[Paulo Lacerda (placerda)]

Summary

• Refresh the supported user/group ACLs on every indexed SharePoint item document and file chunk independently of content timestamps; merge only changed ACL fields, without re-downloading or embedding unchanged content.
• Read complete Graph permission pages and effective document-library sharing permissions. Replace revoked principals, keep content-blocked items eligible for ACL refresh, and fail the job on lookup or partial Search updates.
• Narrow the two touched broad error boundaries and remove their obsolete exception allowances; no new approvals, baseline changes, runtime configuration or shared schema changes.

Validation

• Full maintained suite: 1,015 passed, 10 subtests passed on ea8b93c4e71490824ab9fcdd826aae30b086cfee.
• Evidence-bound protected quality command: all passed, 0 findings. All PR CI checks, including the frontend and aggregate quality gate, pass.
• Regression cases cover unchanged timestamps, inherited grants and inheritance transitions, empty/no-op ACLs, more than 1,000 chunks, sibling-item isolation, blocked content, pagination and partial-update recovery. No live SharePoint/Search run was performed.
• Coordinated documentation: docs: explain independent SharePoint ACL synchronization AI-Landing-Zones#167; strict build passes, held in draft until runtime delivery.

Fixes Azure/agent-landing-zone#720.