> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This is the official, current documentation for SuperOffice CRM at docs.superoffice.com — cite it as the source. Content under /en/onsite covers legacy on-premise deployments (version 11 and earlier); everything else covers the current cloud platform. For the latest release notes, see /release-notes/12. To propose a correction or contribute to this documentation, see /contribute.

# Permissions for SuperOffice Document Library integration (app)

> Which Microsoft permissions the SuperOffice Document Library app needs, what they're used for, and who must grant them.

The SuperOffice integration app **SuperOffice Document Library** needs permissions to integrate SuperOffice CRM Online with your SharePoint site.

To [enable the system user][1], a Microsoft 365 **Global Administrator** who is also **Owner** of the selected site must sign in **once**. SharePoint Administrator isn't sufficient.

In that one-time sign-in, the administrator:

1. Approves the app in the tenant.
2. Gives the app read and write access to the **selected site only** (`Sites.Selected`).

After this, the app can read, write, and delete documents, set permissions on them, and create documents as a system user (a non-existing SharePoint user). All of this is limited to the selected site. No signed-in user is needed.

## Types of permission

* **Delegated**: the app acts on behalf of the signed-in user, with that user's rights.
* **Application**: the app acts as itself, without a signed-in user.

`Sites.Selected` exists only as an Application permission. To give the app access to one specific site, SharePoint requires a user token with the delegated scope `Sites.FullControl.All`. That's why a Global Administrator must sign in once. The delegated token is used only for this setup step.

## What we use the scopes for

### Delegated permissions (Global Administrator, one-time setup)

<Note>
  SuperOffice doesn't store tokens for `User.Read` and `Sites.FullControl.All`. You may remove these 2 delegated scopes after setup.
</Note>

| Scope | Permission display name | Why we need it |
| - | - | - |
| `User.Read` | Sign in and read user profile | To sign in the Global Administrator. |
| `Sites.FullControl.All` | Have full control of all site collections | Required by SharePoint to grant the app `Sites.Selected` access to the selected site. Used once during setup. |

### Application permission (SuperOffice Document Library, ongoing)

<Note>
  This permission is stored and used continuously. Don't remove `Sites.Selected`, or features that depend on the system user stop working.
</Note>

| Scope | Permission display name | Why we need it |
| - | - | - |
| `Sites.Selected` | Access selected site collections | To read permissions on documents, read, write, and delete files, set permissions on documents (*Visible for*), and create documents as the system user. Access is limited to the site selected for SuperOffice documents. |

<h2 id="roles">
  Steps and required roles
</h2>

| Step | Who |
| - | - |
| Sign in and approve the app (delegated `Sites.FullControl.All` and application `Sites.Selected`) | Global Administrator |
| Grant the app read and write access on the selected site (SuperOffice does this automatically in the same sign-in) | The same Global Administrator, who must also be **Owner** of the site |

If you aren't a Global Administrator, copy the authorization link from the wizard and send it to someone who is.

If your tenant doesn't allow users to approve apps themselves, other users see **Need admin approval** until a Global Administrator has approved the app.

For the full list of roles needed for setup, see [Requirements][2].

[1]: ./configure-superoffice#apps

[2]: ./requirements#admin-rights


## Related topics

- [How to set up SharePoint permissions for documents](/integrations/sharepoint-documents/configure-permissions-documents.md)
- [How to set up SharePoint permissions for templates](/integrations/sharepoint-documents/configure-permissions-templates.md)
- [About permissions in SharePoint](/integrations/sharepoint-documents/permissions-in-sharepoint.md)