ChatGPT and SharePoint: Setup, Permissions and Plan Limits

The ChatGPT SharePoint connector is now called the SharePoint app. It lets a signed-in user search, read and summarize SharePoint and work OneDrive files inside ChatGPT in real time, using that user's own Microsoft 365 permissions, and it can take write actions such as uploading a file only where a workspace admin has enabled them. Setup has two halves: a ChatGPT workspace owner or admin enables the app and selects the Microsoft Graph permissions it will request, and a Microsoft Entra administrator grants organization-wide consent to the "ChatGPT / OpenAI, L.L.C." application. The synced, administrator-managed version that indexed sites has been retired: OpenAI's Enterprise and Edu release notes for October 16, 2026 tell administrators to use the real-time SharePoint app instead.

This guide covers the ChatGPT side of that connection: what the app does, whether it honors your permissions, the setup steps for both admins, plan limits and the fixes for the usual failures. If you are rolling out Microsoft 365 Copilot and want outside systems indexed into Microsoft Search and Copilot, that is a different product with its own page, Microsoft Graph connectors for Copilot and Search.

What can ChatGPT do with SharePoint?

OpenAI's SharePoint app article describes live access: ChatGPT searches and references SharePoint and supported OneDrive for work or school content that the connected Microsoft account can already open, so a user can find, summarize and compare files or draft an update from them. Deep research uses the app's read actions. The Company Knowledge plugin, available on ChatGPT Business, Enterprise and Edu, answers from connected sources and, in OpenAI's words, respects permissions in the connected source. Write actions exist (creating folders, uploading or updating files, managing sharing links, working with supported lists and pages) but depend on permissions and admin settings, and approved Microsoft permissions do not enable them on their own. OpenAI's article on custom MCP servers, opened the same day, still describes OpenAI-built apps as search-only, so confirm which write actions your workspace offers in its Actions panel before promising them to staff.

Two searches deserve a direct answer. "ChatGPT in SharePoint": there is no supported way to run ChatGPT inside a SharePoint page; the integration runs from ChatGPT into SharePoint, and Microsoft 365 Copilot is the assistant inside SharePoint. "Azure OpenAI SharePoint integration": Azure OpenAI is Microsoft's hosted set of OpenAI models in Microsoft Foundry, billed through an Azure subscription, for building your own application; connecting it to SharePoint is a custom build with Microsoft Graph, covered in the last section.

Does ChatGPT respect SharePoint permissions?

Yes. OpenAI states that ChatGPT only retrieves content the connected account can already access, that SharePoint, OneDrive and Microsoft 365 group membership still apply, and that members cannot see files they cannot open in SharePoint. The mechanism is Microsoft's: the app uses delegated Graph permissions, and Microsoft's Graph permissions overview says that in a delegated scenario the application can't access anything the signed-in user couldn't access. The consequence is the same one Copilot customers met: ChatGPT will surface anything a person can open, including the folder shared with "Everyone" in 2019. Clean that up first with our guide to fixing SharePoint oversharing and the audit in SharePoint permissions best practices.

Two controls that OpenAI lists among its Enterprise safety and security settings, and that must be enabled for the workspace, narrow access further. A site-collection policy allows or blocks specific SharePoint site collections (an allowlist or a blocklist, not both), and sensitivity-label exclusions remove files carrying listed label GUIDs from results. OpenAI's article on SharePoint site access and sensitivity-label exclusions notes that encrypted content is excluded by default, that label filtering works only where Graph exposes label metadata (so TXT and CSV files are treated as unlabeled), and that none of this replaces Microsoft permissions.

Synced versus on-demand access: what changed in 2026?

The permission row matters for a Microsoft administrator who prefers Sites.Selected, the Graph scope that limits an app to named site collections. OpenAI's article says Sites.Selected is not supported for live SharePoint search and that Sites.Read.All and Files.Read.All must be enabled in both ChatGPT and Entra. Per-site restriction therefore comes from OpenAI's site-collection policy, enforced before results reach the user and the model, rather than from Graph.

Which plans include the SharePoint app, and what are the limits?

OpenAI's app article does not list plans; it says availability depends on the ChatGPT plan, location, workspace settings, the Microsoft account and Microsoft Entra policies. The admin controls described on this page exist in Business, Enterprise and Edu workspaces. OpenAI's admin controls for plugins and apps say that in ChatGPT Business apps are enabled by default and administrators can change workspace-wide availability, while new Enterprise and Edu workspaces start with a selected set of apps enabled and assign apps per role. Limits as of October 2026: supported search formats are .txt, .pdf, .docx, .pptx, .xlsx and .csv; files over 100 MiB are excluded from search; text extraction can fail for some files that appear in results; personal OneDrive accounts are not supported; and scheduled tasks and workspace agents may require different authorization than chat use.

How do you set up the ChatGPT SharePoint app?

1. Decide the scope. Which site collections, which pilot group, and read-only for the first month.
2. Fix sharing first. Run the oversharing checks (everyone links, dormant guests, broken inheritance) before any AI tool can search the tenant.
3. Select permissions in ChatGPT. A workspace owner or admin opens the Admin console, selects the workspace, opens Plugins and chooses Configure Microsoft permissions (legacy workspaces: Manage Legacy Apps, then the app's Microsoft permissions). Required permissions stay selected; leave the ReadWrite scopes off for a read-only pilot.
4. Grant admin consent in Entra. Select Review permissions in Microsoft Entra and sign in as an administrator who can grant organization-wide consent. Microsoft's guide to tenant-wide admin consent names Privileged Role Administrator for any permission, and Cloud Application Administrator or Application Administrator for anything except Graph application permissions. Confirm the organization and the "ChatGPT / OpenAI, L.L.C." application, then Accept; the screen has no per-permission checkboxes.
5. Limit who can use it. Microsoft notes that tenant-wide consent lets all users access the application unless restricted; set the enterprise application to require user assignment and assign the pilot group.
6. Enable actions in ChatGPT. Consent does not turn anything on. Enable read actions only, set the approval mode to "Always ask" or "Allow read actions", and apply the site-collection policy and label exclusions where available.
7. Connect users. Each member opens Plugins or Apps, selects SharePoint, signs in with a work or school account, reviews the permissions and returns to ChatGPT.
8. Test with the pilot group. A file they can open, a file they cannot, a labeled file and a file over 100 MiB; the results should match SharePoint exactly.

What should the Microsoft 365 administrator check before consenting?

Microsoft describes granting admin consent on behalf of an organization as a sensitive operation, so read the request. The scopes OpenAI's article names, with Microsoft's delegated descriptions: User.Read (sign in and read the user's profile); offline_access (keep the connection without signing in for every request); Files.Read.All (read all files the signed-in user can access); Sites.Read.All (read documents and list items in all site collections on behalf of the signed-in user); and, only when write actions are wanted, Files.ReadWrite.All and Sites.ReadWrite.All. All are delegated, so they never exceed the user. Three settings around the consent matter as much: keep user consent restricted to verified publishers for low-impact permissions, enable the admin consent workflow so staff can request rather than self-approve, and know where to review and revoke later (Entra ID, Enterprise apps, the application, Permissions, the Admin consent tab).

Then the data path. OpenAI's enterprise privacy page says ChatGPT respects your organization's existing permissions, that each user must authenticate with a connected application before use, and that by default OpenAI does not train its models on data accessed from apps; Business and Enterprise workspace data is not used for training by default either. Retention is set by workspace admins, and deleted conversations are removed within 30 days. Tell your compliance owner that file content a user asks about becomes part of a ChatGPT conversation stored under that retention policy; it does not stay only in the tenant.

Troubleshooting the SharePoint app

• "Need admin approval" at connection. Consent has not been granted or a grant was changed in Entra; rerun the approval flow from ChatGPT. If the Entra window never opens, allow pop-ups for ChatGPT.
• SharePoint is missing from the app list. Check workspace enablement, role access and any approved-domain policy that limits which account domains can connect.
• An action fails after approval. Confirm the action is enabled in ChatGPT, the grant still exists in Entra, the right Microsoft account is connected, and the member reconnected after new permissions were added.
• A file is missing or cannot be read. Check format, size, the user's direct access in SharePoint, site restrictions and label exclusions; start a new conversation after any policy change, or paste a direct link to the file.

When do you need a custom API project instead?

When the job is more than reading files in a chat: writing results into a line-of-business system, running on a schedule, combining SharePoint with systems that have no app, or restricting an integration to named sites at the Graph level. Those are builds: an application on Microsoft Graph, where Sites.Selected does work and grants access per site collection, or a custom MCP server that ChatGPT Business and Enterprise admins publish as a plugin.

How NetSys sets up ChatGPT with SharePoint

Under our ChatGPT Business workspace setup service we configure the workspace, verify the domain and SSO, and enable apps deliberately rather than by default. For the SharePoint connection, our OpenAI and ChatGPT integration service runs the sharing cleanup, selects the scopes, performs the Entra consent with your administrator, assigns the pilot group, sets the site policy and label exclusions, and documents the permissions so your security owner can revoke them in Entra without calling us. The same engineers manage the Microsoft 365 tenant, so the app and the tenant stay in step.

Request a SharePoint and ChatGPT review before the first connection is approved.

Frequently asked questions

Can ChatGPT access SharePoint?

Yes, through the SharePoint app, once a Microsoft Entra administrator has consented to the permissions and the user has connected a work or school account. It reads only what that user can already open, in real time; it does not index the tenant.

Does ChatGPT Enterprise still sync SharePoint?

No. OpenAI retired individual sync on August 14, 2026 and administrator-managed sync on October 16, 2026, and directs Enterprise and Edu workspaces to the real-time SharePoint app. Enterprise keeps extra controls, such as sensitivity-label exclusions and role-based app assignment.

Does the SharePoint app work on ChatGPT Plus?

OpenAI's article does not list plans and says availability depends on the plan, region, workspace settings and Entra policies. The consent, site-policy and action controls on this page belong to Business, Enterprise and Edu workspaces; a company should connect SharePoint from a workspace it administers, not from personal accounts.

Is our SharePoint content used to train ChatGPT?

OpenAI says that by default it does not train its models on data accessed from apps, and that Business, Enterprise and Edu workspace data is not used for training by default. Conversations that include file content are stored under your workspace retention settings.

Can ChatGPT upload or edit files in SharePoint?

Only if the ReadWrite scopes were consented in Entra and a workspace admin enabled the write actions; ChatGPT may ask the user to confirm each change. For a first rollout, leave the write scopes off.

What is the difference between the ChatGPT SharePoint app and a Microsoft Graph connector?

Direction. The SharePoint app lets ChatGPT read SharePoint. A Microsoft Graph connector, now documented as a Microsoft 365 Copilot connector, brings data from outside systems into Microsoft Search and Copilot. They do not replace each other.