This article documents the Entra application permissions used by the WorkPoint365.WebAPI enterprise application. The sections below represent the distinct feature sets of WorkPoint 365 detailing the unique permissions required for the feature to operate. This article is used to provide content to the upcoming WorkPoint Administration Portal consent management UI.
Core Permissions
Group description
| API | Type | Permission | Description |
|---|---|---|---|
| MS Graph | Delegated | User.Read | lorem |
Core Permissions - Site Provisioning (Full Control)
The Core – Site Provisioning (Full Control) feature allows WorkPoint 365 to create new sites for the WorkPoint solution and manage existing SharePoint Online sites using application permissions. This capability relies on Sites.FullControl.All, which is currently required for automated site provisioning and grants the application access to all sites within the tenant.
Although this permission technically allows WorkPoint 365 to access and manage any SharePoint Online site, the application only uses it to provision and manage WorkPoint-related sites. For organisations that require a more restrictive permission model, alternative site provisioning options are available and described below.
| API | Type | Permission | Description |
|---|---|---|---|
| Microsoft Graph | Application | Sites.FullControl.All | Allows the app to have full control of all site collections without a
signed in user. This permission allows WorkPoint 365 to create SharePoint sites within the tenant, enabling the provisioning of new Entity Sites and the maintenance of Buffer Sites for operational readiness. Although this permission technically provides access to all SharePoint sites, WorkPoint services use it exclusively to provision and manage WorkPoint solution sites and their associated Business Module entity sites. |
Core Permissions - Site Provisioning (Limited Access)
When deployed using the Limited Access model, WorkPoint 365 uses the Sites.Selected application permission to access the WorkPoint Solution Site and associated Entity Sites. In addition to granting consent for Sites.Selected, administrators must explicitly grant the WorkPoint 365 service principal Full Control permissions on each site used by the solution.
Because Sites.Selected does not support site creation, WorkPoint 365 cannot provision new sites in this configuration. Organisations must therefore implement a separate process to create sites, grant permissions, register the sites in WorkPoint 365, and make them available for entity allocation. Further details are provided in the referenced support articl
| API | Type | Permission | Description |
|---|---|---|---|
| Microsoft Graph | Application | Sites.Selected | Manages application access at the site collection level, providing
access to a specific site collection |
| Microsoft Graph | Application | Sites.Create.All | FUTURE ENHANCEMENT: Allows an application to Create sites in the tenant without the
Sites.FullControl.All permission. Once this permission is in general availability, WorkPoint365 services will use Sites.Create.All permission to create new sites in the customer’s tenant as required to support Entity provisioning and site assignment. |
Comments
0 comments
Please sign in to leave a comment.