Just a cautionary note regarding use of the clientaccesspolicy.xml file: the example of it provided by ESRI in the help topic cited earlier in this thread opens up a huge security hole if used on an external web server. The "allow-from" & "domain" settings use the * wildcard, which means that access is made available to any domain. This should be changed from * to your sharepoint server's name & if at all possible, avoid using it at all on an external web server.