Who it is for
Teams that want the always-on, nothing-to-run-on-a-laptop story of a vendor-managed deployment, but need the workload to live inside their own Azure tenant, within their security boundary, network and billing. It is the edition to run in production when a vendor operating the infrastructure is not an option your security team will sign off.
It is also the edition for a Copilot Studio or Azure OpenAI project that must stay inside the tenant. The managed application fills Azure SQL or Azure AI Search from your lists, inside your subscription. Copilot Studio grounds on either as a real-time knowledge connector, a preview feature on Microsoft Learn as of 20 October 2026. When you choose Azure AI Search, the embeddings come from an Azure OpenAI deployment you own. Nothing in that path leaves the subscription.
How it deploys
- Your subscriptionEverything below deploys into it; nothing runs in ours.
- App registrationYours, with your own conditional access policies applied.
- Managed applicationThe SPSync engine, deployed into your own subscription with you on a call.
- Key VaultHolds the deployment's own secrets. Destination credentials sit in the deployment's own database, also in your subscription.
- Private endpointReaches your database without crossing the public internet, when your network requires one.
We never see your data or your credentials. Everything above runs and stays inside your subscription.
- The managed application deploys into an Azure subscription and resource group you choose, and nothing runs in ours.
- You sign in with your own Entra app, so your existing conditional access policies apply to it as they do to any other app in your tenant.
- When your network requires it, the deployment reaches your database over a private endpoint inside your own virtual network, without crossing the public internet.
- When a new version of the managed application is ready, we upgrade your deployment with you.
Built for running unattended
- The deployment holds its own connections, schedules and run history inside your subscription. List rows go straight to your database.
- The service meters Graph resource units and honours Microsoft's Retry-After responses, so a heavy load stays within the tenant's limits.
- A reconcile, weekly by default and configurable per replication, compares every row to confirm SharePoint and your database still match. It also catches up after a big change in SharePoint or an outage of your own server or Microsoft 365.
- Tables, keys, soft deletes and versioned columns are identical to the desktop and command-line editions.
Security and data handling
SPSync reads SharePoint through Microsoft Graph with the permissions you grant. It never writes to SharePoint. Because the managed application runs inside your own subscription, using your own app registration and network, we never see your data or your credentials. The security page has the detail.
Good to know
- We deploy it with you: book a call and we will set the managed application up in your subscription. You can also start on the desktop app and move the replication across later.
- Licensed per deployment and target family, on the same annual terms as every other edition, with Standard Support included. There is no monthly plan. Bought with a licence key and invoiced directly; see how licensing works.
Frequently asked questions
Where does my SharePoint data live?
In your destination database and nowhere else. The managed application deploys inside your own Azure subscription; there is no cross-tenant control plane of ours holding your configuration or content.
How does it reach my database?
Over a private endpoint inside your own virtual network when your database requires one, or a direct connection otherwise. The deployment's own secrets are kept in a Key Vault in your subscription, and destination credentials in the deployment's own database, also in your subscription.
What permissions does it need in SharePoint?
The same choice as every edition: delegated sign-in for the sites you can already open, or app permissions granted per site with Sites.Selected for unattended sync, using your own app registration and conditional access policies. It never writes to SharePoint.
Can Copilot Studio or an agent use the copy?
Yes. Copilot Studio can ground on Azure SQL or Azure AI Search filled by the deployment, and an agent built elsewhere connects to the database with its own login. SharePoint permissions are not copied, so the database role and row-level security decide what each one sees. Grounding Copilot Studio on clean tables explains the list limits this replaces.
How is it licensed and billed?
Per deployment and target family, on the same annual terms as the desktop and command-line editions, with Standard Support included. Licensed with a licence key and invoiced directly. There is no monthly plan and no public price list. Book a call and we will size it with you.
Can I start on the desktop and move to Azure?
Yes. Set the replication up in the Azure deployment with the same lists and the same destination. The tables and schema are identical, so reports and apps built on them carry on working.
How do I get it deployed?
SPSync in your Azure, a managed application for your own subscription, is deployed with you on a call while the Marketplace listing is prepared. Book a call and we will deploy the managed application into your subscription directly.