How to connect AI to your internal documents: SharePoint, Google Drive and more

To use AI with internal documents, switch on the permission-aware connector of the platform your team already pays for: Microsoft 365 Copilot for SharePoint and OneDrive, Gemini for Google Drive, or the Claude and ChatGPT connectors for either. Each tool shows an employee only what that employee can already open. That protects confidentiality, and it also exposes every oversharing mistake already hiding in your file permissions.

Most document-AI projects stall before the model matters. Gartner reported in January 2026 that at least 50% of generative AI projects had been abandoned after proof of concept by the end of 2025, citing poor data quality, inadequate risk controls, escalating costs or unclear business value (Gartner, 2026). This guide shows you how to connect SharePoint, Google Drive and other sources, what each route costs, and how to avoid those four failure causes.

The short answer: switch on the connector you already pay for

Start with your existing suite, not a new platform. Three rules cover most mid-size companies:

• Mostly Microsoft 365: Microsoft 365 Copilot ($30 per user per month) or Copilot Business ($21, up to 300 users), plus Copilot Studio agents for each knowledge domain.
• Mostly Google Workspace: Gemini, bundled in Workspace Business Standard and above. Add Gemini Enterprise when you need SharePoint, Jira or other sources in one search.
• Mixed stack: ChatGPT Business or Claude Team, each $20 per seat billed annually, plus MCP servers for sources with no native connector.

Build custom RAG only for the gaps these tools leave. The cost section below lists them.

Five ways to use AI with your internal documents

Treat these as layers. The first is your default; the others fill specific needs.

Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls (Gartner, 2025). Reliable retrieval comes first; agents earn their return on top of it. Our guide to AI agents for business covers that second layer.

Step by step: connect SharePoint and OneDrive

1. Pick one front end and one owner team. Your options: Microsoft 365 Copilot or Copilot Studio, the Claude Microsoft 365 connector, or the ChatGPT SharePoint app.
2. Check licences. Copilot needs a qualifying Microsoft 365 licence plus Copilot or Copilot Studio capacity. Claude needs a Team or Enterprise plan and a Microsoft Entra tenant. ChatGPT admin-managed SharePoint sync depends on your workspace plan, so confirm eligibility in the OpenAI help centre first.
3. Grant admin consent. For Claude, an organisation Owner enables the connector and an Entra Global Administrator grants tenant-wide consent (Claude Help Center). ChatGPT needs an admin to enable the app and the sync. Copilot connectors are switched on in the Microsoft 365 admin center.
4. Remove oversharing before launch. Follow the checklist in the permissions section below.
5. Scope the knowledge. Copilot Studio accepts up to 25 SharePoint URLs as knowledge sources and shows users only content they can access (Microsoft Learn). Point each agent at specific libraries, not the whole tenant.
6. Set grounding rules. Turn off 'Allow ungrounded responses' and instruct the agent to cite sources. Microsoft notes this does not guarantee the agent never uses general knowledge.
7. Pilot with 20 to 50 users, then scale.

Know the file limits. For SharePoint-sourced generative answers, Copilot Studio can process files up to 7 MB without a Microsoft 365 Copilot licence in the agent's tenant, or up to 200 MB with that licence and tenant graph grounding with semantic search enabled. Files uploaded directly to Copilot Studio can be up to 512 MB (Microsoft Learn). ChatGPT's SharePoint sync accepts TXT, PDF, DOCX, PPTX, XLSX and CSV files up to 100 MB each.

Know the behaviour limits too. One Microsoft Community user reported that a Copilot Studio agent asked to review each of about 100 policy documents processed only about 10, without saying the answer was partial (Microsoft Community Hub). This is one user's report, but it matches a pattern we plan for: any 'check every document' task runs as a deterministic loop in Power Automate or a script, with the model reviewing one document at a time.

Step by step: connect Google Drive

1. Confirm the edition. Full Gemini in Docs, Sheets, Slides, Drive and Meet starts at Business Standard. Business Starter gets limited Gemini.
2. Enable Gemini and choose its sources. The admin turns on Gemini and Workspace smart features, then decides whether Gemini may use Drive, Gmail, Chat and Calendar. Gemini retrieves only content the user can access and honours IRM restrictions (Google Workspace Privacy Hub).
3. Add Gemini Enterprise for cross-source search or agents. It uses your Workspace customer ID, so consumer Gmail accounts do not work. Create the Drive data store in the global, US or EU location (Google Cloud docs).
4. Clean up sharing. Remove 'anyone in the domain' links and orphaned shared drives, then apply DLP and IRM.
5. Respect the indexing limits. Gemini Enterprise extracts 1 MB of text per file and stops PDF OCR at 80 pages, so split long manuals before indexing.
6. Decide where Gemini Notebook fits. It creates a copy of each Drive file you add as a source, file sharing and data region settings do not apply to that copy, and it is not integrated with Workspace DLP. Keep it for non-sensitive collections.

If Gemini is not your front end, ChatGPT and Claude also connect to Google Drive. ChatGPT's Drive sync needs an admin and a Google service account, and your Workspace domain must match (OpenAI Help Center).

Other sources: Confluence, Box, Slack, file shares and MCP

Confluence, Notion, Box, Dropbox, Slack, Salesforce, HubSpot and Jira connect through ChatGPT apps and company knowledge, Gemini Enterprise connectors, the Copilot connector gallery, or Claude connectors. Microsoft's Copilot connectors come in two models: synced connectors index content into Microsoft Graph, while federated connectors retrieve in real time through MCP and store nothing (Microsoft Learn).

File shares and legacy document systems are where custom work usually starts. Your realistic routes: migrate the files to SharePoint or Drive, build a custom synced connector, or write a custom MCP server.

MCP (Model Context Protocol) is the open standard for connecting AI clients to tools and data. Anthropic donated it to the Linux Foundation's Agentic AI Foundation on 9 December 2025 and cited more than 97 million monthly SDK downloads (Anthropic). The MCP blog lists support in ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot and VS Code. Build one MCP server for a legacy system and every major assistant can use it.

OpenAI does not verify custom apps, so start each custom server with narrow, read-only permissions. Agents that write to documents need approval steps and audit trails; our guide to AI traceability and human oversight shows how to set those controls.

Fix permissions before you switch it on

Every native tool retrieves what the signed-in user can already open, so oversharing is your first risk. Treat this checklist as a launch gate (Microsoft's Copilot readiness guidance covers the same ground):

1. Report the current state. Run the SharePoint Advanced Management permission-state and Data Access Governance reports, plus Microsoft Purview DSPM for AI assessments.
2. Contain the riskiest sites. Use Restricted Content Discovery to limit sensitive sites in Copilot and organisation-wide search while you review their permissions. Microsoft blocked new enablement of Restricted SharePoint Search on 31 July 2026 (Microsoft Learn).
3. Remove broad grants. Delete 'Everyone Except External Users' permissions, apply Restricted Access Control where you must block access, and archive stale sites.
4. Label and filter. Apply a Purview DLP policy so labelled content stays out of Copilot grounding.
5. Test with two accounts. Ask the same 20 questions as an administrator and as a junior employee. Any answer that cites a document the junior employee cannot open is a failure.

On Google Drive, the equivalent work is step 4 of the Drive guide above.

Treat document and email content as untrusted input. In June 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), a zero-click flaw in which a crafted email made Microsoft 365 Copilot leak data (arXiv:2509.10540). Microsoft patched it server-side. The lesson: limit write tools and require human approval for every action that changes a file, sends a message or updates a record. Our AI security risks guide covers prompt injection and access controls in more depth.

Prepare your documents and test before you trust them

Retrieval quality follows content quality. Our data readiness service covers the wider preparation work; for a document assistant, start with these checks:

• Delete duplicates and 'final_v3' versions, and archive stale content.
• Run OCR on scanned PDFs.
• Convert complex tables to Sheets or Excel.
• Add an owner, an effective date and a version to every policy.
• Assign one named owner to each document collection.

Then build a golden-question set: 50 to 150 questions per domain, each with the expected answer and its source document. Score four things: retrieval hit rate, answer correctness, citation accuracy and refusal quality. Re-run the set after every content or configuration change. Google's own help page warns that Gemini can sometimes invent a source, so citation accuracy needs its own score (Google Drive Help).

Measure a baseline before you launch: median time to find a policy, and help-desk tickets that ask where a document lives. McKinsey's 2012 report estimated that interaction workers spent 19% of working hours tracking down information and that a searchable store of social messages could reduce information-search time by up to 35% (McKinsey, 2012). The data is old, so use it as direction and replace it with your own numbers. Our guide to RAG for business explains how retrieval quality is measured in more depth.

What it costs, and when custom RAG earns its place

Native tools add $20 to $30 per user per month on top of your suite licence (September 2026 list prices): Microsoft 365 Copilot $30, Copilot Business $21, ChatGPT Business $20 billed annually, and Claude Team $20 per standard seat billed annually. Gemini comes bundled from Workspace Business Standard.

Custom RAG earns its place in five cases:

• No connector reaches your source.
• Answers must follow a fixed schema.
• You are building a customer-facing portal.
• Residency or key-management rules exclude vendor sync.
• Query volume makes per-seat pricing uneconomic.

A custom build adds work the native tools do for you: syncing through change feeds (Microsoft Graph delta, Google Drive changes), trimming results by the user's permissions before any text reaches the model, hybrid retrieval that combines keyword (BM25) and semantic search, and an evaluation set. Our guide to RAG for business covers the architecture.

Embedding is rarely the expensive part. Embedding 100,000 documents of about 3,000 tokens each (300 million tokens) costs about $6 with OpenAI's text-embedding-3-small at $0.02 per million tokens, and about $39 with text-embedding-3-large at $0.13. Generation, parsing, storage and engineering time make up the bill. This is an illustrative calculation, not a project quote.

Large firms run this at scale. Public reporting describes Morgan Stanley's internal assistant, which lets wealth-management advisors query the firm's research. OpenAI reports that Wayfair corrected 2.5 million product tags and automated about 41,000 supplier-support tickets a month (vendor-reported). Neither figure measures retrieval accuracy, so run your own pilot against your own baseline.

How Liorant connects AI to your internal documents

Liorant connects AI to your documents inside the stack you already license: Microsoft 365 and Copilot Studio, Google Workspace and Gemini, or Claude. We use a deterministic approach. Fixed rules such as formulas, scripts and schemas handle every answer that has one correct result, and the model handles only the judgement calls.

Each engagement starts with governance: a permissions audit, a named owner for every document collection and a golden-question set, all before a single employee sees the assistant. Then we build, deploy and run the system, with EU AI Act requirements built in, and report results in euros and hours saved. Our AI ROI measurement guide explains how to track those outcomes.

See how Liorant delivers a working AI system in 4–6 weeks

FAQ