The roadmap entry is short. The more useful finding comes from Microsoft's own connector documentation, which hasn't caught up with it. Several deployment guides still say incremental crawls ignore permission changes. That gap tells admins what to check before they rely on the new behavior.
What the roadmap entry says
The entry describes the change in two sentences. Earlier, permissions were synced only in the periodic full crawl, which it says generally ran once a day by default for most connectors. Now Microsoft says it supports doing permission syncs more frequently in an incremental way.
According to the roadmap metadata, the item:
- Is marked Launched
- Is part of the General Availability release ring
- Applies to Microsoft Copilot (Microsoft 365) on the Web platform
- Covers the Worldwide (Standard Multi-Tenant) cloud only
- Had a preview in May 2026 and general availability in July 2026
The dates moved along the way. An earlier copy of the entry, recorded by the M365 Admin tracker, showed it created 2025-12-04 with a General Availability release date of June CY2026. A later snapshot on the DeltaPulse tracker listed the status as "In development" with an expected release of July 2026. Microsoft's roadmap describes its dates as estimates that can change, and it removes items once they reach GA. The "Launched" label is therefore the only status evidence available. No Message Center post, technical spec or per-connector list for this item turned up.
The Worldwide-only scope matters. If your tenant is in GCC, GCC High, DoD or a sovereign cloud, nothing in the entry says this applies to you.
Section summary: Microsoft's roadmap says connector permission changes no longer have to wait for the daily full crawl. It went GA in July 2026 for worldwide multi-tenant customers, but Microsoft hasn't published a guaranteed refresh interval.
Why this was a real problem
Copilot connectors bring content from outside Microsoft 365 into the Microsoft Graph index: wikis, ticketing systems, file stores, CRM data. Each indexed item carries an access control list (ACL). The ACL is a list of Microsoft Entra users and groups, plus an "Everyone" entry for the whole tenant, each either granted or denied access. A deny entry always beats a grant. Copilot and Microsoft Search check that ACL to decide who can see an item in results.
The weak spot was how often that ACL got refreshed. Connectors usually run two schedules:
| Crawl type | Typical default | What it updated (per current docs) |
|---|---|---|
| Incremental crawl | Every 15 minutes | New and modified content |
| Full crawl | Daily | All content, deleted items and ACL changes |
The Confluence Cloud connector overview spells this out. It warns that permission changes are picked up only during a full crawl (once every 24 hours by default), not during the 15-minute incremental syncs. It also notes that there can be a delay (up to the next full reindex) before Copilot results fully reflect newly changed permissions.
In practice, content changes showed up in about 15 minutes, but access changes could take up to a day. Picture a contractor removed from a Confluence space at 9 a.m. With a daily full crawl, the index could still treat that page as visible to them for the rest of the business day.
That's not a breach of the source system. The contractor can't open the page in Confluence. But Copilot doesn't just find files. It summarizes and cites them, so an outdated permission can turn into a tidy paragraph answer for someone who shouldn't be reading that material.
Microsoft's docs haven't caught up
This is the part admins should pay attention to. Months after the roadmap's July GA date, many of Microsoft's per-connector deployment guides still describe the old behavior:
- The general connector deployment guide says incremental crawls don't support permission updates, and it lists updating ACLs among the jobs a full refresh handles.
- The Confluence On-premises guide, updated within the last month, still says updates to permissions sync only during full crawls, and that incremental crawls don't pick up access control list (ACL) changes or deleted items.
- The Jira Cloud guide says updates to groups that govern access permissions are synced in full crawls only. Incremental crawls don't support the processing of updates to permissions.
- The Azure DevOps Wiki guide uses nearly the same wording: updates to groups governing access permissions sync in full crawls only. Incremental crawls don't support the processing of updates to permissions.
There are a few possible explanations. The documentation may simply be behind, which is common with roadmap items. The rollout may be connector by connector, with some first-party connectors not yet included. Or "more frequently in an incremental way" could mean something narrower than "every incremental crawl syncs ACLs." The roadmap text doesn't say which. Admins shouldn't assume any one of them is true until they've tested their own connectors.
Section summary: The roadmap says incremental permission sync is live. Microsoft's own connector guides for Confluence, Jira, Azure DevOps Wiki and the general deployment flow still say otherwise. Test before you rely on it.
What admins should do now
You manage connectors in the Microsoft 365 admin center with the AI administrator role. Here's how to check whether faster permission sync is working for you:
- List your connectors and their permission models. Some connectors don't enforce per-item permissions at all. The Amazon S3 connector, for example, only supports Visible to Everyone permission. All indexed content is visible to Microsoft 365 users. Faster ACL sync does nothing there.
- Check your crawl schedules. Under Copilot > Connectors > Your Connections, look at each connection's state and last sync time. Microsoft says a connection is only as fresh as its last successful crawl.
- Run a controlled test. Take a test account and a non-sensitive item in a connected source. Remove the account's access in the source system, wait for an incremental crawl to complete (and not a full crawl), then check whether the item still appears in Copilot or Microsoft Search for that account. That tells you what your tenant actually does, whatever the docs say.
- Use on-demand crawls when it's urgent. Admins can start an on-demand full or incremental crawl outside the schedule on supported connections. For connections running through the Microsoft Graph connector agent, Microsoft says on-demand crawls need agent version 2.1.0.0 or later. Only one crawl can run on a connection at a time. If a crawl runs past the next scheduled one, Microsoft stops the active crawl and queues the skipped one.
- Keep running full crawls. Even with better incremental permission handling, Microsoft's deployment guidance says to run full refreshes periodically to ensure data consistency between the source system and the search index. Full crawls also handle deletions and schema changes.
- Have a response plan for urgent removals. For terminations or legal holds, don't wait for any crawl schedule. Remove access in the source system, then start an on-demand full crawl, or turn off the connection's Copilot visibility. Microsoft notes visibility changes can take up to 30 minutes to reach all Copilot experiences.
The bigger picture: synced vs. federated
This change also fits a larger shift in Microsoft's connector strategy. Federated connectors, which Microsoft announced in May, skip indexing entirely. As one practitioner write-up puts it, they use Model Context Protocol, or MCP, to retrieve content in real time from an external system at the moment a user asks a question. Because permissions are checked against the live source with the user's own credentials, they can't go stale between crawls.
Synced connectors, which copy content into the Graph index, still have the advantage in search relevance, offline indexing and the semantic features Copilot depends on. But the old setup, where content updated every 15 minutes and permissions only once a day, was hard to defend once federated connectors offered live access checks. Speeding up permission sync in incremental crawls closes some of that gap. It doesn't close all of it. Any delay between a source ACL change and the index is still a delay, and Microsoft hasn't promised a number.
Bottom line
Roadmap item 503570 targets one of the most common complaints about synced Copilot connectors: content refreshed in minutes while permissions lagged up to a day. If it works as described, that's a real governance improvement for organizations that index Confluence, Jira and similar systems into Microsoft 365 Copilot.
Microsoft hasn't published a refresh interval, a list of covered connectors or a configuration procedure. Several of its own deployment guides still say incremental crawls skip permission changes. Until the documentation catches up, test it on your own connectors, keep full crawls scheduled, and don't let a "Launched" label replace an access review.