Official documentation checked October 14, 2026.
If Copilot does not use a SharePoint document, first distinguish a file-access problem from a discovery or feature limitation. Being able to open a file does not guarantee that every Copilot experience will retrieve it for every question. Conversely, a generic answer does not prove that the user lacks SharePoint permissions.
This guide concerns Microsoft Copilot experiences that use Microsoft 365 work data. A custom Copilot Studio agent has additional knowledge-source and authentication settings; do not apply its setup instructions to ordinary Microsoft 365 Copilot.
1. Confirm the account, experience, and exact document
Record the Copilot app or Microsoft 365 feature, the signed-in work account and organization, and the document’s direct URL. State what you expected: finding the file, summarizing a supplied file, or answering a question across organizational content. Those are different tests.
Ask the administrator to verify that this account has the applicable feature and work-data access. Access to a chat box alone does not establish the entitlement for every grounding scenario. The current Copilot requirements distinguish eligible Chat users from licensed capabilities and app-specific requirements.
- Using the same work account, open the exact SharePoint document URL. Do not test with an administrator’s account as a substitute.
- Note whether the file opens, requests access, or produces a sign-in or policy error.
- If it opens, use the supported file-reference or attachment option in your Copilot experience, or ask about the precise file title. Request a citation and inspect what source was actually used.
For example, compare “What is our travel policy?” with “Using the approved travel policy file I have referenced, summarize its reimbursement rules and identify the source.” A successful targeted result narrows the issue to discovery or question scope; it does not prove that broader organizational search is healthy.
2. Resolve genuine access problems without widening the audience
If the exact file cannot be opened, send the owner its URL, the requesting work account, and the actual error. Ask for the minimum access appropriate to the task. A document reader does not normally need editing rights or membership in a broad site-members group.
The owner should inspect the file’s Manage access information, including direct grants, sharing links, and access inherited from a folder or site. Microsoft describes these separate access paths in its sharing and permissions guidance. A user can legitimately have access to an individual file without belonging to every group associated with the site.
Do not copy the memberships of a colleague whose Copilot works. That colleague may have access to unrelated confidential content. Similarly, restoring inheritance or creating an organization-wide link can expose more material than the requested document.
If opening the file is blocked by device or sign-in policy, give IT the timestamp and error details. Do not exempt the user from MFA or Conditional Access. The identity team should inspect the actual failed sign-in and required controls before deciding on an authorized repair.
3. Check discovery and information-protection controls separately
If direct access succeeds, compare the result with Microsoft Search using the same account. Ask the site owner whether the site or library is intended to appear in search, and whether a recent content or search-schema change is involved. Search absence is not a reason to grant tenant-wide Graph permissions.
- Restricted Content Discovery: this site-level control can suppress organization-wide discovery and Copilot entry points without revoking direct access or removing content from the index. Its propagation time varies. See Microsoft’s current RCD guidance.
- Existing Restricted SharePoint Search: an older tenant configuration may still affect discovery. Microsoft says RSS is retiring and new enablement has been blocked since July 31, 2026. Do not introduce RSS as a new grounding fix or disable an existing governance control without its owner’s review.
- Labels, encryption, and DLP: opening a document does not settle every AI-processing permission. Microsoft’s data-protection architecture describes content-protection requirements and controls affecting Copilot. Have the information-protection owner review the actual file and policy; do not remove protection to force a summary.
There is no universal “Copilot > Data sources > SharePoint allowlist” that every Microsoft 365 administrator must populate. Nor should you grant Sites.Read.All to an enterprise application found by a similar-looking display name as a generic repair. Custom agents and connectors require their own documented, least-privilege configuration.
4. Retest with evidence and escalate the remaining failure
Use a fresh conversation and an approved, non-sensitive test document with a recognizable title and a simple fact. Keep the account, client, prompt, source reference, and expected fact consistent. Record whether Copilot finds the document, cites it correctly, and answers from it. Do not upload a protected file to a personal account for comparison.
If a search-schema change genuinely requires reindexing, an authorized site owner can follow Microsoft’s reindexing instructions, preferably for the affected library. Reindexing runs through the scheduled crawl process and can add substantial load; it is not an instant permission repair.
For support, provide the feature name, account and tenant through the approved channel, test time, affected URLs, direct-access result, search result, and sanitized prompt and response. Include the specific policy or error when one is known. Do not state that indexing, access, or consent is broken merely because a response is incomplete.
A completed repair should restore the intended reader’s use while preserving the document’s audience and protection. If retrieval remains inconsistent despite verified access and supported configuration, retain that evidence for Microsoft support instead of repeatedly changing permissions.