1. Overview
SharePoint uses the Microsoft 365 connection and is limited to sites and libraries you select explicitly.
The Entra app needs Sites.Selected consent plus a separate read grant for every approved SharePoint site.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- Microsoft 365 connection
- This Microsoft product uses the customer-managed, single-tenant Entra app configured for Microsoft 365. It does not need a separate credential.
- Connection ownership
- This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.
3. SharePoint data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Selected sites
- Exact site identities, collections, URLs, and lifecycle metadata.
- Document libraries
- Selected drives, folders, files, content, hierarchy, and version context.
- Access evidence
- Site, library, file, inherited, group, and link permissions used to determine who can access synchronized content.
4. Read-only permission contract
SharePoint uses app-only Sites.Selected plus an explicit site read assignment. No broad site role or site, file, sharing, or permission write role is requested.
- User.Read.All — required directory identity. GroupMember.Read.All is additional and conditional on enabling directory.groups.
- Sites.Selected — constrain app access to approved sites.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- Workspace connections use provider-returned object permissions and stable principals for human audience projection. Missing, stale, ambiguous, or unmappable ACL evidence contributes no human audience, and no Seedling administrator or steward may broaden it.
- If inherited, link, or group permissions are incomplete, Seedling does not show the content to a user.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized SharePoint records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored SharePoint credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.