During the latest weekly community call for Microsoft 365 & Power Platform, two technical demonstrations illustrated concrete use cases for Microsoft Graph, SharePoint Framework (SPFx), and SharePoint Embedded. In parallel, the product team detailed a series of updates to SharePoint Embedded: API in general availability, integration with Azure AI Foundry, permissions management, and simplified administration. Here's what you need to know, with the technical context necessary to evaluate these innovations in a production environment.
Bookmark Hub: Centralizing Scattered Favorites Across Microsoft 365
The first demonstration, presented by Saurabh with Nico and Adam (submission to the SharePoint Hackathon 2026), addresses a classic problem: bookmarks and tracked items accumulate across multiple services without a unified view.
The SPFx web part automatically aggregates three sources via Microsoft Graph:
- emails marked in Outlook
- followed SharePoint sites
- files added as favorites
A fourth type of content — links to saved Teams messages — is managed as a custom bookmark, pending an available Microsoft Graph API for this object.
Unorganized items land in a "Not assigned" section. Users then classify them into groups (Intranet Project, Knowledge Base, etc.) and assign them color-coded labels for cross-filtering. Manual sorting remains possible, but the Organize with Copilot button automates group suggestions based on unclassified content, with an approval or rejection workflow before final validation.
Licensing Impact
The automatic organization button relies on the Copilot conversation endpoint and requires a Microsoft 365 Copilot license for the user. This differs from the usage-based billing model discussed below for SharePoint Embedded, where AI can be consumed without an individual Copilot license.
From an architecture perspective, the team documented a frequent friction point with the Copilot API: it is asynchronous and non-streamed. Perceived latency depends on three factors — sent prompt size, generated response size (the dominant factor), and the two sequential round trips needed to create a conversation and then send a message. There is no way to eliminate these round trips or enable token-by-token streaming. The adopted solution: drastically reduce the prompt size and ask Copilot for a simple identifier-group mapping rather than a complete object, then reconstruct the final object on the client side. This reflex can be applied to any automated organization scenario based on the Copilot API.
Transmittal Flow: Secure Document Sharing with SharePoint Embedded
The second demonstration, led by Robert Jacker and Albert John Scott, targets a recurring business need: sending a batch of documents to an external third party for review or validation, without losing governance or native Microsoft 365 collaboration features.
The architecture rests on three components:
- an SPFx extension installed on the source document library, triggering the submission of a selected batch
- an application API that provisions a SharePoint Embedded container per client — a choice that isolates each third party's documents within a distinct security boundary
- an external portal, outside the Microsoft 365 scope, exposing the Office Online experience (viewing, annotation) to the invited client via a link containing an access token
Once the review is submitted (approved, approved with comments, or rejected), the status and comments are reported back to SharePoint via the application API, providing complete traceability of the validation cycle.
Security Consideration
The invitation link shared in the demonstration relies solely on a token embedded in the URL, without forced authentication: anyone with the link can open the transmittal. For production use, it is recommended to enforce authentication via Azure AD B2C or equivalent, rather than relying on URL confidentiality alone.
Both presenters also detailed their AI-assisted development approach: drafting a product requirements document (PRD) in dialogue with a model, breaking it down into tasks via GitHub Copilot to generate the application skeleton (portal + SPFx extension), then connecting to SharePoint Embedded via the dedicated VS Code extension to create the container type, manage application permissions, and generate the identifiers (client ID / client secret) needed for the .env.local environment. Visual refinement was then delegated to an interface generation tool based on existing screenshots. Estimated total time: two to three days, outside working hours.
SharePoint Embedded: Retrieval API in GA and Azure AI Foundry Integration
Steve Buslik's presentation covered a dense batch of platform updates. The first notable point: the Retrieval API for SharePoint Embedded moves from preview (beta) to general availability (GA).
In parallel, integration with Azure AI Foundry is progressing: it is now possible to create a knowledge source in Foundry by specifying the container type ID of SharePoint Embedded. Foundry then indexes the container's content for contextual reasoning. This Foundry knowledge source remains in preview at this stage.
| Feature | Status | Key Point |
|---|---|---|
| Retrieval API | GA | Adapted signature: specify data source = SharePoint Embedded + container type ID |
| Foundry Knowledge Source | Preview | Based on the container type ID registered in the SharePoint admin center |
| SharePoint Embedded MCP server | Open source (GitHub) | App creation, container type provisioning, container management |
| Apps pillar (SharePoint admin center) | GA deployment in progress | App creation without PowerShell or manual Graph calls |
Another useful innovation for agentic integrations: a dedicated MCP (Model Context Protocol) server for SharePoint Embedded is available on GitHub, open source. It exposes the capabilities of application creation, status retrieval, provisioning, and container type management — exploitable from tools like Copilot Studio, Cloud Code, Replit, or Lovable to automate the complete lifecycle of a SharePoint Embedded application.
On the billing side, the pay-as-you-go option in the Microsoft 365 admin center now supports Copilot/Foundry usage within a SharePoint Embedded application. End users do not need an individual Copilot license in this model: consumption is billed at the tenant level via the SharePoint Embedded meter, which moves from 3 to 4 meters with the addition of the archival feature.
Scale Limits and Container Governance
Official documentation mentioned a threshold of 100,000 containers with an asterisk, often misinterpreted as a hard limit. Microsoft clarifies: this is not a technical ceiling, but an invitation to reconsider the design strategy (avoid one container per document, for example). The recommended pattern remains one container per client or business unit, as illustrated in Transmittal Flow.
The actual hard limit remains set at 2 million sites and containers total. Beyond that, dedicated support from Microsoft is needed to extend the quota.
Other sizing points to remember:
- up to 40 custom columns per container, all indexable and queryable via KQL (Keyword Query Language)
- SharePoint Embedded throttling throughput is significantly higher than that of a standard SharePoint environment, but remains subject to 429 codes
- distributing load across multiple containers rather than a single one reduces the probability of being throttled — a multi-container architecture is therefore not just a security best practice, it's also a performance lever
Best Practice
Implement retry logic with exponential backoff on 429 errors, and monitor this metric in production rather than sizing "worst case" a single giant container.
Permissions and Authentication: Toward Least Privilege
SharePoint Embedded now supports all types of service principals: Microsoft Entra groups, Microsoft 365 groups, security groups, and classic service principals can be used when creating containers.
On the Graph permissions side, Microsoft is gradually removing the requirement for the broad Files.Read.All permission for scenarios that don't truly need it. For file preview, the FileStorageContainer.Selected permission is now sufficient. Full-text search will continue to require Files.Read.All until a more restrictive alternative becomes available.
The last notable addition: a configurable URL template parameter at the container type level. It allows redirecting the user to a custom destination when a file cannot be opened in the embedded viewer — typically CAD/DWG files. Before this option, these openings were massively redirected to the Microsoft Learn documentation, skewing official documentation consultation statistics.
Simplified Administration from the SharePoint Admin Center
Creating SharePoint Embedded applications no longer necessarily depends on PowerShell scripts or manual Microsoft Graph calls. The SharePoint admin center now exposes a new Apps pillar, with the ability to:
- view existing applications and installed applications
- create a new application by specifying owners to notify
- attach an existing billing subscription, or create one later
- enable associated Graph integration
This deployment is announced in worldwide general availability, currently being finalized on some tenants. Microsoft Learn documentation has also been reorganized around the phases of planning, building, publishing, administration, and governance — a structure designed for both human reading and ingestion by agentic tools developing code from documentation.
Key Takeaways
- Bookmark Hub illustrates a reusable pattern: multi-source Graph aggregation + light persistence in OneDrive (JSON file in app root) + Copilot-assisted organization with minimal prompt to limit latency.
- Transmittal Flow demonstrates the value of SharePoint Embedded for secure external sharing, provided authentication is strengthened beyond simple URL token.
- The Retrieval API moves to GA: production integrations can now rely on it without concerns about preview status.
- Azure AI Foundry integration remains in preview: validate before any production commitment.
- The pay-as-you-go model eliminates the need for end users to have a Copilot license for AI scenarios integrated into a SharePoint Embedded application.
- Revisit your Graph permissions:
FileStorageContainer.SelectedreplacesFiles.Read.Allfor preview, a net gain in exposure surface.
For more information, the official documentation on SharePoint Embedded and the PnP Prompt Library repository remain the most reliable entry points to test these innovations before any production tenant deployment.
