One interface for most of it
Microsoft Graph exposes mail, calendar, contacts, files, Teams messages, users and groups through a single API with a consistent permission model.
That consistency is what makes 365 integrations quicker to build than a comparable mix of separate products.
What businesses actually build
- Shared mailbox triage — classification and routing in Outlook
- Document retrieval across SharePoint, respecting existing permissions
- Teams assistants answering from internal documentation
- Meeting notes to tasks, into Planner or To Do
- Excel data extraction and validation from incoming files
The SharePoint permission model is the reason this works well. Retrieval can inherit the access control you already maintain rather than duplicating it.
Permissions are the design
- Application permissions for background processing, scoped narrowly
- Delegated permissions where the action is on a user's behalf
- Sites.Selected rather than blanket SharePoint access
- Admin consent documented, with the reason for each scope
Over-broad permissions are the most common finding in a review of a 365 integration, and they are avoidable at design time.
Copilot and custom work are not the same question
Copilot is a general assistant across your content. Custom integration is a specific process automated end to end into a specific system.
Plenty of businesses want both. Copilot does not do document extraction into your ERP, and a custom pipeline does not summarise a document someone is reading.
Practical constraints
Graph throttling is real and needs handling. Large SharePoint libraries need incremental sync rather than full crawls. Both are known problems with known solutions.
Budget two to five weeks for a focused integration in an existing tenancy.