{"id":176,"date":"2026-03-21T09:03:32","date_gmt":"2026-03-21T09:03:32","guid":{"rendered":"https:\/\/medlearn.imperial.ac.uk\/innovation\/projects\/medlearn-sharepoint-qa-agent\/"},"modified":"2026-04-09T14:36:03","modified_gmt":"2026-04-09T14:36:03","slug":"medlearn-sharepoint-qa-agent","status":"publish","type":"page","link":"https:\/\/medlearn.imperial.ac.uk\/innovation\/projects\/medlearn-sharepoint-qa-agent\/","title":{"rendered":"MedLearn SharePoint Q&A Agent"},"content":{"rendered":"\n\n
\n \n \n \n \n \n \n <\/linearGradient>\n <\/defs>\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n AI Agent<\/text>\n \n \n \n \n SharePoint<\/text>\n \n MedLearn<\/text>\n SharePoint<\/text>\n Q&A Agent<\/text>\n Restricted-folder document querying \u00e2\u0080\u0094 POC<\/text>\n \n \n AI<\/text>\n \n Integration<\/text>\n \n POC<\/text>\n <\/svg>\n<\/div>\n\n

A proof-of-concept to let authorised MedLearn staff query specific SharePoint folders<\/strong> \u00e2\u0080\u0094 SOPs, how-tos, and technical notes \u00e2\u0080\u0094 using natural language, and receive answers with source citations. Requested by Alex Furr (DEO Lead), initially scoped for five named users.<\/p>\n\n\n\n \n \n \n \n \n \n
Status<\/td>\n POC \u00e2\u0080\u0094 in development<\/td>\n <\/tr>\n
Requester<\/td>\n Alex Furr, DEO Lead \u00e2\u0080\u0094 Digital Education Office<\/td>\n <\/tr>\n
Team<\/td>\n Adrian Cowell<\/td>\n <\/tr>\n
Tech stack<\/td>\n Python, Microsoft Graph API, Microsoft Entra ID (OAuth2), RAG \/ vector embeddings, WordPress plugin<\/td>\n <\/tr>\n
Users<\/td>\n ~5 named Imperial staff (DEO team)<\/td>\n <\/tr>\n
GitHub<\/td>\n github.com\/adrianImperial\/medlearn-Sharepoint<\/a><\/td>\n <\/tr>\n<\/table>

The Challenge<\/h2>\n

The MedLearn and DEO teams maintain a growing body of operational knowledge \u00e2\u0080\u0094 SSH commands, deployment procedures, platform SOPs, infrastructure how-tos \u00e2\u0080\u0094 spread across SharePoint folders. Finding a specific piece of information requires knowing which folder to look in, navigating SharePoint’s interface, and reading through documents manually.<\/p>\n

The request is simple in concept: point an agent at those folders and ask it questions<\/em>. The implementation involves careful decisions around permissions, data governance, and where processing can take place \u00e2\u0080\u0094 particularly given Imperial’s M365 environment and information security requirements.<\/p>\n\n

What It Will Do<\/h2>\n

When complete, the agent will:<\/p>\n

    \n
  • Index documents from specified SharePoint folders only<\/strong> \u00e2\u0080\u0094 no access beyond the defined scope<\/li>\n
  • Extract and chunk text from docx, pdf, and pptx files<\/li>\n
  • Answer natural-language queries (e.g. “What is the SSH command to connect to MedLearn prod?”<\/em>) with verbatim supporting snippets and links back to the source file<\/strong><\/li>\n
  • Respect each user’s existing SharePoint permissions via delegated Microsoft Entra ID authentication \u00e2\u0080\u0094 no user can retrieve documents they couldn’t already access<\/li>\n
  • Log queries and cited sources for audit purposes<\/li>\n<\/ul>\n

    A second surface \u00e2\u0080\u0094 a Microsoft Teams bot or Copilot Studio agent \u00e2\u0080\u0094 is in scope as a follow-on once the core service is validated.<\/p>\n\n

    Architecture<\/h2>\n\n
    \n
    \n

    Auth<\/p>\n

    Delegated Microsoft Entra ID (OAuth2 authorisation code flow). Each user signs in \u00e2\u0080\u0094 the agent uses their Graph token and inherits their SharePoint permissions.<\/p>\n <\/div>\n

    \n

    Ingestion<\/p>\n

    Microsoft Graph API enumerates target folders, downloads file content, extracts text, chunks it, generates embeddings, and stores with metadata (filename, SharePoint URL, last modified).<\/p>\n <\/div>\n

    \n

    Retrieval & Answer<\/p>\n

    Query is embedded and matched against the vector store. Top chunks are passed to an LLM with a strict citation requirement. If confidence is low, the agent says so and returns the most relevant documents instead.<\/p>\n <\/div>\n

    \n

    MedLearn UI<\/p>\n

    A protected WordPress page with a chat interface. Calls the retrieval service and renders answers with cited filenames and SharePoint links. SSO-gated to authorised users only.<\/p>\n <\/div>\n<\/div>\n\n

    POC Scope & Constraints<\/h2>\n

    To keep the first build fast and governable, the POC is intentionally constrained:<\/p>\n

      \n
    • Folders:<\/strong> 2\u00e2\u0080\u00933 specific SharePoint folder URLs (to be confirmed by requester)<\/li>\n
    • Users:<\/strong> exactly 5 named Imperial staff \u00e2\u0080\u0094 access is not open<\/li>\n
    • Auth model:<\/strong> delegated (per-user sign-in, not a service account)<\/li>\n
    • File types:<\/strong> docx, pdf, pptx, txt\/md \u00e2\u0080\u0094 no OCR on scanned PDFs in v1<\/li>\n
    • Answer format:<\/strong> verbatim snippets + SharePoint file link + last-modified date<\/li>\n
    • Audit log:<\/strong> user ID, query, file URLs cited \u00e2\u0080\u0094 stored server-side<\/li>\n<\/ul>\n\n
      \n

      Pending from requester<\/p>\n

      Exact SharePoint folder URLs, confirmation of 5 authorised user accounts, and confirmation that external LLM use (outside M365) is approved by ICT\/InfoSec. These are required before the indexing service can be built.<\/p>\n<\/div>\n\n

      Next Steps<\/h2>\n
        \n
      1. Confirm SharePoint folder URLs and authorised user list with Alex Furr<\/li>\n
      2. Confirm ICT\/InfoSec position on external LLM use vs Azure OpenAI<\/li>\n
      3. Register app in Microsoft Entra ID (Imperial tenant) \u00e2\u0080\u0094 delegated permissions<\/li>\n
      4. Build ingestion service (Graph \u00e2\u0086\u0092 text extraction \u00e2\u0086\u0092 embeddings \u00e2\u0086\u0092 vector store)<\/li>\n
      5. Build retrieval + answer layer with citation enforcement<\/li>\n
      6. Build WordPress chat UI page (SSO-gated)<\/li>\n
      7. Pilot with 5 users, gather feedback, assess Teams surface viability<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

        AI Agent SharePoint MedLearn SharePoint Q&A Agent Restricted-folder document querying \u00e2\u0080\u0094 POC AI Integration POC A proof-of-concept to let authorised MedLearn staff query specific SharePoint folders \u00e2\u0080\u0094 SOPs, how-tos, and […]<\/p>\n","protected":false},"author":16,"featured_media":0,"parent":7,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-176","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/pages\/176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/comments?post=176"}],"version-history":[{"count":2,"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/pages\/176\/revisions"}],"predecessor-version":[{"id":269,"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/pages\/176\/revisions\/269"}],"up":[{"embeddable":true,"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/pages\/7"}],"wp:attachment":[{"href":"https:\/\/medlearn.imperial.ac.uk\/innovation\/wp-json\/wp\/v2\/media?parent=176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}