You fix an employee's identity mapping, save the connector, and see a recent sync time. Before closing the ticket, check whether that employee can still retrieve the old department's documents through Copilot.
Microsoft's October 6, 2026 release notes announce that administrators can edit query strings and user identity mapping rules after creating a connector. The notes cover releases between September 22 and October 6; they do not establish the date the control appeared in your tenant. The change makes access corrections easier, but administrators still need evidence that the index reflects them.
This guide proposes a change-verification procedure, using ServiceNow Knowledge for the crawl details. We have not tested it against a customer tenant. It covers indexed Microsoft 365 Copilot connectors, not GitHub Copilot or a Copilot Studio tool making a live request.
Establish exactly what changed#
Keep the connector ID, source instance, old mapping, proposed mapping, and affected population in the change record. Separate a mapping correction from a source permission change: resolving an email address to the intended person does not decide which articles that person should read.
Microsoft's identity-mapping reference describes transformations from source identity properties into a selected Entra property. Before saving a formula, compare its output with the actual directory record. Include a renamed account, an unmatched account, and any duplicate-looking names in the review. Do not assume that matching display names identify the same principal.
Confirm that your connection supports the edit. The management reference specifically lists ServiceNow user mapping, advanced criteria, and query-string edits. Its partner-connector column permits fewer changes. The older mapping reference's limitations still say published mappings cannot change. The dated release and connector-specific operations support the new capability; verify it on the intended connection rather than assuming universal availability.
Use a benign item with known access rules to establish a baseline before changing the connection. Record the source user's identifier, resolved Entra user, item identifier, and expected access. A useful hypothetical case is an employee who moved from Finance to Operations: the employee should lose the Finance-only fixture and gain the Operations fixture, while an unchanged Finance colleague retains access.
See how your AI systems hold up under real attacks
General Analysis maps AI applications and agents, red teams prompts, retrieval, tools, MCP servers, browser actions, permissions, and business workflows, then turns findings into evidence your team can reproduce and retest.
Wait for the update that carries the permission change#
A content sync and an identity sync can finish at different times. Microsoft's ServiceNow Knowledge crawl documentation distinguishes these paths:
| ServiceNow Knowledge path | What the documentation says it updates | What to verify |
|---|---|---|
| Standard incremental crawl | Changed articles and article-level permission changes | Do not use its completion as evidence of refreshed user memberships or parent knowledge-base permissions. |
| Incremental identity sync | Identity changes between full crawls, for Advanced flow connections with the user_changes resource configured | Confirm this separate path exists and completed; a content-crawl timestamp is insufficient. |
| Full crawl | All content and permissions; content and identity work run in parallel | Wait for both parts to finish before checking the affected items. |
Microsoft's general index-validation page gives broader advice: ACL changes can take up to 24 hours to appear, and permission updates require a full crawl. That page does not describe the ServiceNow-specific incremental paths above. Use the connector-specific behavior when it applies, and retain the actual completion evidence. Neither statement guarantees that your change converges within a chosen interval.
A saved configuration can also miss the crawl already in progress. The connection-management documentation says edits during the initial full crawl take effect on the next scheduled full crawl. Record the save time and which subsequent crawl incorporated the change.
For a mapping-formula change, do not assume incremental identity sync alone applies the new formula: the cited ServiceNow guidance describes identity changes, not a universal formula-change guarantee. Verify the effective mapping and item permissions after the applicable crawl; investigate a mismatch before closing the ticket.
Check the same users and items before and after#
Use the connector's Index browser to locate each fixture. Microsoft's validation instructions expose item status, refresh time, permissions, and Check user access. That last view matters for users whose access comes through a group. A missing user can indicate failed mapping or discovery; it is not a successful denial check.
Repeat the baseline with the same identities and items after the update. Our recommended acceptance set is small enough to review manually:
| Case | Expected evidence |
|---|---|
| User loses access | Source denies the fixture; the resolved user is present; indexed access denies it. |
| User gains access | Source permits the fixture; indexed access permits it; an authorized retrieval can find it. |
| Unchanged user | Access remains consistent, catching an overbroad mapping correction. |
| Unmatched source identity | The mapping failure is visible and assigned for resolution, rather than counted as a verified denial. |
For each case, also check the intended Microsoft Search or Copilot experience using the test user's authorized session and a fresh query. Record the exact item returned, if any. A vague Copilot answer that omits the document cannot establish that the permission boundary worked: retrieval may simply have selected something else.
Keep content scope in the check. If the change also narrows the connector query, include an item that should leave the index. Correct user mapping cannot compensate for the wrong content population.
The following is an illustrative evidence record, not a Microsoft API payload or a claim of completed testing. Keep it in a restricted change record; replace nulls only with observed evidence.
Code source: illustrative
{
"connection_id": "pilot-knowledge",
"change_saved_at": null,
"mapping_before": null,
"mapping_after": null,
"case": "user-loses-access",
"source_user_id": "pilot-mover",
"entra_user_id": null,
"indexed_item_id": null,
"expected_access": "deny",
"crawl_type": null,
"crawl_completed_at": null,
"index_access_observed": null,
"surface_check_observed": null,
"checked_at": null,
"review_status": "unverified"
}
Resolve mismatches without widening access#
If the intended reader cannot retrieve a fixture, inspect the mapping and permission evaluation before changing the audience. Setting the connection to Everyone changes the access policy and invalidates a test of source-restricted access.
Check the ServiceNow flow, too. Microsoft's source-setup instructions require Advanced flow when the source uses script-based user criteria. A mapping correction cannot repair an unevaluated source rule. Keep the rule intact and investigate the configured flow.
If a denied user still retrieves restricted material, handle the exposure through your incident process while repairing the connection. Pause stops crawling but leaves indexed data searchable, according to Microsoft's connection states. Record and verify the containment action separately; do not mark the incident contained from the crawl state alone.
Preserve the evidence of what was actually returned. Our Microsoft 365 Copilot interaction-export guide explains how to collect prompts, responses, and audit records with their coverage limits. If the account or AI application falls outside the approved environment, the shadow AI detection guide covers that discovery problem.
Close the mapping change when the recorded checks match the source policy. Keep untested users and retrieval surfaces in the handoff so the next administrator knows what remains unchecked.
Frequently asked questions
- Can I edit a Copilot connector's identity mapping after creation?
Microsoft's October 6, 2026 release notes announce that capability. The management reference explicitly lists user-mapping edits for ServiceNow; check the supported operations for your connector and tenant rather than assuming every connector supports the same settings.
- Does pausing a connector remove its indexed content?
No. Microsoft's connection-state documentation says previously indexed data remains searchable while crawls are paused. Treat containment as a separate action and verify it on each affected surface.
- Does an incremental crawl refresh ServiceNow user memberships?
The standard incremental content crawl does not. ServiceNow Knowledge has a separate incremental identity sync for configured Advanced flow connections; otherwise identity updates require a full crawl. Verify actual completion and item access before closing the change.
