# Permissions required for SharePoint

## Permissions Required in SharePoint for Unifize Integration

Unifize’s integration with SharePoint and Microsoft 365 enables users to seamlessly access, manage, and collaborate on documents within a unified workspace. To ensure secure and functional operation, both **SharePoint permissions** and **Microsoft 365 permissions** are required. Here's a complete breakdown of the access levels necessary.

***

### 1. Permissions Needed to **Integrate SharePoint with Unifize**

To enable integration at the organizational or tenant level, **admin-level access** is required. This is necessary for Unifize to authenticate, connect, and interact with SharePoint resources.

#### Required Permissions (Admin Consent Scope):

* **Microsoft Graph API permissions:**
  * `Sites.ReadWrite.All` → Allows Unifize to read and write to all site collections on behalf of the signed-in user.
  * `Files.ReadWrite.All` → Enables full access to all files the user has access to.
  * `User.Read` → Grants read access to the user's profile.
  * `offline_access` → Allows Unifize to maintain access using refresh tokens even when the user is offline.

> These permissions need to be granted by a Microsoft 365 Global Administrator during the initial connection setup.

***

### 2. SharePoint Permissions Required for **Using the Integration**

Once integration is set up, **each Unifize user** interacting with SharePoint must have appropriate permissions within the SharePoint site or document library. These are needed for accessing, editing, uploading, or collaborating on documents.

#### Common SharePoint Permission Levels:

| Permission Level | Required For                                   | Scope             |
| ---------------- | ---------------------------------------------- | ----------------- |
| **Read**         | Viewing linked documents                       | Library or Folder |
| **Contribute**   | Uploading new documents, editing existing ones | Library           |
| **Edit**         | Managing document metadata, versioning         | Library           |
| **Full Control** | Site admin operations, managing permissions    | Site (Admin only) |

> Users will see permission errors inside Unifize if their SharePoint roles do not match the operation they’re trying to perform (e.g., upload, rename, lock/unlock files).

***

### 3. Microsoft 365 Permissions for Supporting Features

To enhance collaboration using tools like Word, Excel, and Teams inside Unifize, users need the following permissions at the Microsoft 365 level:

#### Required Permissions (User-level):

* **Microsoft 365 License**:
  * Ensure users are licensed for **SharePoint Online** and **Office Online (Word, Excel, etc.)**
* **Teams Integration (optional)**:
  * `Chat.ReadWrite` and `Teams.ReadBasic.All` if Teams chat or group-based workflows are used within Unifize

***

### 4. Ongoing Access & Token Management

Unifize uses **OAuth2 and Microsoft Identity Platform** for secure access:

* Tokens are scoped to the signed-in user
* Permissions are enforced based on what the user has in Microsoft 365 and SharePoint
* Admin consent is required only once unless permissions change

***

### Summary Checklist

| Action                              | Role Required                  | Permissions                                                    |
| ----------------------------------- | ------------------------------ | -------------------------------------------------------------- |
| Initial Integration Setup           | Microsoft 365 Global Admin     | `Sites.ReadWrite.All`, `Files.ReadWrite.All`, `offline_access` |
| Daily Use of SharePoint via Unifize | End User                       | SharePoint site-specific (`Read`, `Contribute`, `Edit`)        |
| Office 365 Document Editing         | End User                       | Valid license for Office Online                                |
| Admin Management of Files           | SharePoint Admin or Site Owner | Full Control                                                   |

***

### Pro Tips

* Use SharePoint permission inheritance carefully to avoid unwanted access escalation.
* If users report access errors in Unifize: check both SharePoint library permissions and their Microsoft 365 license.
* Maintain a least-privilege approach: grant only what is necessary per role.