The request path
The SharePoint app authenticates through Microsoft and calls the SHaiRO backend. The backend uses delegated Microsoft Graph access for the approved site and the signed-in user’s supported mailbox retrieval, then sends the relevant request context to Azure OpenAI to produce a response.
SHaiRO is a connected cloud service. It requires access to Microsoft services, the backend and its model deployment.
Permission boundaries
Microsoft permissions, installation verification, the approved site, client feature settings and user access restrictions are all part of the request checks. Mail retrieval is limited to the signed-in user’s own mailbox in this release.
Reseller dashboard accounts are scoped to their own client organisations. Internal supplier-cost settings are not shared with resellers.
What installation discovery reports
When the app first runs, it reports tenant/site/web identifiers, site URL/title, app version and the first observed user’s name/email for onboarding. This person may be an end user rather than the installer.
This discovery event does not include document bodies, email content or chat messages. Actual AI questions and retrieval are a separate request path that can include relevant content.
History and backend records
Chat history is stored locally in the browser for the user and site; clearing browser data removes that local history. It is not cross-device storage or an encrypted records archive, and scripts on the same SharePoint origin may be able to access browser storage.
The backend also retains usage and durable job records, which can contain generated replies and source metadata for safe retries. This is not a zero-retention product. Discuss retention and customer data requirements with RandTech IT before deployment.
Review before a wider rollout
Test with ordinary users and restricted sample documents, confirm the requested Microsoft consent, and review how your organisation intends to use the answers. Use source verification and human review for important decisions.
This page describes the current implementation. Contractual data-processing terms, regional requirements and customer-specific policies should be agreed as part of onboarding.