Deploy Protect to Microsoft 365

Protect is a SharePoint Framework solution that contains a list-view command set and a web part. The web part supports SharePoint pages and Microsoft Teams tabs.

Before you begin

Prepare the following:

• A SharePoint Administrator who can use the tenant App Catalog.
• An approved Protect package or access to its Microsoft Marketplace listing.
• A decision to deploy tenant-wide or to selected sites.
• A pilot site with a modern document library.
• A site owner who can edit a SharePoint page.
• A Teams Administrator if Protect will be made available in Teams.
• Test accounts representing a reviewer and a site owner.

Deployment and Pro licensing are separate. A working deployment can expose review and preview features while Protect editing actions remain license-controlled.

Choose a deployment method

Install from Microsoft Marketplace

1. Sign in with the administrator account responsible for app acquisition.
2. Open the Protect listing in Microsoft Marketplace.
3. Start the acquisition or approval flow.
4. Review the publisher, requested scope, privacy information, and your organization's app policies.
5. Approve and deploy the app by following the tenant prompts.
6. Continue to Verify the command extension.

If acquisition is blocked, route the request through your organization's Microsoft 365 app-approval process.

Install the SharePoint package

1. Open the tenant SharePoint App Catalog.
2. Open Apps for SharePoint.
3. Upload the approved Protect SharePoint package.
4. In the deployment dialog, review the solution details.
5. To make Protect immediately available across the tenant, select the tenant-wide deployment option. For a controlled rollout, leave it cleared.
6. Select Deploy.
7. For a controlled rollout, open each target site, select Add an app, and add Protect.

The deployed solution provides:

• Manage permissions, Manage columns, Fill properties, and View approvals commands in supported SharePoint list and library views.
• A Protect web part for SharePoint pages and Teams tabs.

Add the web part to SharePoint

1. Open the SharePoint page where reviewers should use Protect.
2. Select Edit.
3. Add a web-part section if the page doesn't have an appropriate section.
4. Select the add-web-part control and search for Protect. Depending on package branding, the catalog title can be ISO 19650.
5. Add the web part.
6. Publish or republish the page.
7. Open the published page with a reviewer account and confirm that the Sites view loads.

Add Protect to Microsoft Teams

1. In the SharePoint App Catalog, synchronize the solution with Teams if your tenant requires that action.
2. In the Teams admin center, allow the app in the applicable app permission policies.
3. Add the Protect web part as a tab in a pilot team, or add a SharePoint page that contains the web part.
4. Open the tab with a representative user.
5. Select a visible site and confirm that Protect uses that user's existing SharePoint access.

Configure the hosted website and web app

The public website, documentation, and standalone product are published as one Azure Static Web Apps artifact:

• / is the public Protect website.
• /docs contains the documentation.
• /app contains the authenticated product.

Add both the production and local product addresses as Single-page application redirect URIs on the Microsoft Entra app registration used by Protect:

• https://protect.flinker.app/app
• https://localhost:4323/app

The root address is intentionally public. Opening it does not start Microsoft authentication. A user must open /app and select Continue with Microsoft. After sign-out, Protect returns the user to the public website.

Verify the command extension

1. Open the pilot document library in its modern SharePoint view.
2. Clear the selection and confirm that Manage permissions and Manage columns appear.
3. Select one file and confirm that Fill properties and View approvals appear.
4. Select two rows and confirm that Manage permissions is hidden.
5. Clear the selection, select Manage permissions, and verify the site and folder in the Protect breadcrumb.
6. Select Manage columns and confirm that the policy dialog opens with Preview, JSON, and Reference tabs.

Verify the permission experience

1. Open the Protect web part or Teams tab with a reviewer account.
2. Confirm that the Sites view returns only accessible sites.
3. Open a known site and apply a permission filter.
4. Export the loaded permission data to Excel.
5. With a Pro-enabled site-owner account, perform one approved change on non-production content.
6. Select Refresh and confirm the new SharePoint state.

Update Protect

1. Review the release notes and validate the package in a pilot environment.
2. Upload the new package to the existing App Catalog entry.
3. Confirm replacement and deploy the update.
4. Recheck the command extension, web part, and Teams tab.
5. Recheck one export, one policy preview, and each licensed editing workflow used by your organization.
6. Communicate visible workflow changes before production rollout.

Scale beyond the pilot

Installing the Protect package tenant-wide makes the app available; it does not by itself standardize the governance configuration of every SharePoint project or Microsoft Teams-connected workspace.

1. Group target workspaces by purpose, business unit, region, or risk level.
2. Define and approve one governance template for each repeatable workspace type.
3. Validate the template against representative pilot projects and Microsoft Teams workspaces using actual user roles.
4. Deploy the approved template in controlled waves.
5. Verify SharePoint behavior and retain a deployment record before starting the next wave.

For template contents, pilot checks, wave planning, exceptions, and evidence, see Standardize governance across large workspace estates.