Admin Deployment Guide 21Vianet

简体中文 | English

Admin Deployment Guide (21Vianet Cloud)

For enterprise IT administrators: everything required to roll out ShareOneList in a Microsoft 365 operated by 21Vianet tenant. Individual users need zero configuration; an enterprise tenant usually requires just one admin consent from an administrator, with a few extra steps depending on your security policies.

This guide covers 21Vianet tenants. For the Global cloud, see Admin-Deployment-Guide-Global. Applies to ShareOneList v2.x.

How the app connects to Microsoft 365

ShareOneList is a standard public client that calls Microsoft Graph as the signed-in user:

• Sign-in: OAuth 2.0 + PKCE in the system browser; the app never sees or stores passwords. The 21Vianet edition supports work/school (organizational) accounts only, authenticating against login.partner.microsoftonline.cn/organizations
• Application identity (Client ID): bef23379-d430-497d-aaaa-caebd57118f3 (multi-tenant app registration inside the 21Vianet cloud)
• Credential storage: refresh tokens are stored only in Windows Credential Manager / macOS Keychain on the local machine; no server in the middle
• Permission type: all permissions are delegated — the app can only reach what the signed-in user can reach; scopes use the full 21Vianet Graph URI (e.g. https://microsoftgraph.chinacloudapi.cn/Files.ReadWrite.All). No application permissions, no background access

Delegated permissions requested and what they are used for (Graph resource is microsoftgraph.chinacloudapi.cn):

Permission	Purpose
User.Read	Sign-in and basic profile (display name, email)
Files.ReadWrite.All	Read/write OneDrive / SharePoint files the user can access
Sites.Read.All	Discover SharePoint sites the user can access
Group.Read.All	Discover sites via the user's Microsoft 365 group memberships
offline_access	Silently refresh tokens, avoiding frequent re-sign-in

1. Admin consent (usually required)

Files.ReadWrite.All and Group.Read.All are not "low-impact" permissions, so a tenant administrator must grant tenant-wide consent once. After that, no user is prompted with a consent dialog.

Open the URL below with a Global Administrator (or Application Administrator) account, replacing {tenant-id} with your tenant ID:

https://login.partner.microsoftonline.cn/{tenant-id}/adminconsent?client_id=bef23379-d430-497d-aaaa-caebd57118f3

• Review the permission list, then accept with Consent on behalf of your organization
• Afterwards, ShareOneList appears under Entra admin center → Identity → Applications → Enterprise applications; the grant is auditable and can be revoked at any time
• Users then sign in straight to the account picker, with no consent prompt

2. Tenants that restrict user consent

If user consent is set to Do not allow, the first user sign-in stops at the "Need admin approval" page (AADSTS90094) and cannot trigger consent at all. In that case:

• Check: Entra admin center → Identity → Applications → Enterprise applications → Consent and permissions → User consent settings
• Recommended: keep user consent disabled and have the administrator complete the tenant-wide consent in step 1 — this is the standard pattern for controlled enterprises
• If the policy is "Allow user consent for apps from verified publishers, for selected permissions", verify the publisher status of the app registration; if unverified, fall back to admin consent in step 1

Keywords users may report: AADSTS90094, AADSTS65001, "Need admin approval". Step 1 resolves all of them.

3. Network endpoint whitelist

The following endpoints must be reachable through corporate firewalls / outbound proxies:

Purpose	Endpoints
Authentication	login.partner.microsoftonline.cn
Graph API	microsoftgraph.chinacloudapi.cn
File transfer (download / upload)	*.sharepoint.cn
Update check and installer download	api.github.com, github.com, objects.githubusercontent.com; China mirror accelerators ghfast.top, gh-proxy.com, github.moeyy.xyz

Notes:

• The OAuth redirect target is a random port on local 127.0.0.1; no inbound firewall rule is needed. Sign-in is only affected if an outbound proxy forcibly inspects localhost traffic (rare)
• The mirror accelerators only speed up installer downloads and can be blocked freely; sign-in and file features are unaffected
• The update check only detects and downloads new versions; blocking it does not affect browsing or file transfer
• MFA and Conditional Access are fully honored: tokens are acquired through the system browser, and sign-in frequency / device compliance policies are evaluated at token acquisition; when a policy requires re-authentication, the app prompts for sign-in again

---

Questions or issues: Issues. For the Global cloud, see Admin-Deployment-Guide-Global.