Implement information extraction solutions 5.1 Build retrieval and grounding pipelines
An agent must answer questions from SharePoint content through a Foundry IQ knowledge…
Study guide skill: Connect retrieval pipelines directly to workflows and agent tools
Question B2-029
An agent must answer questions from SharePoint content through a Foundry IQ knowledge base. Content must not be copied into a search index, results must always be current, and SharePoint must enforce each user's document permissions at query time. Which knowledge source should you use?
Select one answer.
Answer: B
Remote knowledge sources don't ingest or store data; they query the external system on demand, so data is always current. For a remote SharePoint knowledge source (preview), the x-ms-query-source-authorization header passes the user's identity so SharePoint enforces document permissions through the Copilot Retrieval API. Each querying user needs either a Microsoft 365 Copilot add-on license that includes Retrieval API usage or Retrieval API pay-as-you-go enabled. Indexed sources, blob exports, and vector stores all copy the content.
Deep dive
How it works
Foundry IQ knowledge bases use two kinds of knowledge source, and the requirements pick one cleanly:
- Indexed knowledge sources ingest data into a search index, handling chunking, vectorization and ACL synchronization. SharePoint, Blob Storage and OneLake can all be indexed. Freshness depends on your indexer schedule.
- Remote knowledge sources don't ingest or store data. They issue on-demand queries to the external system at retrieval time, so data is always current. SharePoint is supported remotely through the Copilot Retrieval API.
"Not copied, always current, SharePoint enforces permissions" is the remote SharePoint knowledge source (preview). It queries live content directly at retrieval time, and you don't need a search index or connection string.
Permissions work through the caller's identity. Pass the user's token in the x-ms-query-source-authorization header, and SharePoint enforces document permissions at query time through the Copilot Retrieval API. The identity must be recognized by both the Azure tenant and the Microsoft 365 tenant. Licensing is a prerequisite: each querying user needs a Microsoft 365 Copilot add-on license that includes Retrieval API usage, or Retrieval API pay-as-you-go enabled.
The other options, and when you'd use them
- Blob Storage with exported SharePoint files: Exporting is copying, and Blob Storage is an indexed source that ingests data into a search index. Permissions and freshness would depend on your export and indexer.
- A file search vector store: File search uploads files into a vector store that Azure AI Search ingests. It's a copy, and it's built for documents users provide, not live SharePoint permissions.
- Indexed SharePoint with a daily indexer: Indexed sources ingest data, and refresh frequency depends on the indexer schedule. A daily run is neither copy-free nor always current.
Exam tip
"Don't copy, always current" = remote knowledge source. Remote SharePoint + x-ms-query-source-authorization = SharePoint enforces each user's permissions.
References
Last reviewed: