# Microsoft 365 as an Authorization Graph

> Why Copilot inherits SharePoint's permission state, the two-decision model with Purview DLP, Sites.Selected, RCD, and Entra Agent ID blueprints.

- Web page: https://www.alesanalytics.com/architecture/microsoft-365
- Markdown: https://www.alesanalytics.com/architecture/microsoft-365.md
- Part of: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md), section "The enterprise estate"
- Last verified: 13 October 2026
- Publisher: Ales Analytics

## Not a cloud: an authorization graph

It's easy to think of Microsoft 365 as a set of applications. Architecturally it's better described as many workloads sharing three planes: one identity plane (**Entra ID**), one data-access plane (**Microsoft Graph**) and one compliance plane (**Purview**). Copilot, agents and third-party apps all sit on top of those three and inherit whatever state they hold.

Entra holds the users, groups, apps, agents and Conditional Access. Exchange, SharePoint and OneDrive, Teams, Intune and Defender, and Power Platform sit on it. Microsoft Graph is the one API and permission model across them. Purview carries labels, DLP, retention, audit and DSPM for AI. Copilot, agents and third-party apps come last, and inherit everything above.

That inheritance is the point. AI over Microsoft 365 is an authorization-inheritance problem. It shows each user everything they can technically open, and years of oversharing become instantly searchable.

The question to ask of any AI design over Microsoft 365 is: **what permission state does the AI inherit, and which second decision says it may process it?**

| Workload | Its role | Why it matters for AI |
| --- | --- | --- |
| Exchange | Mail and calendar | Email and invitations are injection vectors (ASI01) |
| SharePoint and OneDrive | Storage, with permission inheritance | The main oversharing surface |
| Teams | Chat and meetings; files live in SharePoint | Meeting transcripts become grounding |
| Intune | Device compliance, fed into Conditional Access | Lets you require a compliant device |
| Defender | XDR and app governance | Detects risky consent and anomalous Graph use |
| Power Platform | Connectors and Copilot Studio | Every connector is an egress path |

## Oversharing, and the tools that hide it

SharePoint permissions inherit by default. Breaking inheritance creates item-level ACLs. Sharing links grant access to whoever holds them. Group membership grows. And grants to "Everyone except external users" quietly make a site readable by the whole company. For years, obscurity hid most of that permission debt: nobody found the budget spreadsheet because nobody knew where to look. Semantic search removes the obscurity.

Microsoft offers two controls that limit what search and Copilot surface. Neither changes permissions.

- **Restricted Content Discovery (RCD)** is a site-level setting. It affects only tenant-wide search and Microsoft 365 Copilot, it doesn't change who can open anything, and overusing it can degrade performance.
- **Restricted SharePoint Search (RSS)** is retiring. New enablement is blocked from 31 July 2026 [1], and Microsoft points to RCD instead. Microsoft's page no longer gives a final retirement date (a date of 31 January 2027 was reported earlier and is now unverified), and nothing migrates automatically. Content that RSS was keeping out of results may become discoverable once it goes, unless it's restricted another way or its permissions are fixed. Microsoft's own page describes RSS as a temporary measure that "isn't a security boundary".

The root fix is permission remediation: data security posture assessments, access reviews, and site sensitivity labels that enforce privacy and sharing settings.

## The two-decision model

**Figure: The two decisions behind every answer Microsoft 365 Copilot gives.** A user signs in through Microsoft Entra ID (identity, groups, Conditional Access) and asks a question. Decision 1 asks whether the user can open each item, from the item's ACL, inheritance and sharing links. Decision 2 asks whether the AI may process each readable item, from Purview DLP on the Copilot location, by sensitivity label. Only items that pass both ground the answer, which cites what it used. DLP changes can take up to four hours to reach Copilot. Decision 1 is the permission state SharePoint and Exchange already hold, years of it. Decision 2 is a separate Purview DLP policy that can stop the AI processing an item the user is allowed to open. A policy change can take up to four hours to reach Copilot, so Decision 2 is not an instant kill switch.

Decision 2 is a Purview DLP policy on the Microsoft 365 Copilot and Copilot Chat location. With the condition *Content contains > Sensitivity labels*, it stops Copilot using labelled files and emails in its responses. The items can still appear in citations, but their content isn't processed. In Word, Excel and PowerPoint, Copilot's skills are disabled for a file with a covered label. Prompts that contain sensitive information types can be blocked from processing and from web search.

Four details from Microsoft's documentation shape how you use it:

- The location is only available in the **Custom** policy template [2].
- Selecting it **disables every other location in that policy,** so Copilot DLP becomes a separate policy estate, and drift between it and your workload DLP is a risk.
- Policy updates can take **up to four hours** to reach Copilot [2].
- In the Office apps, the policy is evaluated when a file is opened, so a label applied mid-session takes effect the next time the file opens.

> **Inference.**
>
> Decision 2 is only as good as your labelling. Unlabelled sensitive content passes it untouched, so coverage depends on default and automatic labelling. And four hours means DLP is not an instant kill switch: if you need something out of Copilot's reach now, fix Decision 1.

## Graph permissions and consent

| Type | What the app can reach | The risk |
| --- | --- | --- |
| Delegated | The intersection of the app's scopes and the signed-in user's access | Consent phishing; broad `*.All` scopes |
| Application | The app's own access, across the whole tenant | `Sites.Read.All` means every site |
| Selected (`Sites.Selected`, and `Lists`, `ListItems` and `Files.SelectedOperations.Selected`) | Nothing until an explicit grant is made on each resource [3] | Making that grant requires `Sites.FullControl.All`, so the identity that grants is privileged |

`Sites.Selected` is generally available for Microsoft Graph and the legacy SharePoint APIs, in both delegated and application forms.

**The pattern for an AI connector:** use Selected scopes with per-site or per-list grants, under a workload identity with a federated credential, so the connector reads only what you have decided it may.

> **The granting identity is Tier-0.**
>
> Whoever holds `Sites.FullControl.All` to make Selected grants can grant anything. Put that identity in your Tier-0 set, alongside the identity provider and KMS, and treat its use as an event worth alerting on.

## Entra Agent ID

An **agent identity** in Microsoft Entra is a special kind of service principal created from an **agent identity blueprint**. The blueprint is a template and also an identity in its own right, one that can do exactly one thing in the tenant: create and remove agent identities.

Three facts shape how you design with it:

- **Credentials live on the blueprint.** Agent identities authenticate using credentials configured on their blueprint [4]. The blueprint may hold client secrets and certificates as well as federated identity credentials, and Microsoft advises against secrets in production. So "credential-less agents" is not true of the system as a whole: one blueprint credential can mint tokens for every agent made from it.
- **Policy applies at the blueprint.** Conditional Access policies can target a blueprint and so every agent identity created from it, and disabling a blueprint stops all of its agents authenticating.
- **Permissions can be inherited, by design.** Microsoft's documentation describes *inheritable permissions*: when an administrator grants permissions on the blueprint principal from a resource app marked as inheritable, every agent identity created from that blueprint receives them [5]. The declarations don't grant anything on their own; an administrator still has to consent. This edition of the atlas originally recorded inheritance as an open question; the current documentation resolves it, and you should still test the behaviour in your own tenant.

The design consequence: **the blueprint is the blast-radius unit for agents.** Scope one blueprint per agent type and data domain, back its credential with a managed identity's federated credential rather than a secret, and monitor token issuance from it as a Tier-0 signal. Copilot Studio can assign agent identities automatically, and Agent 365 gives each agent an Entra Agent ID.

## How Microsoft 365 couples to everything else

| Coupled with | Through | Why it matters |
| --- | --- | --- |
| Azure | The same tenant; a Global Administrator can elevate to the Azure root | Microsoft 365 administration is Tier-0 for Azure too |
| Other SaaS | Single sign-on and SCIM; Graph connectors import external content | Map the external ACLs, or the import overshares |
| Data platforms | Bulk export, Fabric | Bypasses per-request DLP |
| Automation | Power Automate, Logic Apps | Needs connector DLP of its own |
| Security | Defender, Purview audit, Sentinel | Copilot interactions are audited events |

## How it fails

Unlabelled sensitive content passes Decision 2. The four-hour lag leaves a window after every policy change. Policy drifts between the Copilot DLP estate and the workload DLP estate. The identity holding `Sites.FullControl.All` is compromised. And RSS retires, taking its restrictions with it.

## Questions to ask in a review

What's the permission debt, measured? What fraction of sensitive content is labelled? Who holds the granting permission? What happens in the four hours after a policy change? Which sites does RSS currently hide, and what will hide them after January 2027?

## Verified claims

Each numbered statement above, tied to the page that says it, the date it was last checked and the conditions it holds under.

1. Restricted SharePoint Search is retiring, and from 31 July 2026 it can't be newly enabled; Microsoft points to Restricted Content Discovery instead. Source: https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search. Checked 13 October 2026, tier T1. Holds when: Microsoft 365 tenants licensed for Microsoft 365 Copilot. The page (updated 18 August 2026) gives no final retirement date; the 31 January 2027 date reported earlier is unverified. Check Message Center for your tenant.
2. A Purview DLP policy for the Microsoft 365 Copilot location uses the custom template only, and updates can take up to four hours to reach Copilot and Copilot Chat. Source: https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about. Checked 13 October 2026, tier T1. Holds when: Microsoft Purview with a licence that includes DLP for Copilot. Four hours is the stated upper bound, not a guarantee.
3. Sites.Selected grants nothing until an explicit grant is made on each site, and making that grant requires Sites.FullControl.All. Source: https://learn.microsoft.com/en-us/graph/permissions-selected-overview. Checked 13 October 2026, tier T1. Holds when: Microsoft Graph and the SharePoint REST APIs, delegated and application permissions. Lists, ListItems and Files Selected scopes follow the same model.
4. The credentials used to authenticate an agent identity are configured on its agent identity blueprint, not on the agent identity itself. Source: https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint. Checked 13 October 2026, tier T1. Holds when: Microsoft Entra Agent ID, in preview at the time of checking. The credential types a blueprint accepts are listed on Microsoft's separate credentials page.
5. Permissions granted on a blueprint principal from a resource app marked as inheritable are received by every agent identity created from that blueprint. Source: https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint. Checked 13 October 2026, tier T1. Holds when: Microsoft Entra Agent ID, in preview. Only after administrator consent, and only for resource apps that mark the permission as inheritable. Test in your own tenant.

Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com.

## Sources

1. [Microsoft Purview DLP for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about). Microsoft, 2026. Custom template only; selecting the location disables other locations in the policy; updates take up to four hours to reach Copilot.
2. [Restricted Content Discovery for SharePoint sites](https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery). Microsoft, 2026. A site setting that keeps content out of tenant-wide search and Copilot without changing permissions.
3. [Restricted SharePoint Search](https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search). Microsoft, 2026. Retiring: new enablement blocked from 31 July 2026. Described by Microsoft as temporary, and not a security boundary.
4. [Overview of Selected permissions in OneDrive and SharePoint](https://learn.microsoft.com/en-us/graph/permissions-selected-overview). Microsoft, 2026. Sites.Selected and related scopes grant nothing until an explicit per-resource grant is made.
5. [Agent identity blueprints in Microsoft Entra Agent ID](https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint). Microsoft, 2026. Credentials are configured on the blueprint; policy applied to it reaches every agent identity; inheritable permissions flow to agent identities after consent.

## Where to go next

- Previous: [Observability, Operations and Governance](https://www.alesanalytics.com/architecture/observability-and-operations.md)
- Next: [Hybrid Cloud, Private Cloud and On-Premises](https://www.alesanalytics.com/architecture/hybrid-and-on-premises.md)
- Overview and every page: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md)
- The whole site in one file: https://www.alesanalytics.com/llms-full.txt