Solutions · Repository connectors

Search network file shares for FOI and ATIP requests

The departmental share, a former employee's home folder, the archive nobody has opened in years — browse and search SMB shares from inside the case, capture files or whole folder trees with the path, version and SHA-256 on record, and, on a domain-joined host, let NTFS permissions decide what each coordinator sees. No VPN and no inbound firewall rule.

Start Free Trial Request a Demo

Network shares are where an organization's working records pile up: the program area's folder tree, a departed employee's home drive, scanned files saved to a departmental share. They're also where FOI and ATIP searches go wrong. A custodian is asked to look, copies a handful of files to an email or a USB key, and the access office never learns what was searched, what was left out, or whether the copy matches the original.

Azure can't mount an SMB share, so the network file share connector runs beside it: a small Windows service on a domain-joined host — a VM or the file server itself — under a domain service account with read and list rights on the folders you expose, and nothing more. AccessPoint reaches it through an Azure App Service Hybrid Connection: the Hybrid Connection Manager on the same host makes an outbound HTTPS connection to Azure Relay, so there is no VPN, no ExpressRoute and no inbound firewall rule, and the API's own TLS session runs end to end inside the tunnel. The connector accepts calls only from your AccessPoint deployment's managed identity and refuses to start without that restriction. Coordinators then browse the configured roots as folders, search by name, extension and modified date or by terms in the file name, and capture files or collect whole folder trees. A file open in Word still captures, hidden and system files are skipped by default, and long paths are supported.

In the Application mode, whatever the service account can read is exposed and AccessPoint's case-level rule decides who may browse and capture — the right choice when the access office is the custodian of the share. In the Application with user check mode, the connector resolves the coordinator's UPN to their Active Directory account and evaluates each file's NTFS permissions — any matching Deny wins — so listings are trimmed per person and AccessPoint confirms access before every capture. That mode needs a domain-joined Windows host and hybrid identity, where the Entra UPN matches Active Directory, and it fails closed. The costs are in your own estate and subscription: the host (two vCPUs and 4 GB are ample, or the file server itself) and the Hybrid Connection — about USD $10 per listener per month at Azure Relay list price, with 5 GB of relay traffic included and a per-GB charge above that.

Sound familiar?

Three moments every office that searches shared drives for requests recognizes.

The search that lives in someone's memory

The custodian says they searched the shared drive. Which folders? With what terms? The only record is a sentence in an email.

The USB-key copy

Responsive files are dragged to a USB key or attached to an email, losing their folder path and modified date on the way into the request file.

The folder you weren't meant to see

A coordinator collecting from a departmental share opens an HR folder that the share's own permissions would never have shown them.

What to look for when an FOI system reaches a network file share

Whatever you use, these are the questions your network, security and records teams will ask.

No inbound ports The share should be reachable over an outbound-only connection from inside your network — not a VPN, and not a firewall rule that lets the cloud in.
NTFS permissions honoured Where it matters, each person should see only what the share's own permissions allow, with explicit denies respected and failures closed.
A read-only service account Read and list rights on the folders exposed, and nothing else — the connector should never write.
Folder-tree collection with filters Collect a custodian's whole tree by modified date, name pattern, extension and size, mirror the folders, and re-run safely without duplicates.
Path, version and hash on every file Each captured file should keep the path it came from, the version taken and a SHA-256 — not a renamed attachment.
Only your deployment may call it The service beside the share should accept calls only from your own AccessPoint identity, over TLS with a certificate for its host name.

How the network file share connector works

A ready-to-run service beside the share, reached from your AccessPoint deployment through Azure Relay.

Runs beside the share

A Windows service on Windows Server 2019 or later with the .NET 10 runtime, unzipped from the release's connectors folder — each zip with a SHA-256 file to verify before you deploy.

Reached through a Hybrid Connection

The Hybrid Connection Manager needs outbound port 443 to Azure Relay and nothing inbound. Run it on two machines for redundancy; Azure Relay spreads connections across both.

Browse and search the shares

Configured roots appear as folders, sorted by name. Search by name, extension and date, or by terms in the file name; once captured, AccessPoint's own content search covers what's inside.

NTFS-aware, per person

In user-check mode the connector evaluates each file's permissions for the person asking — their own account and every group they belong to, nested groups included — and excludes what they can't read.

Collect whole folder trees

Collect this folder walks the subtree depth-first, applies the dialog's dates, name pattern, extensions and size, mirrors the folders into the case, and skips files already captured.

Hashed as it streams

The SHA-256 is computed while each file streams and reported back after capture, so captured files are verified. Files up to 50 GB are served by default, within AccessPoint's own upload limits.

Chain of custody

From the shared drive to the case, with the path intact

The AccessPoint API pulls each file from the connector and streams it into the case's own storage, computing its SHA-256 on the way, then processes it exactly like an upload — PDF conversion, indexing, redaction scans, duplicate detection and, where deployed, the Defender malware scan. Source details keep the path the file came from, the version taken, the hash and its state, when the file was last modified, who captured it, when and for which case, and the collection job it came through. A share path isn't a web link, so there is no Open in source — the path itself is the record. The connector logs every call against the person, the case and the purpose, and AccessPoint's audit ledger records the connector, the item, the version, the hash and the purpose.

Inside your network and tenant The connector sits beside the share; captured copies land in your own Azure storage; nothing passes through Realizer.
Logged on both sides The connector's log and AccessPoint's audit ledger both name the person, the case and the purpose.
No per-connector fee Repository connectors are included in every AccessPoint plan.

From share to case

The path for a departmental file server:

  1. AccessPoint administrator: redeploy with Hybrid Connections on and the connector's host name and port listed — for example apconnector.corp.example.ca:8443 — then create the AccessPoint Connectors app registration in Entra once and enter it in Settings as the tenant's default connector audience.
  2. On a domain-joined Windows host, unzip the connector, install a certificate for that host name, set the roots, your tenant, the audience and the API's managed-identity object id in its settings, and install it as a Windows service under a read-only service account.
  3. Install the Hybrid Connection Manager on the same host and add the connection; it should read Connected.
  4. In Settings → Foundations → Repository connectors, add a Remote connector at that host name and port with Reached through a Hybrid Connection switched on, run Test connection, and enable it. Widen it to the Custodian role if custodians should collect their own folders.
  5. On a case, open Add from…, choose the share, and browse, search and capture — or use Collect this folder… for a custodian's whole tree.

Go deeper

Repository connectors Every connector, how capture works, and the chain of custody behind it. Connectors in the docs Registering, testing and operating connectors, including Hybrid Connections. Records & information managers A defensible search across the shares and systems you steward. Municipal & local government Shared drives, small teams and statutory clocks — the municipal FOI office. FOI request management The full request lifecycle the search belongs to — deadlines, collection, redaction, release. Security & data sovereignty Where captured records live, who can see them, and what never leaves your tenant.

Network File Share Connector Questions

How can a cloud FOI system search an on-premises network file share?
AccessPoint's network file share connector runs as a Windows service on a host that can see the share — a small VM or the file server itself — and AccessPoint reaches it through an Azure App Service Hybrid Connection. Coordinators then browse and search the share from any case and capture files or whole folder trees into the request, each with its path, version and SHA-256 recorded. The AccessPoint API does the fetching server-side; the browser never touches the share.

Do we need a VPN or an inbound firewall rule?
No. The Hybrid Connection Manager on the connector's host makes an outbound connection on TCP port 443 to Azure Relay in your own subscription and needs no inbound port; the AccessPoint API's own TLS session runs end to end inside that tunnel, so the relay never sees the content. The connector's certificate must cover the host name you register, and the connector accepts calls only from your AccessPoint deployment's managed identity.

Can it respect NTFS permissions on the share?
Yes, in the Application with user check mode on a domain-joined Windows host. The connector resolves the coordinator's UPN to their Active Directory account, gathers their groups (nested membership included), and evaluates each file's NTFS rules — any matching Deny wins. Listings are trimmed per person, and AccessPoint asks the connector to confirm access immediately before each capture. It needs hybrid identity, where the Entra UPN matches Active Directory, and it fails closed: if a user or a file's permissions can't be resolved, the file is excluded. In the default Application mode, AccessPoint's own case permissions are the gate.

Does it copy files or link to them?
It copies them. Each captured file is a frozen copy in the case's own storage with its path, version and a SHA-256 recorded, processed exactly like an upload. A share path can't be opened from a web page, so captured files carry their path rather than a link. A file already captured at the same version on a case is skipped rather than duplicated, so re-running a folder collection is safe.

Does it need a Windows server?
Windows is recommended: a domain-joined Windows Server 2019 or later host (or Windows 11) with the .NET 10 runtime, which is also what per-user NTFS checks need. Alternatively, it can run on a Linux host or container in Azure with the shares mounted — CIFS or Azure Files — in the Application mode only.

What does the network file share connector cost?
Nothing extra from Realizer: repository connectors are included in every AccessPoint plan, with no per-connector fee. Your own costs are the host it runs on — two vCPUs and 4 GB are ample, or the file server itself — and the Azure Relay Hybrid Connection, about USD $10 per listener per month at list price with 5 GB of relay traffic included and a per-GB charge above that, billed in your own subscription. An Azure Relay namespace with no listener connected costs nothing.

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.

  • Under 500 employees$2,990/yr
  • 500–1,999 employees$7,990/yr
  • 2,000–9,999 employees$14,990/yr
  • 10,000+ employees$29,990/yr

See full pricing Build the business case

Search the Shared Drive From the Case.

Try AccessPoint free for 30 days in your own Microsoft 365 tenant — repository connectors included, no per-connector fee.

Start Free Trial Request a Demo