# Epic SSI-117 - Allow SharePoint integration setup with more restrictive permissions
Project: Stream Storage Integrations
Status: closed
URL: https://community.openproject.org/work_packages/SSI-117
## Detailed specification
### Motivation and background information
### Acceptance criteria
### Out of scope
* Extending file picker with folder tree view including folder search.
* Marketing landing page
* Bahn migration
| Attribute | Value |
| --- | --- |
| Mockups | |
## Planning
| Attribute | Value |
| --- | --- |
| Roadmap | 2025 Q4 |
| Date | 2025-08-18 – 2025-08-28 |
| Votes | |
| List | RM Document collaboration |
| Target versions | 17.0.0 |
| Relevance | |
## Subitems
| ID | Type | Subject | Status | Assignee | Target versions | Project | Priority | Spent time |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| SSI-301 | Feature | SharePoint Storage Creation | closed | | 17.0.0 | Stream Storage Integrations | Medium | |
| SSI-302 | Feature | SharePoint Storage Basic Functionality | closed | | 17.0.0 | Stream Storage Integrations | Medium | |
| SSI-303 | Feature | SharePoint Storage AMPF support | closed | | 17.0.0 | Stream Storage Integrations | Medium | |
| SSI-392 | Implementation | Update FilePicker to use Octicons | closed | | 17.0.0 | Stream Storage Integrations | Medium | |
| SSI-454 | Implementation | Force enable SharePoint feature flag | closed | | 17.0.0 | Stream Storage Integrations | Medium | |
| SSI-272 | Open Point | Can/Should we use all drives of a site or stick with the default one? | decided | | | Stream Storage Integrations | Medium | |
| SSI-320 | Open Point | Would this be a Corporate or Enterprise Feature? | decided | Dominic Bräunlein | | Stream Storage Integrations | Medium | |
| SSI-354 | Open Point | Should we hide this under a Feature Flag until complete? | decided | Dominic Bräunlein | | Stream Storage Integrations | Medium | |
| SSI-357 | Open Point | Spelling of SharePoint inside code | decided | | | Stream Storage Integrations | Medium | |
## Bugs and other work packages
| ID | Type | Subject | Status | Assignee | Target versions | Module |
| --- | --- | --- | --- | --- | --- | --- |
| SSI-404 | Bug | Configured sharepoint file storage is considered incomplete | closed | | 16.4.0 | |
| SSI-401 | Bug | Creation of SharePoint file storage fails on stage after enabling feature flag | closed | | 16.4.0 | |
| SSI-400 | Bug | Error message from stimulus when creating SharePoint file storages | closed | | 16.4.0 | |
| SSI-394 | Task | Create an Azure Application for the Edge Environment | closed | | 16.4.0 | |
| SSI-380 | Code maintenance | Change composite id separator to colon | closed | | 16.4.0 | |
| SSI-378 | Bug | Trailing Slash on Storage Host leads to 500 | closed | | 16.4.0 | |
| SSI-376 | Bug | Sharepoint Health Host check is missing translation key | closed | Marcello Rocha Pereira | 16.4.0 | |
| SSI-374 | Bug | Sharepoint Storage Edit mentions Nextcloud Oauth | closed | Marcello Rocha Pereira | 16.4.0 | |
| SSI-395 | Task | Create an Azure Application for the Staging Environment | new | | 16.4.0 | |
| SSI-382 | Code maintenance | Harmonize input data of download link query and open file link query | closed | Yauheni Suhakou | 17.0.0 | |
| SSI-350 | Documentation | Add SharePoint documentation | closed | Marcello Rocha Pereira | 17.0.0 | |
| SSI-381 | Code maintenance | Rename share_point and one_drive to single words | needs review | | 18.0.0 | |
| SSI-448 | Task | Create Enterprise banner for SharePoint Integration | rejected | Marc Alcobé | | |
| SSI-299 | Open Point | Should we instruct users to create a new site just for OpenProject | rejected | | | |
| SSI-357 | Open Point | Spelling of SharePoint inside code | decided | | | |
| SSI-354 | Open Point | Should we hide this under a Feature Flag until complete? | decided | Dominic Bräunlein | | |
| SSI-320 | Open Point | Would this be a Corporate or Enterprise Feature? | decided | Dominic Bräunlein | | |
| SSI-272 | Open Point | Can/Should we use all drives of a site or stick with the default one? | decided | | | |
| SSI-437 | Code maintenance | Move Nexcloud and OneDrive AMPF upkeep services to Providers | new | | | |
| SSI-391 | Code maintenance | Get token actual read/write permissions for children and the current folder | new | | | |
| SSI-375 | Code maintenance | Health check for host needs to be re-thought over. | new | | | Modules and project features / File storages |
## Details
| Attribute | Value |
| --- | --- |
| Module | Integrations / SharePoint/OneDrive |
| Enterprise plan | Enterprise / Professional (PRO) |
| Labels | |
## People
| Attribute | Value |
| --- | --- |
| Assignee | Ihor Khomenko |
| Accountable | Dominic Bräunlein |
| Product manager | |
| Designer | Parimal Satyal |
| Developers | |
| Requested by | |
| Interest by | |
## Estimates and progress
| Attribute | Value |
| --- | --- |
| Work | |
## Description
**As** an administrator responsible for file storage
**I want to** enable a SharePoint storage using the `Sites.Selected` (Application) permission in SharePoint
**So that** no unnecessary wide permissions are set on the Microsoft Entra ID app when it could be avoided.
### Why?
To allow a third-party app to access files in OneDrive/SharePoint, admins need to set the correct permissions for an Entra app that is used by our integration to authenticate against SharePoint.
When the integration was first implemented, the Files.ReadWrite.All (Application) permission was required for it to work. This permission is quite broad, which concerns some IT security teams. While the Entra ID app with this permission cannot be exploited on its own, if other secrets are leaked, it could exacerbate the issue.
Microsoft has since introduced `Sites.Selected`l permission that we can use to grant our integration enough access to operate while avoiding the unwanted Files.ReadWrite.All (Application).
### What's the `Sites.Selected` permission?
The `Sites.Selected` permission, on the other hand, applies to the entire SharePoint Site, not just a specific folder. This would allow us to keep the existing integration concept and use any document library in the SharePoint integration. The level of access that we are aiming is `manage`, while it would be possible to operate over `write` it wouldn't allow us to do AMPF over it.
The downside is that the API endpoints would change, we would need to ask the admin for additional information (Site ID) when setting up the integration, the permission setup would be more complex for SharePoint admins, and we would still need to support the old setup with the broader permissions.
###
### Acceptance Criteria
- The "Add Storage" button allows to add a "SharePoint" or "OneDrive" integration
- There is information about the differences to educate the admin
- \
- If SharePoint is choosen, an additional input field "Sharepoint URL" and "Sharepoint Site" is displayed and required to be filled.
- UI helper texts and links to documentation are added.
- Commands and Queries are added for the new storage type
- The health status needs to be implemented for Sharepoint
- If needed new error codes are added and documented
- The connection validation needs to be implemented for Sharepoint
- If needed new error codes are added and documented
- Documentation is updated for both integrations
- Add information on how to retrieve the Site ID
- Add educational section to highlight when and why to choose a specific storage type.