Choose the right connection route

A source connection, a document upload and an orchestration input serve different purposes. Use the configured source-management area for approved read-only repositories. Use Document Intelligence intake or an orchestration stage to select the records to process.

Available providers and authentication methods depend on the deployment and enabled capabilities. The source controls include cloud repositories, email, APIs, database views and private-runtime boundaries where supported. Do not assume every connected provider is automatically a Document Intelligence ingestion route.

Define an explicit read-only boundary

  1. With the required administrator permission, open source management and add a source. Give it a clear business name and select the provider.
  2. Enter the required tenant, region or private-site information and provider-specific identifiers. Use an approved secret reference rather than placing credentials in names or notes.
  3. Specify the exact permitted source references, such as approved folders, prefixes, API paths or database views. Apply least-privilege access on the provider side.
  4. Complete only the confirmations relevant to that provider. Save and follow the connection verification process before relying on it operationally.
Local product example · sample dataClick to enlarge ↗
Name the source and restrict what it can read

This cropped view shows the shared connection fields with SharePoint selected and a fictional source name. Provider-specific settings and boundary confirmations continue below. No live credentials are shown. A secret reference identifies approved secret storage; it is not the secret itself.

Select records for an orchestration

A document stage can use a workflow input variable or another supported source mode. Its location reference and filters determine the intended record scope; they do not grant additional permissions.

For a workflow input, confirm the upstream stage supplies the expected document IDs. For another source mode, supply the required reference and check document types, lifecycle and information-classification filters.

Verify access and processing separately

A saved connection is not proof that access works. Check the recorded runtime verification and resolve failed or degraded checks. A working source connection also does not prove that a document has completed classification, review, indexing or delivery.

Keep provider-side permissions and secret references current. If access changes, inspect the connection and any affected processing runs rather than repeatedly submitting duplicate jobs.

Change connections under control

  1. Identify dependent intake routes/runs before changing credentials or boundaries.
  2. Make the authorised change using protected credential controls.
  3. Repeat verification: an old test does not cover a new target.
  4. Inspect affected runs for stale bindings/access errors and retire unused provider access through the approved process.