Microsoft 365 and where documents actually live

Three seams

The Microsoft estate touches Manufacturing PLM in three places, and it is worth keeping them separate because they fail differently.

• Entra ID for identity — SSO through SAML or OIDC, with group membership driving role assignment. Deprovisioning in Entra removes access here, which is the property that matters at an audit.
• SharePoint for controlled copies — released documents published into a SharePoint location as controlled copies, watermarked and superseded automatically when a new revision releases.
• Office files under revision control — specifications, procedures and test reports held here with their revisions, opened for editing through the desktop or web application.

The folder problem

Every manufacturer without a PLM has a document structure that grew into one. It has conventions, a person who understands them, and a filename pattern ending in _rev_C_FINAL_v2_use_this_one.

The instinct on adopting a PLM is to keep the folders and integrate with them. It does not work, and the reason is precise: a folder cannot answer which revision is current, because a folder has no concept of a revision. It has files with names, and names are a convention people follow at differing rates.

So the direction is one-way by design. Documents come *out* of Manufacturing PLM into SharePoint as controlled copies — read-only, watermarked, stamped with the revision and the moment they were published — and nothing comes back. The SharePoint copy is a distribution surface, not a workspace.

The practical test of whether this landed is whether anyone still emails a specification as an attachment. When the SharePoint location reliably holds the current controlled copy and visibly supersedes the old one, that habit stops on its own.

The failure it prevents

A supplier builds two hundred units to a specification they downloaded from a shared folder eight months ago. The specification revised twice in that period. Neither revision reached them, because reaching them was a manual step somebody used to do and stopped doing when they changed roles.

The units are within the old tolerance and outside the new one. They are not scrap — a waiver covers them — but the waiver takes four weeks, involves a customer notification, and the root cause on the report reads *document control*.

Superseding is the whole feature. A controlled copy that is not automatically marked superseded when its source revises is just a file in a folder with a watermark on it, and it will be used long after it stopped being true.

How it meets the rest of the product

Identity is the seam with the widest blast radius. Roles map from Entra groups, so a person joining a programme gets access through the group they were added to rather than through a request somebody actions in Manufacturing PLM, and a person leaving loses it the same way.

Where a workflow requires re-authentication for a signature, that re-authentication goes through Entra, which means your conditional access policies apply to it. A PLM that implements its own second password beside your identity provider has created a credential your security team cannot govern.

Documents held here carry their relationships — a specification attached to an item, a test report attached to a quality record — and those relationships are what a folder cannot express. The controlled copy in SharePoint carries a link back to the object it belongs to, which is frequently how somebody finds their way from a file to the reason it exists.

Search reaches document content, scoped by permission, so a procedure is findable by what it says rather than by whether a filename followed the convention. That is the capability a shared folder is assumed to have and stops having somewhere past a few thousand files.

How it meets your ERP

Dynamics 365 deployments make this seam denser, because identity, documents and the ERP all sit in the same estate and it becomes tempting to treat them as one system. They are not: the ERP still owns transactions, Manufacturing PLM still owns definition, and shared identity does not merge the record.

Where the ERP references documents, it references the controlled copy rather than storing its own. A purchase order pointing at a SharePoint controlled copy of a drawing is pointing at something that supersedes itself; a purchase order with a drawing attached is pointing at a snapshot of a moment.

The system-of-record matrix is unchanged by any of this. Running on one vendor's platform is an operational convenience and not an argument about who owns which field.

Where the boundary is

SharePoint is never the system of record for a controlled document. The copy there is a distribution artefact. Editing it changes nothing here, and a copy that has drifted is superseded rather than reconciled.

Manufacturing PLM also does not index or search your SharePoint estate. It does not know what is in your folders, does not attempt to import them wholesale, and does not present their contents as product data — because content nobody has classified is content nobody can rely on.