How to extend Coveo website search to your intranet

To extend an existing Coveo website search deployment to the intranet, keep your Coveo skills, analytics practice and front-end components, and add what the intranet needs: secured sources for SharePoint, Confluence and ServiceNow, permissions indexed with each item, a separate search hub and query pipeline, and relevance tuned on employee queries. Plan it as a new search solution on a platform you already know, not as a setting to switch on.

The short answer

Your website deployment gives you a head start. Your team already knows how Coveo sources, query pipelines, machine learning models and analytics reports work. The intranet adds content that not everyone is allowed to see, so the project is mostly about identity, permissions and keeping the two audiences apart.

Start with an inventory of intranet sources and permissions, build and test the secured sources in a sandbox organization, route employee queries to their own query pipeline, pilot with one group in French and English, then let usage data drive the tuning.

What carries over from your website deployment

• Platform skills. Your administrators already manage sources, query pipelines, ranking rules and Coveo ML models. The same console and the same concepts apply to intranet content.
• Relevance practice. Query ranking expressions, A/B tests on query pipelines and the Relevance Inspector work the same way on intranet search. If your team already tests changes before rolling them out, keep doing it.
• Analytics habits. The reports you read for the website, such as search clickthrough and queries without results, are the same metrics you will watch for employees.
• Front-end components. Your developers can build the intranet search page with the Coveo libraries they already use on the website.
• The relationship. You already have a Coveo contract and account team. Confirm with them how intranet users and sources are licensed before you design the architecture.

What is new on the intranet

Intranet sources and connectors

Coveo offers native source types for the systems most intranets rely on, including SharePoint Online and SharePoint Server, Confluence Cloud and Confluence Data Center, ServiceNow, Jira, Google Drive, Box, Dropbox and Slack. REST API, GraphQL API and Push sources cover systems without a native connector. Coveo's documentation recommends dedicated crawling accounts and tokens for each source.

Identity and permission crawling

Website content is usually public, so website sources often let everyone see every item. Intranet sources must not. Coveo's recommended content security option, "Same users and groups as in your content system", indexes each item's permissions with the item. Coveo calls this early binding: at query time, items the user cannot open are filtered out before results are built.

A few details matter by source:

• Confluence Cloud. Replicating permissions requires installing the Coveo User Sync app in your Atlassian site, because Atlassian's API does not return user email addresses.
• ServiceNow. Coveo's ServiceNow source documentation states that ServiceNow permissions are only partially supported, so test knowledge base and article user criteria with real accounts.
• SharePoint Online. The source is linked to a security identity provider that other sources may share. Coveo advises checking the impact on those sources before you reauthorize it.

Our guide on permission-aware AI search explains why early binding is the safe model, and our article on permission-aware enterprise search covers what security teams should check.

Separate search hubs and query pipelines

Do not send employee queries through the pipeline that serves your website. Create a search hub for the intranet and a query pipeline with a condition such as "Search hub is Intranet". Website ranking expressions, filters and model associations then never apply to employees, and intranet rules never reach the public site.

Coveo recommends condition-based routing combined with a search token generated server side that enforces the search hub. Users and client-side code then cannot change which pipeline a query goes through. This matters most if an intranet source has to stay open to everyone and relies on pipeline filter rules for protection.

Relevance tuned for employees

Employees search differently from website visitors. They use internal acronyms, project names and policy titles, and they often need one specific document. Your website models will not solve that for you. Coveo's Automatic Relevance Tuning (ART) builds a submodel for each language, filters it by search hub and search tab, and boosts items only when they were clicked in the same search interface. Intranet relevance learns from intranet traffic.

While the models collect data, use query ranking expressions to apply business rules, for example to favour the official policy library over old file shares. ART also checks permissions: it only recommends items the user is allowed to access.

A phased plan

1. Assess. List intranet sources, owners, permission models and identity systems. Pull search logs from the current intranet if you have them, in both languages. Decide which sources come first.
2. Build in a sandbox. Coveo recommends creating sources in a sandbox organization first, then copying the configuration to production with a snapshot or manually. Index the first sources with "Same users and groups as in your content system" and test with real accounts from different groups, including HR and executive content.
3. Route and secure. Create the intranet search hub, its query pipeline and its routing condition. Generate search tokens server side after the user signs in to the intranet.
4. Pilot. Launch to one department. Watch queries without results and search clickthrough, add query ranking expressions where results are clearly wrong, and test French and English queries separately.
5. Scale and tune. Add the remaining sources one at a time. Turn on ART once the intranet has enough traffic, and use A/B tests on the query pipeline before rolling out larger changes. Name the person who owns intranet relevance.

Common pitfalls

• Reusing the website pipeline. Employee queries pick up rules written for public visitors, and a change for one audience breaks the other.
• Opening intranet sources to "Everyone" to go faster. Without item permissions, the only protection is pipeline filters and server-side search tokens. Use "Same users and groups as in your content system" wherever the connector supports it.
• Expecting website models to rank intranet results. ART learns per search hub. Plan for a period where query ranking expressions do the work.
• Skipping permission tests on ServiceNow and Confluence. Partial ServiceNow permission support and the Confluence User Sync app are documented requirements, not edge cases.
• Testing only in English. ART builds a submodel per language. Bilingual organizations need real French queries in the pilot.
• Launching without an owner. Intranet search needs someone who reads the reports and adjusts rules after launch.

What to look for in a partner

The right partner for this work has run Coveo on websites and on secured internal content. Ask each candidate:

1. How will you handle permissions for each source? Expect specific answers on ServiceNow user criteria, the Confluence User Sync app and SharePoint identity providers.
2. How will you keep website and intranet search apart? Look for search hubs, pipeline conditions and server-side search tokens.
3. What is your permission test plan? Ask which accounts and collections they will test, not for a promise.
4. How will you tune relevance before the models have data? Listen for query ranking expressions, analytics reviews and A/B tests.
5. Do you work in French and English? Bilingual relevance needs testing in both languages.
6. When would you advise against Coveo? A neutral partner can name cases where another tool fits better.

How Sengo approaches it

Sengo rebuilds intranet search across SharePoint, ServiceNow and the CMS. We are an official Coveo implementation partner with a former Coveo backend developer on the team, and we tell clients when Glean, Microsoft 365 Copilot or another tool fits better. Our intranet search assessment covers sources and connectors, whether results and AI answers respect who can open each document, search logs in French and English, content hygiene and AI assistant readiness, and ends with options and a roadmap.

For background, read how an AI-enabled intranet on Coveo works, how to unify a ServiceNow knowledge base with SharePoint and your CMS, and our Coveo vs Glean comparison. See also our smart intranet approach and our Coveo partner page.

Frequently asked questions

Can the website and the intranet share one Coveo organization?

Sources for both can live in the same organization, with secured intranet sources and separate query pipelines keeping the audiences apart. A separate organization is also an option if you want separate administration. Confirm licensing and roles with your Coveo account team first.

Will our website search models improve intranet results?

Not directly. ART builds submodels per language, filters them by search hub and search tab, and boosts items only when they were clicked in the same search interface. The intranet needs its own usage data, and query ranking expressions can fill the gap at first.

Which intranet systems can Coveo index?

Native source types include SharePoint Online and Server, Confluence Cloud and Data Center, ServiceNow, Jira, Google Drive, Box, Dropbox and Slack. REST API, GraphQL API and Push sources cover other systems.

How does Coveo enforce document permissions on the intranet?

With early binding. Sources set to "Same users and groups as in your content system" index each item's permissions, and Coveo filters out items the user cannot open at query time. Test ServiceNow user criteria and install the Coveo User Sync app for Confluence.

Should we look at Glean instead?

If most intranet content sits in SaaS tools and nobody will own search tuning, Glean is worth a pilot. If Coveo already runs your website and you want one platform with fine relevance control, extending it reuses the skills and contract you already have. Our Coveo vs Glean comparison covers both.

Where do we start?

With an inventory of sources, permissions and search logs. The intranet search assessment covers these and ends with options and a roadmap.

Start with an intranet search assessment

Sources & References

1. Management of security identities and item permissions: Coveo Platform
   docs.coveo.com
2. Add a source: Coveo Platform
   docs.coveo.com
3. Add a SharePoint Online source: Coveo Platform
   docs.coveo.com
4. Add a Confluence Cloud source: Coveo Platform
   docs.coveo.com
5. Add a ServiceNow source: Coveo Platform
   docs.coveo.com
6. Set up a query pipeline: Coveo Platform
   docs.coveo.com
7. Use query ranking expressions: Coveo Platform
   docs.coveo.com
8. About Automatic Relevance Tuning (ART): Coveo Platform
   docs.coveo.com
9. A/B tests: Coveo Platform
   docs.coveo.com