If staff keep asking questions that are already answered in SharePoint, a Copilot Studio agent can give them a conversational route into that knowledge. The important bit is not creating a chatbot quickly. It is making sure the agent searches the right content, respects permissions and knows when it cannot answer.
This replaces the old Make and Chatbase recipe. That route may still suit some projects, but it sends Microsoft 365 content through additional services and its screens, plans and model options change independently. Copilot Studio now has a supported SharePoint knowledge source and can be published to Teams.
What this build does
The agent uses one or more SharePoint sites, libraries or lists as knowledge sources. A signed-in user asks a question in Teams, and Copilot Studio retrieves relevant content before generating an answer.
Microsoft says the standard SharePoint knowledge source answers on behalf of the signed-in user and only surfaces content that user can access. At minimum, the user needs Read permission to the relevant SharePoint content. Permission trimming is essential, but it is not a substitute for cleaning up the underlying permissions.
Prerequisites
Before building anything, confirm:
- you have access to a Copilot Studio environment and permission to create an agent;
- Dataverse search is enabled where required by the SharePoint knowledge feature;
- the intended users can sign in with Microsoft and can read the source content;
- the SharePoint material is current, clearly titled and approved for the audience;
- your administrator has confirmed licensing, data-loss-prevention policies and whether custom agents may be published to Teams.
Do not copy production HR, legal or security content into a test site simply to make a demo work. Use a small, representative test library with non-sensitive documents.
Build the agent
- In Copilot Studio, create an agent in the correct environment.
- Open its knowledge settings and choose Add knowledge.
- Select the full SharePoint knowledge option, then add the exact site, folder or list you want searched.
- Add agent instructions that state its subject, audience and refusal boundary. Tell it to say when the available sources do not answer the question.
- Use the test pane to ask questions with known answers, ambiguous answers and no answer.
- Configure Authenticate with Microsoft for the Teams scenario, then publish the agent to Microsoft Teams through your organisation's approved app process.
Register the narrowest useful SharePoint URL. Microsoft documents that a registered site URL includes its subpaths, but not parent, sibling or unrelated sites.
Test permissions, not just answers
Use at least two test accounts with deliberately different access:
- Account A can read the ordinary policy library.
- Account B can read that library plus a restricted test document.
Ask both accounts a question that only the restricted document can answer. Account A should not receive that content. Account B should receive an answer that points back to the permitted source.
Also test an encrypted, password-protected or sensitivity-label-encrypted file. Microsoft notes that Copilot Studio may show such a document as ready but still be unable to ground an answer from it.
Common failures and recovery
The agent gives no answer: check the user's SharePoint permission, the registered URL, Dataverse search and the source status. Microsoft provides a dedicated troubleshooting page for SharePoint sources that return no results.
A recently republished agent still behaves like the old version: in a Teams 1:1 chat, type start over to begin a fresh conversation. Microsoft notes that authentication changes can take time to appear.
It answers too broadly: reduce the registered SharePoint scope and tighten the instructions. Do not try to solve an over-broad source with prompt wording alone.
It exposes something it should not: unpublish or remove the Teams app, correct the SharePoint permissions, then repeat the two-account test. Treat that as a permissions incident, not a copy-editing problem.
What this proves
A successful test proves that the named accounts received the expected answers from the chosen test content at that time. It does not prove that every document is accurate, that all tenant permissions are clean, or that generated answers will always be correct. Keep source ownership, review dates and an escalation route outside the agent.
For practical help building governed apps and agents on Microsoft data, join the Power Apps Builders Space.