Admin Deployment Guide Global

简体中文 | English

Admin Deployment Guide (Global Cloud)

For enterprise IT administrators: everything required to roll out ShareOneList in a Microsoft 365 Global tenant. Individual users need zero configuration; an enterprise tenant usually requires just one admin consent from an administrator, with a few extra steps depending on your security policies.

This guide covers Global tenants. For Microsoft 365 operated by 21Vianet, see Admin-Deployment-Guide-21Vianet. Applies to ShareOneList v2.x.

How the app connects to Microsoft 365

ShareOneList is a standard public client that calls Microsoft Graph as the signed-in user:

• Sign-in: OAuth 2.0 + PKCE in the system browser; the app never sees or stores passwords
• Application identity (Client ID): 9e5165d3-7c32-4cf6-bb54-b444bc429ba8 (multi-tenant app registration)
• Credential storage: refresh tokens are stored only in Windows Credential Manager / macOS Keychain on the local machine; no server in the middle
• Permission type: all permissions are delegated — the app can only reach what the signed-in user can reach; no application permissions, no background access

Delegated permissions requested and what they are used for:

Permission	Purpose
User.Read	Sign-in and basic profile (display name, email)
Files.ReadWrite.All	Read/write OneDrive / SharePoint files the user can access
Sites.Read.All	Discover SharePoint sites the user can access
Group.Read.All	Discover sites via the user's Microsoft 365 group memberships
offline_access	Silently refresh tokens, avoiding frequent re-sign-in

1. Admin consent (usually required)

Files.ReadWrite.All and Group.Read.All are not "low-impact" permissions, so a tenant administrator must grant tenant-wide consent once. After that, no user is prompted with a consent dialog.

Open the URL below with a Global Administrator (or Application Administrator) account, replacing {tenant-id} with your tenant ID:

https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id=9e5165d3-7c32-4cf6-bb54-b444bc429ba8

• Review the permission list, then accept with Consent on behalf of your organization
• Afterwards, ShareOneList appears under Entra admin center → Identity → Applications → Enterprise applications; the grant is auditable and can be revoked at any time
• Users then sign in straight to the account picker, with no consent prompt

2. Tenants that restrict user consent

If user consent is set to Do not allow, the first user sign-in stops at the "Need admin approval" page (AADSTS90094) and cannot trigger consent at all. In that case:

• Check: Entra admin center → Identity → Applications → Enterprise applications → Consent and permissions → User consent settings
• Recommended: keep user consent disabled and have the administrator complete the tenant-wide consent in step 1 — this is the standard pattern for controlled enterprises
• If the policy is "Allow user consent for apps from verified publishers, for selected permissions", verify the publisher status of the app registration; if unverified, fall back to admin consent in step 1

Keywords users may report: AADSTS90094, AADSTS65001, "Need admin approval". Step 1 resolves all of them.

3. Network endpoint whitelist

The following endpoints must be reachable through corporate firewalls / outbound proxies:

Purpose	Endpoints
Authentication	login.microsoftonline.com
Graph API	graph.microsoft.com
File transfer (download / upload)	*.sharepoint.com
Update check and installer download	api.github.com, github.com, objects.githubusercontent.com

Notes:

• The OAuth redirect target is a random port on local 127.0.0.1; no inbound firewall rule is needed. Sign-in is only affected if an outbound proxy forcibly inspects localhost traffic (rare)
• Environments that allow personal Microsoft accounts additionally need login.live.com reachable from the browser (work/school-only environments do not)
• The update check only detects and downloads new versions; blocking it does not affect browsing or file transfer
• MFA and Conditional Access are fully honored: tokens are acquired through the system browser, and sign-in frequency / device compliance policies are evaluated at token acquisition; when a policy requires re-authentication, the app prompts for sign-in again

---

Questions or issues: Issues. For Microsoft 365 operated by 21Vianet, see Admin-Deployment-Guide-21Vianet.