SharePoint remains the system of record for sites, files, groups, links, permissions, metadata, validation, and approval state. Protect reads and writes that information under the signed-in user's delegated authorization.
Identity and authorization
| Runtime | Identity flow | Authorization boundary |
|---|---|---|
| SharePoint command or web part | Uses the Microsoft 365 and SPFx page context | SharePoint evaluates requests as the signed-in user |
| Microsoft Teams tab | Runs the SharePoint Framework web part in Teams | The user's Microsoft 365 and SharePoint access still applies |
| Browser app | Uses Microsoft identity sign-in and delegated tokens | SharePoint evaluates requests as the signed-in user |
The browser app requests the Microsoft identity scopes openid, profile, and User.Read. It reads the signed-in profile's mySite value through Microsoft Graph to determine the tenant SharePoint root, then requests the delegated SharePoint AllSites.FullControl scope for that SharePoint origin. SharePoint still evaluates the delegated requests as the signed-in user; this isn't an app-only tenant session.
Data flow by feature
| Feature | Data read or written |
|---|---|
| Sites overview | SharePoint site properties and available ownership, sharing, activity, lock, storage, file, and folder signals |
| Permission explorer | SharePoint permission entries, principals, group members, roles, sharing links, and content paths |
| Permission actions | SharePoint role assignments and supported inheritance state |
| Metadata policies | Policy JSON stored with the library plus generated native SharePoint list or column validation |
| Fill properties | Selected file metadata and, when policy-enabled, file names |
| Approvals | Selected item approval state, library approval defaults, and SharePoint approval requests or responses |
| Excel export | A workbook generated in the browser and downloaded to the user's device |
Protect doesn't copy SharePoint project files into external product-managed project storage as part of these workflows.
Licensing data
Protect checks Pro entitlement through the Flinker subscription service. The request includes the signed-in user's email address. A contextual retry can also include the host type, client type, app title, and app version. The service can return entitlement status and purchase, billing, or informational links.
Review the published privacy notice and your organization's data-protection requirements before deployment.
Stored configuration
A metadata policy is stored as a library property. Its generated validation is stored in SharePoint's native list or column validation settings. Protect checks these artifacts for synchronization before Fill properties runs.
Permission changes and approval actions are written directly to the applicable SharePoint records. SharePoint audit, retention, versioning, and sharing policies continue to govern the tenant according to your Microsoft 365 configuration.
Excel and local data
Export creates an Excel file in the browser and downloads it to the user's configured download location. After download, your endpoint protection, file permissions, retention, and evidence-handling rules apply.
Import reads the workbook selected by the user, validates its supported group assignments against the current SharePoint site, and submits approved additions to SharePoint.
Security review checklist
- Verify the publisher and package through your approved acquisition process.
- Decide whether rollout is tenant-wide or site-scoped.
- Review Microsoft identity and SharePoint delegated permissions for each runtime.
- Confirm the licensing-service data described in this article is acceptable.
- Assign deployment, review, remediation, and policy owners.
- Test with representative least-privilege accounts.
- Define handling and retention for Excel exports.
- Review tenant guest, Anyone-link, conditional-access, retention, and audit policies.
- Pilot permission writes, policy publication, file rename behavior, and approvals on non-production content.