endpoint under device management. Microsoft describes MAM for unenrolled devices as a way to combine application configuration and protection. On supported apps, policies can require an app PIN, restrict copying to personal apps, limit local storage and selectively remove organisational data.

Compile 30 to 50 questions, including traps. Define the source, acceptable formulations, citation, refusal and human handover. Have the business owner score the answers.

5. Monitor usage and workload

Purchase, logistics and personal use policy needed.

6. Decide: stop, stabilise or expand

Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.

Belgian scenarios

4. Company-owned device

1. Index all of SharePoint. Noise, duplicates and inherited permissions make responses unpredictable.
2. Choose the tool before defining the use case. An attractive demonstration defines neither value nor risk.
3. Confuse respected permission with correct permission. AI can make it easier to discover an access permission that is already too broad.
4. Test only with administrators. The results do not represent ordinary users.
5. Forget NL or FR. Write policy and notice. Explain visibility, responsibilities, support, loss, removal, departure and updates.
6. Allow actions too early. Company device
7. Measure only fluency. A pleasant answer can be incorrect or based on the wrong version.
8. Yes, with more complete configuration. Purchase, logistics and personal use policy needed.
9. Fail to assign an owner. An agent without review quickly becomes a channel for outdated procedures.