Refresh SharePoint ACLs independently of content modification timestamps #720

Problem

The custom SharePoint ingestion job retrieves current user/group permissions, but writing those permissions to Azure AI Search is gated by content freshness checks. Permission-only changes are therefore not reliably synchronized independently of content changes.

This requirement was raised for Qnity Wave 1. This issue concerns ACL synchronization only, not Purview sensitivity-label enforcement or document decryption.

Code evidence

Reviewed main at commit 75a2ef17779e634f3b3150f682c8669a7f928481:

• Current permissions are retrieved for the item.
• The item body is updated only when its modification timestamp is newer.
• Document-library files are skipped when their timestamp is not newer. This path prioritizes fileSystemInfo.lastModifiedDateTime over the service-level timestamp.

No independent ACL comparison/update path was identified in this flow. This is a code-level finding, not a reproduced customer incident. It does not assume that every permission operation leaves every timestamp unchanged.

Expected behavior

Synchronize effective SharePoint permissions to existing Search documents even when content timestamps are unchanged. Cover direct permission changes and changes inherited from parent scopes within the connector's supported permission model.

Prefer an ACL-only update path that updates metadata_security_user_ids and metadata_security_group_ids on every affected indexed document/chunk without downloading, chunking, or embedding unchanged content. Assess whether comparing permissions already fetched on scheduled runs is sufficient before introducing an additional change-tracking mechanism.

Acceptance criteria

• A permission grant or revocation is reflected in all affected indexed documents/chunks even when content timestamps remain unchanged.
• Inherited permission changes, including parent-scope changes and inheritance transitions supported by the connector, are covered.
• Revocations remove stale principals rather than only appending new ones.
• An empty ACL resulting from a successful lookup is distinguished from a failed permission lookup; failures are surfaced and are not treated as successful synchronization.
• Unchanged ACLs do not cause unnecessary writes or content reprocessing.
• Partial update failures are observable and retryable, and are not reported as complete synchronization.
• Automated tests cover unchanged timestamps with changed ACLs, grants, revocations, inherited changes, unchanged ACLs, and lookup/update failures.
• Document the synchronization cadence and supported scope/limitations.

References

• Microsoft Graph fileSystemInfo semantics
• Microsoft guidance for detecting changes and scanning permissions hierarchies
• Native SharePoint indexer permission synchronization: reference only; native-indexer capabilities do not automatically apply to this custom connector.