M365
Backend
Pipeline
Experience
Storage
FastAPI Backend
The central orchestrator. Runs on Azure Container Apps (consumption plan) — chosen over App Service for native KEDA integration, scale-to-zero cost savings, and the ability to run multiple apps (API + workers) in a shared environment with independent scaling.
Authenticates via MSAL for Python against Entra ID to obtain tokens for Microsoft Graph calls.
Microsoft Graph
Unified REST API layer for all M365 services. Provides read/write access to SharePoint files, Outlook mail, Teams channels, calendar, users, and Business Central data through a single authenticated endpoint.
FastAPI calls Graph endpoints using OAuth2 tokens. Supports delta queries for incremental sync and change notifications via webhooks.
Logic Apps (Workflows)
Low-code automation for event-driven workflows. Triggers on new Outlook mail, SharePoint file uploads, Teams messages, or scheduled intervals. Calls FastAPI endpoints for AI processing, classification, and routing.
Connectors for 400+ services. Handles approval flows, notifications, and cross-system orchestration without custom code.
RAG Pipeline
Retrieval-Augmented Generation for document intelligence. Documents from SharePoint and Outlook are extracted, split into semantic chunks, embedded into vectors, and stored in a search index.
At query time, relevant chunks are retrieved via hybrid search (vector + keyword) and passed as context to the LLM for grounded, accurate answers.
Copilot Studio Agent
Custom AI agent built in Microsoft Copilot Studio. Connects to Azure AI Search as its grounding knowledge source, enabling the agent to answer questions based on indexed organizational content with citations.
FastAPI endpoints are registered as plugins, allowing the agent to perform actions — create tasks, send notifications, query Business Central, or trigger Logic App workflows — all from natural language conversation.
Microsoft Fabric
Unified analytics platform combining lakehouse, data warehouse, ETL pipelines, notebooks, and Power BI into a single managed environment. Serves as the central data and reporting layer for the entire solution.
Operational data from all integrated systems flows into OneLake for long-term storage, transformation, and business intelligence through Power BI dashboards.
Unified Event-Driven Pipeline
All M365 changes — new documents, emails, messages — flow through a single event backbone. Service Bus topics fan out to domain-specific worker apps that scale independently via KEDA.
source = 'sharepoint'source = 'outlook'source = 'teams'all events (catch-all)Idempotency & Document Metadata Tracking
Every processed event is tracked in Azure Cosmos DB (NoSQL API) to guarantee exactly-once processing semantics and provide a complete audit trail of all pipeline activity.
{
"id": "graph-notif-a1b2c3d4",
"partitionKey": "documents-worker",
"source": "sharepoint",
"resourceId": "/sites/ops/docs/Q2-report.pdf",
"changeType": "updated",
"graphTimestamp": "2026-03-10T14:22:00Z",
"status": "completed",
"claimedAt": "2026-03-10T14:22:01Z",
"completedAt": "2026-03-10T14:22:08Z",
"durationMs": 7042,
"workerInstance": "documents-worker-replica-3",
"output": {
"chunksCreated": 24,
"indexName": "corporate-knowledge",
"embeddingModel": "text-embedding-3-large",
"contentHash": "sha256:e3b0c442..."
},
"ttl": 2592000
}
id is derived from the Graph change notification ID. Duplicate deliveries from Service Bus resolve to the same document — Cosmos upsert is atomic.
claimedAt timestamp acts as a lease. A background sweep or the next delivery reclaims stale records after a configurable timeout (e.g. 5 minutes).
Use Case Examples
Practical scenarios showing how the architecture components work together to solve real business problems.
Company Knowledge Assistant
Employees ask natural-language questions about internal policies, contracts, or product specs. The system retrieves relevant SharePoint documents via Graph, chunks and embeds them, then delivers precise, cited answers through a Teams bot or web chat.
Intelligent Email Triage
Incoming client emails in Outlook trigger a Logic App that calls FastAPI. The AI classifies intent (support request, invoice, complaint, inquiry), extracts key entities, drafts a response, and routes to the correct Teams channel or SharePoint list. Urgent items get flagged with priority notifications.
Business Central Analytics Dashboard
Sales orders, inventory levels, and financial data from Business Central flow into Microsoft Fabric's lakehouse via scheduled pipelines. Power BI dashboards surface real-time KPIs — revenue trends, margin analysis, fulfillment rates — accessible to leadership directly in Teams tabs.
Client Onboarding Automation
When a new client record is created in the CRM, a Logic App triggers an automated onboarding workflow: creates a dedicated SharePoint site with template documents, sends a welcome email sequence via Outlook, schedules a kickoff meeting in calendar, and posts an intro in the team's channel.
Compliance & Contract Review
Legal and compliance documents stored in SharePoint are continuously ingested, chunked, and indexed. Staff can query across thousands of contracts — "which agreements expire in Q2?" or "find all clauses related to data retention." Analytics on query patterns and document usage flow to Fabric for compliance reporting.
Meeting Intelligence Hub
Teams meeting transcripts and recordings are processed by FastAPI — summarized, action items extracted, and decisions logged. Summaries are posted back to the meeting chat, action items create tasks in Planner via Graph, and meeting analytics (frequency, topics, participation) are tracked in Fabric dashboards.
Technology Stack Overview
| Component | Role | Category | Alternatives |
|---|---|---|---|
| Microsoft Fabric | Lakehouse + warehouse + BI + ETL | Analytics | Databricks, Snowflake, BigQuery |
| Microsoft Graph | Unified API for M365 services | API Layer | Google Workspace API, Slack API |
| FastAPI | Custom backend / orchestrator | Backend | Django, Express, .NET |
| Azure Logic Apps | Low-code workflow automation | Automation | n8n, Zapier, Power Automate |
| Azure AI Search | Vector + hybrid search index | AI / Search | Elasticsearch, Weaviate |
| Azure Service Bus | Message queue / topic for event decoupling | Messaging | RabbitMQ, Amazon SQS |
| KEDA | Event-driven autoscaler for Container Apps | Scaling | HPA, AWS Lambda triggers |
| Azure Cosmos DB | Idempotency store + document processing metadata | State / Metadata | DynamoDB, MongoDB Atlas, Azure SQL |
| Power BI | Dashboards + reporting | Analytics | Tableau, Looker, Metabase |
| Copilot Studio | Custom AI agent builder + multi-channel deployment | AI / Copilot | Custom Teams bot, Botpress, Voiceflow |
| Azure Key Vault | Centralized secret, certificate, and key management | Security | AWS Secrets Manager, HashiCorp Vault |
| Terraform → Bicep | Infrastructure as Code — Terraform for MVP, Bicep migration for v2 | Infrastructure | Terraform, Pulumi, CloudFormation |
Technical Highlights
Cloud-Native & Scalable
The entire platform runs on Azure Container Apps (consumption plan) with native KEDA autoscaling, scale-to-zero cost savings, and independent scaling per worker. Logic Apps handle workflow automation, Fabric covers analytics — all managed services with minimal infrastructure overhead.
AI-Powered Document Intelligence
Documents and emails are automatically chunked into semantic passages, embedded as vectors, and indexed for hybrid search — enabling precise, grounded answers from your organization's knowledge base.
Secure Identity & Access
All service-to-service communication is authenticated through Microsoft Entra ID with OAuth 2.0 via MSAL. Azure Key Vault stores all secrets centrally — accessed only through managed identities with zero secrets in code or config.
Reproducible Infrastructure
All Azure resources are provisioned via Terraform (MVP) with a planned migration to Bicep for v2. Environments (dev, staging, prod) are identical by definition, deployed through GitHub Actions CI/CD with no manual portal configuration.
Infrastructure & Deployment
All infrastructure is defined as code, secrets are centralized in Key Vault, and environments are provisioned through automated pipelines — ensuring security, reproducibility, and auditability across all stages.
# main.tf
variable "env" {
type = string
default = "dev"
validation {
condition = contains(["dev","staging","prod"], var.env)
error_message = "Must be dev, staging, or prod."
}
}
variable "location" {
type = string
default = "eastus" # Confirmed with client
}
resource "azurerm_resource_group" "main" {
name = "rg-m365-platform-${var.env}"
location = var.location
}
module "keyvault" { source = "./modules/keyvault" }
module "cosmos" { source = "./modules/cosmos" }
module "servicebus" { source = "./modules/servicebus" }
module "ai_search" { source = "./modules/ai-search" }
module "openai" { source = "./modules/openai" }
module "container_apps" { source = "./modules/container-apps" }
azurerm provider coverage for all resources in scope (Container Apps, Cosmos DB, Service Bus, AI Search, Key Vault, OpenAI). No learning curve risk on a 17-day deadline.
terraform apply.
var.env variable (dev / staging / prod) produces identical infrastructure with different naming and SKUs. Parameter files per environment — no branching.
keyvault, cosmos, servicebus, ai-search, openai, container-apps — each independently testable and reusable.
terraform plan (if infra changed) and Docker image build (if app changed)terraform apply provisions or updates Azure resources (runs only when infra/ changes)