Permissions for SuperOffice Document Library integration (app)

The SuperOffice integration application SuperOffice Document Library requires several permissions to be able to integrate SuperOffice CRM Online with SharePoint site. To add the SuperOffice Document Library app in SharePoint, a Global Administrator user must sign in once to give the app permission to access the selected site. This is done by using a one-time user-token with scope Site.FullControl.All. Once the app is approved with the given scopes for delegated permission, it can read and write files, delete and set permissions on documents, and create documents on behalf of a non-existing SharePoint user (system user).

​

Types of permission

There are two different types of permission:

• (User) Delegated means that the application may act on behalf of a user as the user themselves for this particular permission.
• Application means that the application itself may act for this particular permission.

The reason for choosing a scope with delegated permission is the limitations in the API and can’t use application permission here because documents will be created and updated as the application, not as the signed in user. Sites.Selected is available only as Application permission, and can’t be applied to Delegated permissions.

​

What we use the scopes for

​

User delegated permission (representing Global Administrator)

The delegated permissions are used once for adding the app.

​

Application permission (representing SuperOffice Document Library)

The application permission is used every time to read permissions and to read, write, create, and delete files in the selected site where the SuperOffice Document library is.

​

Steps to enable Application permission with Sites.Selected