Foundry IQ and SharePoint: why metadata changes knowledge base responses
Foundry IQ SharePoint metadata: what Microsoft's PoC demonstrates, using columns and filters in RAG, and why permissions need explicit design.
Reading time: 11 min

A knowledge base can retrieve the wrong document even when its text is relevant: the deciding constraint could be in SharePoint columns. Status, department, or classification can change the answer without appearing in the PDF. The PoC published by Microsoft shows how to bring this information into recovery with Foundry IQ.
The October 8, 2026 release is a new reproducible technical example, not the launch of Foundry IQ nor the general availability of all the functions shown. It uses synthetic data and illustrates an Azure AI Search index with structured chunk metadata and directions to the planner. Official Microsoft PoC.
In summary
- Columns may contain constraints that do not appear in the document text.
- The PoC replicates structured information about chunks to make them usable in recovery.
- Hint queries help the planner, but require compatibility with the index scheme.
- Demonstration on synthetic data does not guarantee the same results on business archives.
- A custom index requires explicit permission propagation design.
Why can searching only in the text be insufficient?
Imagine a procedure whose text correctly describes a task, while an archive column indicates it as outdated. If the search only sees the text, it can consider it an excellent answer. The same problem arises when a question concerns a department or classification that are registered outside the document. Semantic content is relevant, but a constraint is missing that determines which source is usable.
It is a different problem from hallucination understood as invented information. The system could quote a real document and faithfully report its contents, still misspelling the selection. That's why a project RAG must distinguish the quality of the generated text and the quality of the recovery. An existing quotation does not prove by itself that the source is suitable for the demand.
The Microsoft PoC addresses this level through structured columns and metadata-driven retrieval. The example uses accident reports and a demonstration taxonomy, with synthetic data. It is not a Giallo customer archive and does not constitute a universal measure of the improvement obtainable. Description of the Microsoft dataset and approach.
What does the PoC Foundry IQ actually do?
The example builds an Azure AI Search index where structured information is replicated on chunks, the portions where the document is represented for retrieval. In this way the result is not just a fragment of text: it brings with it attributes that can help select it according to the context of the question. The repository cited by Microsoft It allows you to examine the demonstration path.
Hint queries provide the planner with directions for filters and boosts. A filter narrows the results according to a constraint; a boost can affect the priority. These functions should not be confused with an infallible decision on the correct source. They depend on the available schema, what the question requires, and how the system translates the requirement into a search operation.
PoC uses API 2026-08-01-preview for query hits. The preview status and configuration shown belong to the technical example, they are not a guarantee of general availability of behavior in any environment. The version and requirements must be verified in the PoC code before attempting to reproduce its operation in a company project.
Which columns deserve to enter the recovery?
Not all the information in the archive is equally useful. It is convenient to start with the questions people ask and the constraints that distinguish a correct source from a similar one. If no request depends on a column, including it can add complexity without a clear benefit. If a column determines validity or accessibility, ignoring it may make recovery inappropriate.
The following table is an illustrative proposal, not the mandatory scheme of the PoC. Names and meanings must be defined on the process of the company.
| Attribute possible | A question that helps clarify | Data quality control |
|---|---|---|
| Document Status | Is it an approved and usable source? | Consistent values and management of withdrawn documents |
| Department responsible | Which group uses this procedure? | Taxonomy shared between those who publish and those who seek |
| Content Category | Is it an instruction, a note, or a precedent? | Understandable and uniformly applied distinction |
| Version or period of validity | Which source is relevant to the case? | Update coordinated with source |
| Document ID | Which original is the chunk from? | Stable link to the correct version |
| Authorization information | Who can see the content? | Propagation and explicit verification of permits |
This phase requires the owner of the archive. If "approved" means different things between departments, the model cannot correct ambiguity on its own. The design of the knowledge base company includes the choice of sources and responsibilities, before the conversational interface.
Why can a generated filter be wrong?
The planner must produce operations compatible with the index fields and types. An incorrect column name, unexpected value, or incompatible expression can cause errors. The PoC recalls this boundary: query hits do not eliminate the need to control the pattern and behavior of queries. Limits described in the technical publication.
Even a formally valid query can misrepresent the user's intention. If a person uses an informal name for a department, the system must understand whether there is an authorized correspondence or if a clarification is needed. Always forcing a filter can rule out the right source; not applying it can include sources that violate the demand constraint.
The test should therefore include clear requests, synonyms, missing columns, and ambiguous values. Expected constraints and eligible documents are noted for each. When the result is empty, the team must distinguish the absence of sources, excessive filtering, and query error. "I haven't found anything" is an outcome to interpret, not a demonstration that the archive doesn't contain the answer.
The document contains the answer, but does the system continue to exclude it?
It checks the replicated attributes on the chunk and the filter actually generated. Verify that names, types, and values match the schema and that the document is in the expected version. Before changing the model, try to figure out if the recovery excludes it for a correct constraint, an incorrect data or an improper translation of the question.
From relevant filter to verified denial
Customer and department help recovery, while access requires an identity and rules of their own. The route AI knowledge base and permissions extends verification to sources, fragments, citations, and revocations. A pilot must include unauthorized requests and copies left in the index, avoiding reading a good semantic filter as proof of protection.
Do SharePoint permissions automatically pass into the index?
A custom index requires you to explicitly design permission propagation. The IQ Foundry FAQs distinguish the path to a remote SharePoint knowledge source from the responsibility to manage access in other configurations. It is incorrect to infer that a copy of the contents and columns automatically inherits each permission. Official FAQ Foundry IQ.
The project must link user identities, source permissions, and returned results. One content could be semantically correct but reserved for another group. The department filter used to improve relevance should not be confused with a security check. The selection by meaning and the authorization answer different questions and must be verified separately.
The test must use users with different accesses and include permission changes. You control what happens when a document becomes confidential or a person changes role. The goal is to prevent the text from remaining visible in the index after revocation. The basics of Data security with AI are part of the quality of recovery: a correct source shown to the wrong person remains an inappropriate result.
A Manufacturing SME with procedures: hypothetical scenario
Let's imagine an SME that keeps operating procedures in SharePoint. Some have similar text but relate to different departments; others have been withdrawn and remain in the archive for historical consultation. In this hypothetical scenario the question ‘which procedure should I use?’ cannot be solved solely by the semantic proximity between question and text.
The evidence would start from an authorized collection and columns with shared meaning. The team would prepare questions in which state and department change the correct source. The result should show the relevant document, the link to the original and enough information to recognize the version. It would not rely on the generated text to guess if a procedure is still approved.
An essential case would be the withdrawal of a document. After the change, the recovery should reflect the new state and not continue to propose previous chunks as valid instructions. The manager would compare expected sources and results, before evaluating the formulation of the response. It would be a more concrete criterion than the mere presence of a citation, because it verifies the constraint that makes that citation usable.
A study with files and precedents: hypothetical scenario
Let's consider a professional study that looks for internal precedents, classified by scope and accessibility. In this second hypothetical scenario the material can be useful without being appropriate for each collaborator. The research should distinguish relevance of the previous and right of consultation, maintaining the link to the authorised file.
The evidence would use materials that the firm can treat and identity with different permissions. Some questions would be repeated by different users to verify the separation. An unaccessible precedent should not appear as an excerpt, revealing title, or source of a response. It would not be enough to prevent the original file from being opened if the assistant has already shown its contents.
The guide to business document analysis remains useful for distinguishing recovery and interpretation. Finding such a file does not mean it is applicable to the new assignment. The interface should favor reading and comparing the source, signaling when a constraint is missing. The expected result would be to help professional research, keeping the decision on the case to the competent contact person.
How do you update metadata and chunks without losing consistency?
Replicating attributes on document portions makes it necessary to keep them aligned. If the source status changes, the project needs to know how to update the representations already present. If an identifier or classification changes, it must remain clear which results belong to that version. The problem does not resolve only once during the initial import.
For this reason it is better to define the owner of the columns and the path of the updates. An acquisition error should be visible, so that a document that is left behind is not mistaken for a current source. The test may include an intentional modification and control of the next result, also observing materials that have not been properly updated.
Other recovery technologies face a different level. The Perplexity multimodal embedding for PDF and EmbeddingGemma 2 for local search They are interested in the representation of content. The PoC Foundry IQ discussed here concerns structured constraints in recovery. Improving the representation of a page does not automatically make a column that indicates the validity of the document consistent.
What happens when a column is empty or contradictory?
A real archive may contain documents without a department, inconsistent states, or values written in different ways. The test must include these cases, instead of using only perfectly classified materials. If a column determines the eligibility of the source, the system must have an agreed behavior when the information is missing: exclude the material, ask for clarification or report it to the owner of the archive, according to the expected process.
The choice should not be left to an invisible deduction. A model could recognize a plausible department from the text, but this does not amount to an approved classification. For fields governing access or validity, explicit data and the correction path are essential. The referent must know which documents require maintenance before becoming reliable sources.
It is also useful to control the contradictions between content and column. A procedure may declare itself updated in the text while the archive marks it as withdrawn. The project must determine what information is authoritative and how to report the conflict. This work improves the archive regardless of the model and makes the errors observed during recovery more interpretable.
What mistakes should be avoided in the adoption decision?
The first is to present the PoC as a new feature already available in each production configuration. The second is to transfer the results on synthetic data to your archive without proof. The third is to add many columns before you know which questions they need to solve. The fourth is to treat a relevant filter as if it were an authorization barrier.
Another mistake would be to evaluate only the final answer. It is necessary to retain recovered sources and applied constraints, so as to explain why the system has included or excluded a document. The comparison with Atlassian Rovo, Jira and Confluence it concerns another ecosystem, but it recalls the same choice: the useful context must come from the correct sources, with consistent identities and permissions.
To start, choose questions where a column really changes the answer and documents that the company is allowed to use. We can build a internal knowledge base with recovery and verified permits, comparing expected source, filter and result before extending the archive. The value of the PoC is to make a precise problem visible: often the answer is not missing from the document, but from the way the system decides which document to look for.
Giallo Studio guides: methodology and sources
How we apply it in the company
Related resources
RAG: what it is and why it improves AI responses
AI for business knowledge bases: find the information you need
AI for business document analysis: a practical guide
AI and data security: concrete risks and how to manage them
EmbeddingGemma 2: Local AI search in business documents
Perplexity opens multimodal embeddings: search inside PDF pages
OpenAI and Atlassian expand Rovo: Jira and Confluence in working with AI
Duplicate CRM contacts: use AI to propose merges while keeping historyFAQ
What is new in the Foundry IQ PoC?
Microsoft demonstrates metadata-driven document retrieval, with structured columns replicated across chunks and query hints. This is a technical publication, rather than an announcement of general availability for every feature.
Why do SharePoint columns matter for AI search?
They can contain information such as status, department or classification that does not appear in the document text. If this information is not included in retrieval, the search may ignore an important constraint in the question.
Does the PoC use real customer data?
The example described uses synthetic data and a demonstration taxonomy. Its results do not guarantee improvement on a different company archive.
Do query hints always make a filter correct?
No. Generated filters must be compatible with the index’s fields and types. Verify the configuration using requests that are valid, ambiguous and incompatible with the schema.
Does a custom index automatically inherit SharePoint permissions?
Do not assume so. The intended remote path and a custom index have different responsibilities: the latter requires explicit design of authorization propagation and verification.
Where should you start a trial within a company?
Choose authorized documents and questions that depend on columns rather than just text. Check the retrieved sources, metadata validity and separation of results between users with different permissions.