Enterprise Connectors

Enterprise Connectors records provider-neutral connector definitions, connector instances, credential references, source refs, connector jobs, health checks, and source-owner handoff evidence.

Use it when a workspace needs to connect governed enterprise source systems to Novantra without turning one provider, one document store, one AI workflow, or one tender scenario into core product behavior.

What Enterprise Connectors Owns

Connector definitions and adapter descriptors.
Connector instances and tenant configuration posture.
Connector credential references and rotation posture.
Sync, import, export, validation, and AI-preparation job records.
Sanitized external source refs.
Health checks, retry posture, and dead-letter evidence.
Source-owner handoff requests and receipts.

Enterprise Connectors stores refs, status, capability state, rights/classification/retention snapshots, and handoff posture. It does not store raw provider payloads, bearer tokens, passwords, raw source text, OCR text, storage keys, prompts, embeddings, vectors, or retrieval rankings.

User Journey

Open Developers > Connectors.
Use the connector cards to configure a supported provider, or open the advanced tables for generic connector diagnostics.
Create a connector instance and record safe configuration snapshots.
Record credential posture using an external secret reference, encrypted-secret posture, digest-only posture, or customer-held posture.
Test the connector configuration to record health evidence.
Activate the connector with a governed reason.
Request a sync, import, export, validation, or AI-preparation job.
Review external source refs discovered or recorded by the connector.
Select one or more eligible source refs for source-owner handoff or AI preparation.

SharePoint Connector

Microsoft SharePoint is the first provider-specific connector path behind the Enterprise Connectors framework. Use the SharePoint card to configure a customer-managed Microsoft Entra application, not a Novantra-owned Microsoft account.

The connection flow asks for a connection name, Microsoft tenant ID or tenant domain, Microsoft application/client ID, credential method, and credential storage choice. The credential method can be a customer-managed Entra client secret or client certificate. For client secrets, choose either Use secret manager reference or Store encrypted in Novantra. Secret manager reference remains the recommended/default posture and resolves the value from an approved runtime secret manager. Store encrypted in Novantra lets an admin paste the Entra client secret once; Novantra stores it encrypted, never reveals it back, and uses it only through the connector credential resolver. For certificate mode, store the private-key bundle or private key plus SHA-256 certificate thumbprint in the approved secret manager and enter only that reference in Novantra; encrypted certificate-bundle paste support is not available in v1. The thumbprint may be supplied in base64url, base64, or hex form. Supported reference shapes are environment variable names or env://... / process-env://..., aws-secretsmanager://region/secret-id, azure-keyvault://vault-name/secret-name, and hashicorp-vault://mount/path?field=value; the connection form validates the selected secret-manager shape before saving. Secret and certificate material stays under the selected credential posture; connector records expose only safe posture and never expose raw secret material.

After connecting, use Validate connection to validate the customer-managed Entra app against Microsoft Graph and record sanitized health evidence. A successful credential validation means the connector is connected even if no SharePoint source has been selected yet. Use Browse sources from the connected card; SharePoint sites load automatically from the saved connection, and the refresh action is only for retrying or reloading. Search for a site if needed, choose a site, choose a document library and optional folder, then save one or more governed source scopes for that connection. In large tenants, provider-backed selectors load the first page automatically and append more choices as you scroll or choose Load more results; Novantra keeps Microsoft Graph continuation details server-side and sends only safe opaque cursors to the browser. For smooth tenant discovery, grant Microsoft Graph Application permissions Sites.Read.All for site list/search and Files.Read.All for document libraries, folders, and file listing. Restricted Sites.Selected mode is also supported, but it requires Entra consent plus explicit SharePoint resource grants; when broad discovery is unavailable, enter the approved SharePoint site URL in the source browser. The selected site URL must be an HTTPS SharePoint Online site URL without embedded credentials, query text, or fragments.

Saving a SharePoint source scope queues discovery for that scope. Discovery calls SharePoint with the saved connector credential, uses Microsoft Graph delta traversal for the selected library or folder scope, follows Graph pagination, and records sanitized source refs for discovered files. One SharePoint connection can own multiple source scopes, such as separate libraries, folders, or direct-document selections, without duplicating credentials. Source refs show safe titles, status, eligibility, and readiness context. Raw Graph payloads, provider IDs, source text, tokens, secrets, file paths, vectors, embeddings, and storage keys are not exposed in the connector UI or connector records.

When Microsoft Graph allows item permission reads, SharePoint source refs also include a safe rights summary with permission counts, role/link/principal-type categories, and a digest. Novantra does not store raw permission IDs, user or group names, email addresses, sharing URLs, or raw permission payloads, and the summary should not be treated as full SharePoint ACL mirroring.

Launch-supported direct-text SharePoint files, PDF files with an extractable text layer, DOCX, XLSX, PPTX, legacy DOC, and RTF files can be resolved through the Content Extraction source-owner seam for extraction and AI preparation. The SharePoint adapter fetches bounded file bytes after Microsoft Graph validation, while Content Extraction owns the text parser and resulting extraction posture. Scanned PDFs, images, SharePoint pages or HTML/ASPX files, legacy XLS/PPT, and other unsupported formats still require a governed parser or OCR path before they can become ready for AI Context and Knowledge Bases. When that parser/OCR path is missing or blocked, Novantra should show an unsupported or needs-extraction posture instead of marking the source ready for Copilot.

The Prepare for AI action records eligibility and queues a connector-owned ai_prepare job. For SharePoint, preparation is offered and queued only while the parent connector is active, configured, and has successful validation health. If readiness regresses after queueing, the preparation worker fails before asking Content Extraction to resolve the SharePoint source. For Content Extraction targets, the durable job requests extraction through the Enterprise Connector source-owner seam and records only safe downstream status back on the connector handoff: extraction source/run ids, extraction status, source hash, chunk count, ready count, unsupported count, failed count, and safe reason-code counts. Extraction belongs to Content Extraction, and indexing, embeddings, vectors, retrieval policy, and AI answers belong to the AI owner.

For larger source sets, select rows in the source-ref table and use Prepare selected for AI. Novantra queues connector ai_prepare jobs for eligible refs while skipping blocked, unsupported, already-indexed, or unavailable refs. The connector job records source-ref IDs, counts, target owner, Content Extraction handoff status, capability state, and safe blocker summaries; it does not copy document text, OCR text, prompts, embeddings, vectors, provider payloads, storage paths, exception details, or secrets.

When at least one connector job is created, the bulk preparation route returns 202 Accepted, includes an asyncOperation object, and sets Location to the connector-owned job status URL. Poll the job URL to read source counts, handoff counts, retry posture, terminal status, and sanitized failure code. If the selected refs produce no eligible work, the route returns the normal result with skipped/not-found outcomes and no async operation.

Durable async subscriptions keep connector posture current after the request. Enterprise Connectors refreshes instance health from sanitized health-record events and processes AI-preparation jobs by requesting downstream Content Extraction for supported connector source refs. Compliance Posture consumes the same connector health event as a sanitized signal; it does not copy connector records or provider diagnostics.

Credential Posture

Connector credential posture records the responsibility boundary for an external system connection. A credential can be represented as an external secret-manager reference, encrypted-secret posture, digest-only posture, or customer-held-only posture depending on the adapter and deployment policy. For SharePoint client-secret mode, encrypted-secret posture means Novantra stores the pasted secret encrypted and marks the reveal posture as never; the secret is not returned in cards, tables, activity, audit metadata, health evidence, or examples.

The connector surface can show last rotation, next rotation due date, last verification, disabled/stale/expired/customer-action-required status, and owner responsibility. Scheduled owner-local posture evaluation marks credentials due, stale, expired, or requiring customer action from safe rotation metadata. It must not show raw bearer tokens, passwords, refresh tokens, webhook signing secrets, provider payloads, or private endpoint details.

Public API service-account credentials and webhook signing secrets remain owned by Developers > API and Developers > Webhooks. Enterprise Connectors owns connector-instance credential posture only.

Capability States

Connectors use shared readiness labels such as configured, provider-not-configured, policy-blocked, deployment-dependent, reference-only, roadmap, and no-AI profile.

When a provider adapter, public API, source-owner handoff, AI profile, or deployment capability is not available, Novantra should show the accurate capability state instead of implying unsupported behavior.

Cloud And On-Prem

Enterprise Connectors uses the same workspace behavior in cloud and on-prem deployments. Deployment differences should appear as configuration, posture, or capability states, not as different product semantics.