SharePoint: Declarative Agent Finder

Key insights

• SharePoint Agents Finder: A declarative agent that lets Copilot list and surface SharePoint agents and files across a tenant using natural-language queries.
  It uses the Microsoft Graph Search API as a Copilot plugin to return structured results like tables with direct links.
• Implementation steps: Generate a Graph plugin from the OpenAPI spec with the Kiota VS Code extension, register an Entra ID app with Files.Read.All, add an auth client in the Teams Developer Portal, and import the plugin with the Microsoft 365 Agents Toolkit.
  These steps wire a secure plugin into Copilot for real-time search calls.
• How it runs: Copilot invokes the plugin action and sends a shaped request body to /search/query, then prompts the agent and presents results as a table of agent files.
  The table includes direct SharePoint links so users can open items quickly.
• Permissions and security: Agents inherit site permissions and the app uses Entra ID auth to enforce access control.
  Follow least-privilege practice when granting scopes like Files.Read.All to reduce exposure.
• Key benefits: Faster discovery of agents and documents, clear structured responses, and low setup because agents are auto-created per site.
  The approach scales and can be extended to improve result formatting and linking to agent sources.
• Community and adoption: Microsoft and community demos (including mid-2025 sessions) and PnP samples show patterns for building and deploying these declarative agents.
  Access requires Copilot licensing or consumption-based options, and admins can monitor and manage agents centrally.

Microsoft published a recent YouTube demo that showcases a practical build of the SharePoint Agents Finder as a declarative agent. Accordingly, the presentation by Mohammed Amer walked viewers through integrating the Microsoft Graph Search API as a Copilot plugin and wiring it into Microsoft 365 Copilot. Furthermore, the video demonstrated both the developer steps and the live results, producing a table of agent files with direct links to SharePoint. As a result, the demo offers an accessible blueprint for teams that want to add conversational search capabilities to their tenant.

What the demo shows

The walkthrough begins by generating a Copilot plugin from the Graph OpenAPI spec, using developer tooling to create clean, typed API bindings. Then, the presenter secures access with an Entra ID app permission (notably Files.Read.All) and registers an authentication client in the Teams Developer Portal. Next, the plugin gets imported via the Microsoft 365 Agents Toolkit and connected to the declarative agent. Consequently, Copilot can call the Graph /search/query endpoint and return structured results inside the chat experience.

Throughout the demo, Mohammed Amer emphasized how the request body is shaped for the Graph search call and how prompts are crafted to produce useful, tabular outputs. He showed how to prompt the agent, call the plugin action, and then present results that include direct links to the SharePoint items. Thus, users receive a conversational interaction that replaces manual browsing of libraries and folders. In addition, the demo highlights how declarative agents streamline connector logic without requiring bespoke code for each operation.

Security, permissions, and governance

Security plays a central role, and the demo balances convenience with strict access controls by using standardized app permissions and platform registration. For instance, granting Files.Read.All requires careful governance because it broadens read access across the tenant, so administrators must assess risk and apply least-privilege where possible. Moreover, registering an auth client in the Teams Developer Portal and controlling which plugins are available lets teams limit exposure to only approved agents. Therefore, the approach keeps the workflow secure while enabling the necessary data access for useful search results.

At the same time, there is a tradeoff between broad search capability and granular access control: wider search scopes give better coverage but increase the importance of compliance monitoring and auditing. Accordingly, organizations should combine permission design with logging and policy enforcement to reduce risk. In short, governance must evolve in step with agent deployment to maintain both usability and compliance.

Tradeoffs and implementation challenges

Implementers will face several tradeoffs, especially around performance, maintainability, and user experience. For example, shaping rich table responses improves usability but can require additional formatting logic and careful prompt design to avoid ambiguous results. Similarly, relying on the Graph Search API simplifies integration but also places dependence on API quotas and search relevancy tuning, which may require iterative refinement. Thus, teams must weigh the immediate productivity benefits against the ongoing cost of tuning and operational support.

Another challenge stems from managing many declarative agents at scale: while agents provide a low-code path, they still need lifecycle management, version control, and monitoring. Consequently, organizations should plan for maintenance processes and automation to update agents, audit their outputs, and retire stale entries. Ultimately, the balance between low-code convenience and operational overhead will determine long-term success.

Practical implications and next steps

For technical teams, the demo offers a repeatable pattern: generate a plugin from an OpenAPI spec, secure it with Entra ID, register an auth client, and then wire the action into a declarative agent using the toolkit. Next, prompt engineering and response shaping turn raw search results into usable UI elements within Copilot chat. Consequently, teams can roll out conversational search rapidly while iterating on prompts and result formatting to improve relevance and clarity.

For leaders and administrators, the video underscores the need to align adoption with governance and user training so stakeholders understand both capabilities and limits. Finally, while the demo accelerates build steps, production readiness requires attention to permission scoping, monitoring, and policy compliance. Overall, the demo by Mohammed Amer serves as a practical guide that balances functionality with the careful controls organizations need when deploying AI-driven search in Microsoft 365.

Keywords

SharePoint Agents Finder, declarative SharePoint agents, building SharePoint agents, SharePoint agent automation, SharePoint search agents, Power Platform SharePoint agents, Microsoft Graph SharePoint agents, SharePoint development best practices