Integration · Knowledge + docs
On roadmap — not yet shippedClarityLift + SharePoint
SharePoint document-comment signals via Microsoft Graph. Roadmap — not yet shipped. Document body content is out of scope.
Signals derived from SharePoint
Team friction (comment tone on shared documents)
Communication health (review and comment patterns)
OAuth scopes ClarityLift requests
Every scope below has a documented purpose tied to a specific step in the data flow. ClarityLift never requests scopes it does not use.
Sites.Read.All
List SharePoint sites
Files.Read.All
Read file metadata and comments
Data flow, end to end
- 1Tenant admin grants Graph application permissions.
- 2Admin selects which SharePoint sites to include.
- 3ClarityLift uses Graph delta queries to detect new comments on documents.
- 4Aggregate signals derived from comment threads.
What ClarityLift does NOT read on SharePoint
The privacy posture is led by what is excluded, not what is included.
- Direct messages between individuals — never read, ever.
- Group DMs — out of scope by design.
- Channel content from teams below the 10-member group floor.
- Personal account content of any kind.
- Document body content.
- Sites containing customer-facing or regulated content (legal team should pre-screen).
- PHI-adjacent sites in healthcare deployments — explicitly excluded per ClarityLift’s healthcare deployment posture.
Retention
No comment text persisted. Aggregate signals only.
Privacy considerations specific to SharePoint
- SharePoint contains the most varied content of any integration — admin pre-screen of sites is required before connecting.
- In regulated industries (healthcare, finance), SharePoint sites holding regulated data should not be connected.
- OAuth tokens encrypted at rest (CL_ENCRYPTION_KEY).
What the customer does at install time
- 1.Tenant admin grants Graph permissions.
- 2.Admin pre-screens and selects sites to include.
- 3.Admin maps sites to internal teams.