Private role-based AI assistant (specialty chemicals manufacturer)

One department needed answers from its own documents without exposing sensitive data. We built a private AI assistant that answers by role, inside the company's own Azure environment, and turns unresolved questions into tracked tickets.

One department at a global specialty chemicals manufacturer held its working knowledge in documents stored across SharePoint and Azure Blob Storage. Staff had no simple way to get answers from them, and three problems followed.

• Information was slow to reach people. Finding the right document and the right section took time, so questions went to colleagues by email and chat, and answers arrived late or got lost.

• Access control was loose. There was no consistent way to make sure each person saw only the information their role allowed. With sensitive data involved, that was a real risk of exposure.

• Requests were not tracked. When someone needed action rather than an answer, there was no structured way to raise it. Requests went untracked, and no one could see who owned them or how long they took.

The department wanted to use generative AI to fix the first problem, but only if it made the second one better, not worse.

We designed the assistant around four decisions, each tied to one of the department's concerns.

• Keep it private. The assistant runs inside the client's own Azure environment, on a private network. Nothing goes through a public AI service.

• Reuse the identity system they already had. People sign in with their existing Microsoft Entra ID accounts, and the assistant acts as that signed-in user. Each person only gets answers from information their role already allows.

• Answer from the department's own documents. Rather than training a model on company data, the assistant searches the department's documents for each question and writes its answer from what it finds. That keeps answers current as documents change and specific to each role.

• Turn requests into tickets. When a question needs action, the assistant raises a ticket in the company's existing Ivanti service desk, so every request has an owner and a status.

The build ran over 28 weeks as a managed engagement with hybrid delivery. It came together in five parts.

• Document pipeline. An Azure Logic App copies the department's files from SharePoint into an Azure Blob Storage container. An Azure AI Search indexer reads that container, and Azure OpenAI embeddings make the content searchable by meaning, not just keywords.

• Sign-in and access. Users sign in to a web app hosted on Azure App Service with their Microsoft Entra ID account. The app then works on behalf of that user, so their existing role-based permissions follow every request.

• Answering questions. A backend service on Azure App Service takes each question, retrieves the most relevant passages from Azure AI Search, and sends them to GPT-4o on Azure OpenAI to write the answer. The answer is grounded in the department's own documents.

• Raising tickets. When a request needs action, an Azure Function creates a ticket in Ivanti through its REST API, so the request is logged, assigned and tracked like any other service request.

• Private network. The web apps run inside a virtual network and reach Azure OpenAI, Azure AI Search and storage through private endpoints, so traffic between services never crosses the public internet.

Results reported after launch:

Estimated impact: around $150,000 a year in avoided data breach costs, from moving sensitive information behind role-based access on a private network.

• More time on real work. Staff get answers from their own documents in one place, instead of searching folders or waiting on colleagues.

• Lower risk with sensitive data. Generative AI was adopted without opening a new route to sensitive information: access follows existing roles, and traffic stays on a private network.

• Clear accountability. Every request that needs action becomes a ticket with an owner and a status, so nothing is lost in email and response times can be tracked.

• A pattern that scales. The same setup, private network, existing sign-in and answers grounded in company documents, can be extended to other departments without starting from scratch.