{"slug": "rovo-sharepoint-connector-permissions-sites-and-consent", "title": "Rovo SharePoint Connector: Permissions, Sites and Consent", "summary": "A developer who walked Atlassian's Rovo SharePoint connector setup on a test org found that the wizard never displays the permissions being approved, and that one of the two Microsoft permission requests sends only the opaque `.default` scope rather than a named list. The walkthrough, which stopped at Microsoft's sign-in page without connecting a real tenant, documents two Microsoft apps (a consent app and an indexing app), a 15 November 2026 admin-consent deadline, and terms under the Authorize button that let Atlassian share ingested third-party data with MCP clients and connected apps. The developer recommends granting admin consent now, testing the Authorize step in a pilot tenant and reading the granted list in Entra, and indexing via an allow list of sites rather than a block list.", "body_md": "Yes, Rovo can access SharePoint. The Rovo SharePoint connector copies SharePoint and OneDrive files into the Teamwork Graph, the index Atlassian keeps for search and AI, and Rovo answers from there. A Microsoft 365 admin has until 15 November 2026 to consent to Atlassian's new app, and one of the two permission requests the setup sends Microsoft names no permissions at all, only `.default`.\n\nI think the design is fine. The problem is the setup page never shows you the permission list you're approving. Microsoft's consent screen shows it once, to whoever clicks Accept, and Entra shows it after the fact.\n\nI walked the setup on our test org this week, right up to Microsoft's sign-in page, and recorded where each button sends you. We don't have a real Microsoft tenant, so nothing got connected. Anything past the sign-in page comes from documentation, and I say so where it counts.\n\nMy recommendation for a 50 to 2,000 seat company: grant the admin consent now, because that's the one with the deadline. For the Authorize step, do it first in a pilot or test Microsoft tenant and read the granted list in Entra. Without one, have the approving admin screenshot Microsoft's consent screen and click Cancel, then decide for production. When you do switch indexing on, use an allow list of sites, never a block list.\n\n`.default`. Its list isn't on the setup page or in any Atlassian doc we read; you see it on Microsoft's consent screen and, afterwards, in Entra.\nI found the connector under Atlassian Administration > Connectors > All connectors. Rovo needs a Standard plan or higher, and Atlassian Government organizations don't get it.\n\nThe setup talks to two Microsoft apps. I'll call them the consent app and the indexing app from here on.\n\n|  | Consent app | Indexing app | \n|---|---|---|\n| Button in the wizard | Grant consent | Authorize | \n| Entra app (client ID) | 0c8611af-925f-491b-86f4-32fad2901689, named \"Atlassian\" | 20ddde29-f84a-4a98-a8c2-b3b698d4ace2 | \n| Microsoft endpoint | /organizations/v2.0/adminconsent | /organizations/oauth2/v2.0/authorize | \n| Scopes in the URL | email, openid, Files.Read.All, Sites.Read.All, User.Read, offline_access | [https://graph.microsoft.com/.default](https://graph.microsoft.com/.default) , offline_access | \n| Who approves | Entra Global Administrator, Application Administrator or Cloud Application Administrator | \"SharePoint global admin\" per Atlassian's connect page | \n| What Atlassian documents | Each scope, read-only | \"the permissions here are broad\" | \n\nThat's what the browser sent on 25 October 2026. No consent was granted and we saved nothing. The page creates an unsaved draft when it loads, and the connector list still showed 0 items afterwards.\n\nSo up to three admins sign something: the Atlassian organization admin who runs the wizard, the Entra admin who grants consent, and whoever authorizes indexing. Then each user connects their own Microsoft account once.\n\nThe wizard asks that last admin for \"Microsoft Entra admin permissions\". [Connect SharePoint to Teamwork Graph](https://support.atlassian.com/organization-administration/docs/connect-sharepoint-to-teamwork-graph/), which I'll call the connect page, says \"SharePoint global admin permissions\". Plan for whoever holds both.\n\nRead the terms under the Authorize button. You \"allow Atlassian to access or ingest sensitive data\". You also agree \"that Atlassian may share data from the third-party product with MCP clients or apps that users connect to Teamwork Graph\".\n\nThat second term reaches MCP clients and other connected apps as well as Rovo. I'd flag it separately. If you've already locked MCP down with Atlassian Guard, our piece on [what the Atlassian data security policy covers](https://leanzero.net/blog/atlassian-data-security-policy-guard?utm_source=devto&utm_medium=referral&utm_campaign=crosspost) lists the \"Prevent Atlassian MCP server access\" control.\n\n[Upgrade your SharePoint and OneDrive connection](https://support.atlassian.com/organization-administration/docs/upgrading-your-sharepoint-and-onedrive-connection-in-atlassian/) names the app: \"a Microsoft 365 administrator must grant consent to Atlassian's new Microsoft publisher-verified application by November 15, 2026\", application ID 0c8611af. Without it, \"users may no longer be able to resolve SharePoint and OneDrive Smart Links, display link previews, or find SharePoint and OneDrive content through Rovo.\"\n\nYou can do that without switching indexing on. Same page: \"You don't need to complete the connector setup or add the connector. Opening the setup page is only necessary to obtain the admin consent URL.\" Indexing only happens \"If your organization separately configures a synced Teamwork Graph connector for Rovo\".\n\nSo I'd split the two decisions. The consent app's scopes are documented and read-only. Sites.Read.All is \"Read items in SharePoint sites that the signed-in user can access\", and \"If a user cannot access it in Microsoft, granting consent does not give them access through Atlassian.\" Revoking it later \"will disable SharePoint and OneDrive features in Atlassian for all users in your organization\".\n\nAuthorize is the step that switches indexing on. The connect page calls it \"granting Atlassian Teamwork Graph access to your SharePoint/OneDrive accounts\" and adds: \"Although the permissions here are broad, Atlassian Teamwork Graph will only ingest assets that comply with the admin policy controls\".\n\nMicrosoft's [scopes page](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc) says `.default` \"signals that consent should be prompted for all required permissions listed in the application registration\". So the request carries no list. The list is whatever permissions Atlassian set on its own app in Microsoft's directory.\n\nMicrosoft shows that consent screen when nothing has been granted yet, or when the request forces it. That screen is where the list appears, once, for the admin who approves it. If someone in your tenant already clicked through, you probably won't see it again. After consent, Entra shows the same list: Enterprise applications > the app > Permissions, with delegated and application grants kept apart.\n\nThat split is what to look for. Delegated permissions act as the signed-in user, so they can't reach anything that person can't open. Application permissions run with no signed-in user at all. Microsoft's reference says Sites.Read.All as an application permission \"Allows the app to read documents and list items in all site collections without a signed in user\".\n\nWhat we captured is a sign-in request with offline_access. In Microsoft's model that gets a token acting for the admin who signs in, which fits Atlassian's line that synced connectors index \"using a service or admin account\". Nothing we saw rules out the same app registration also holding application permissions used another way. Only the consent screen or the Permissions list in Entra would show that.\n\nUntil spring 2026 you created the Entra app. The archived connect page (12 March 2026) said \"Select Application permissions\" and listed eight Graph ones, from Directory.Read.All and Sites.Read.All to AuditLogsQuery-SharePoint.Read.All, plus ActivityFeed.Read and a tenant-scoped SharePoint read.\n\nThat list was read-only, which isn't greedy by comparison. Glean's SharePoint connector asks for Sites.FullControl.All in its standard setup, and \"All permissions must be granted as Application permissions.\" Glean does document Microsoft's Sites.Selected, which limits an app to chosen site collections, as an alternative it doesn't recommend, and Google documents it too. No Atlassian page we read mentions it. I'd ask Atlassian before assuming either way.\n\nIt ran on Azure Access Control Service (ACS), Microsoft's old SharePoint add-in authentication, retired for existing tenants on 2 April 2026. Atlassian announced the move to \"an Atlassian-managed Microsoft Entra app\" on 31 March. Connectors left on legacy auth \"may stop syncing\", leaving Rovo \"reasoning over stale data\".\n\nIf I were the CISO, I'd read this part first. SharePoint is a synced connector, and Atlassian's privacy page says those store \"the content for each file\" and \"permissions settings about the file\". Your content sits in the Teamwork Graph, and the permission check runs against Atlassian's synced copy of your SharePoint permissions.\n\nMicrosoft 365 Copilot works differently. Its data is \"processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365\". This connector moves a copy out of Microsoft 365 into Atlassian, which you can at least pin with Atlassian's data residency.\n\nPer the connect page it copies Word (.doc, .docx), Excel (.xls, .xlsx), PowerPoint (.ppt, .pptx), PDFs up to 10 MB, and web pages (.html, .aspx). It stores each file's body along with its name, URL, dates, creator and collaborators. \"Encrypted documents do not get ingested.\" SharePoint lists aren't mentioned, and neither is what happens to a 12 MB PDF.\n\nPeople come along too. The People data tab always indexes display name and email address. A toggle, on by default, adds job title, manager and department. The doc's own list has hire date and no manager, so check the screen you actually get.\n\nOneDrive arrives through Include personal sites. One Atlassian page says it comes \"automatically\"; the setup screen says \"OneDrive is off by default\", and the toggle was off. Trust the screen.\n\nAtlassian's permission-sync page covers changes to a document, not to a person. Restrict a file at the source and it \"Only shows up in search results for those with permissions\". Remove the restriction and it's \"Visible in Search for everyone using Rovo on your site\". Delete it and it's \"Removed from Rovo, including Search, Chat, and Agents\".\n\nIt has no row for someone who leaves or is taken out of a SharePoint group. How long a change takes to land isn't on any Atlassian page we read either.\n\nSo I'd treat the connector as exactly as tight as your SharePoint sharing. The setup page puts it this way: \"Permissions are always respected. We encourage you to review your permissions in Microsoft SharePoint and OneDrive before connecting. Content that has not been restricted will appear in search results for all users.\" A site the whole company can open in SharePoint is just as open in Rovo.\n\nIn the Choose content modal, Include SharePoint sites starts on and Include personal sites starts off. \"At least one must be on. If both are off, nothing is indexed.\"\n\n| Control | What it does | Limits | \n|---|---|---|\n| Allow SharePoint sites | Only listed sites are indexed | Up to 50 URLs; URLs aren't checked | \n| Block SharePoint sites | Everything except listed sites is indexed | Up to 50 URLs; a blocked URL wins over the allow list | \n| Limit by date | Only content created or modified after a date | One date for the whole connector | \n| Limit by labels | Blocks files with listed sensitivity label GUIDs | GUIDs read in Microsoft Graph Explorer by an admin with SensitivityLabels.Read.All | \n| Allow / Block personal sites | Personal sites (OneDrive) by Microsoft 365 Group ID | See below | \n\nFifty entries is plenty for \"the IT wiki and the HR policy site\", and a site created next month stays out until you add it. A block list works the other way round: every new site is indexed by default, and anything on it that isn't access-restricted in SharePoint shows up for every Rovo user.\n\nI'd watch the personal sites allow list. A blank one means all users, so turning Include personal sites on with an empty list puts every OneDrive in the tenant in scope.\n\n\"Blocking or allowing individual files or folders is not supported.\" A sensitive folder inside an allowed site goes in unless something else stops it.\n\nAtlassian added label blocking on 3 June 2026, and for a blocked label \"None of its content, metadata, or embeddings reach Rovo's index.\" Label a file after it was indexed and \"it stops appearing in Rovo search immediately and is purged from the index on the next full scan.\" I couldn't find how often the full scan runs.\n\nEncrypted files are skipped anyway, so it's the labels you use without encryption that need listing. You read their GUIDs in Graph Explorer, Microsoft's web console for calling the Graph API.\n\nThe connector step says \"Rovo can use Microsoft SharePoint and OneDrive data in chat and agent responses\". Atlassian's own bug tracker says that doesn't fully work yet.\n\n[ROVO-529](https://jira.atlassian.com/browse/ROVO-529), \"Rovo Chat/Agent cannot read or search content from SharePoint resources\", is a bug in Short Term Backlog with 41 votes. Its description: \"The SearchTool is able to read SharePoint file metadata (e.g. filename), but not file contents.\" It was filed in December 2025, before the new connector. On 4 September 2026 Chait Donthini, the Atlassian who wrote the March connector announcement, asked in the ticket whether it was fixed, saying users should be able to reach SharePoint from chat and agents. A customer answered three days later: \"No, it's not resolved.\"\n\nPages are the other gap. The connect page lists .aspx. Suggestion AI-1233 (22 votes, still Gathering Interest) was filed in September 2025 saying pages created in SharePoint \"can't be ingested as of now\", and Atlassian hasn't closed it since .aspx appeared in the doc. I haven't tested either on a live tenant, so pilot with one known file and one known page.\n\nThe same screen says \"External AI models don't process this data.\" Rovo's data handling page says its hosted LLM partners run under zero data retention. How those fit when Chat answers from a SharePoint file, neither page explains. I'd ask Atlassian in writing.\n\nOne more. A Bugcrowd disclosure Varonis named RovoBlast, reported on 4 November 2025 and fixed on 8 July 2026, says the technique \"was also demonstrated against data reachable through connected surfaces (Jira, and third-party connectors such as SharePoint and Outlook).\" So a bug in Rovo can reach what you index, whoever is allowed to search it.\n\n\"Connecting Teamwork Graph connectors and indexing data does not consume your Rovo credit allowance.\" It counts against indexed objects instead: 100 per user on Standard Jira or Confluence, 250 on Premium, 625 on Enterprise, and 1,000 to 6,250 on Teamwork Collection (Service Collection gets the same as Jira). Nothing on that page covers going over.\n\nI pulled our own usage export (8 Sep to 20 Oct 2026, no connectors). The Teamwork Graph line was 1 event and 0 credits. Rovo Chat was 19 events and 1,435 credits ([how to pull that export](https://leanzero.net/tutorials/check-rovo-credits-usage-each-user?utm_source=devto&utm_medium=referral&utm_campaign=crosspost)).\n\nTo get out, hide the app from Search or disconnect it. \"It will take 48 hours to completely disconnect most apps.\" Cached data \"may persist for up to 5 minutes\". After uninstalling, stored content is deleted \"within 30 days\". Turning Rovo off doesn't switch Search connectors off, as we found when we looked at [what stays on when you disable Rovo](https://leanzero.net/blog/disable-rovo-jira-confluence?utm_source=devto&utm_medium=referral&utm_campaign=crosspost).\n\nWhat I'd do, in this order:\n\nThe exact Graph permissions on the indexing app, and whether any are application permissions.\n\nWhich \"service or admin account\" the indexer runs as, and whether it supports Sites.Selected.\n\nWhat happens in Rovo when a user leaves or loses a SharePoint group, and how fast.\n\nHow often permission sync and the full scan run. No Atlassian page we read gives a number.\n\nWhat happens to PDFs over 10 MB, to SharePoint lists, and when you exceed the indexed-objects allowance.\n\nWhether connector content counts as the \"customer data\" in Rovo's no-training sentence. Atlassian's connector privacy page promises no training only for Google Workspace data, and says nothing similar for SharePoint.\n\nThe setup page's own \"Learn how permissions are kept in sync\" link returns a 404 today. The page lives at a slightly different URL.\n\nIf you've clicked Authorize on a real tenant, what did Microsoft's consent screen and then Entra list under the indexing app's permissions, delegated or application? And did your security team sign it off as it was, or send you back with questions? Tell me in the comments. Even just the permission names would help everyone reading.\n\nOriginally published on [leanzero.net](https://leanzero.net/blog/rovo-sharepoint-connector-permissions?utm_source=devto&utm_medium=referral&utm_campaign=crosspost). More Atlassian, Forge and local-AI write-ups at [leanzero.net/blog](https://leanzero.net/blog?utm_source=devto&utm_medium=referral&utm_campaign=crosspost), and if you're planning a migration or a Forge app, that's what we do: [leanzero.net/services](https://leanzero.net/services?utm_source=devto&utm_medium=referral&utm_campaign=crosspost).", "url": "https://wpnews.pro/news/rovo-sharepoint-connector-permissions-sites-and-consent", "canonical_source": "https://dev.to/mihai_leanzero/rovo-sharepoint-connector-permissions-sites-and-consent-5bce", "published_at": "2026-10-26 08:59:47+00:00", "updated_at": "2026-10-26 09:13:04.716725+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "agent-protocols", "ai-tools"], "entities": ["Atlassian", "Rovo", "SharePoint", "Microsoft", "OneDrive", "Teamwork Graph", "Entra", "Atlassian Guard"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/rovo-sharepoint-connector-permissions-sites-and-consent", "markdown": "https://wpnews.pro/news/rovo-sharepoint-connector-permissions-sites-and-consent.md", "text": "https://wpnews.pro/news/rovo-sharepoint-connector-permissions-sites-and-consent.txt", "jsonld": "https://wpnews.pro/news/rovo-sharepoint-connector-permissions-sites-and-consent.jsonld"}}