Security & Data Privacy Overview

1. Architecture: In-Tenant & Browser-Based

SP Toolkit is an SPFx (SharePoint Framework) web part — not an external SaaS agent, not a desktop installer, and not a service principal with tenant-wide access.

The migration engine runs entirely inside your browser, within your Microsoft 365 boundary. When you migrate a list, the data flows directly from SharePoint → browser → SharePoint. There is no intermediary server, no staging area, and no external data store.

SP Toolkit is deployed from the SharePoint App Catalog — the same mechanism Microsoft uses for all first-party and third-party SPFx solutions. Your SharePoint admin retains full control over deployment scope and can limit it to specific site collections.

2. Data Residency & Sovereignty

Zero Data Transit

No file content, list item data, metadata, attachments, or user information ever leaves your Microsoft 365 tenant during migration.

• Source reads go directly to SharePoint/Graph endpoints within your Microsoft 365 boundary
• Target writes go directly to SharePoint REST endpoints within your Microsoft 365 boundary
• Cross-tenant migrations flow from source tenant → browser → target tenant. The browser is the only intermediary, running on the user's own device

Australian Compliance

• No data is routed through third-party servers or offshore infrastructure
• Data residency is determined entirely by your existing Microsoft 365 tenant configuration
• SP Toolkit introduces zero additional data sovereignty risk
• Compliant with the Australian Privacy Act 1988 (APP 8 — cross-border disclosure) because no personal information or SharePoint content crosses borders. Licence validation calls to Azure transmit only a tenant ID and aggregate numeric counts.

3. Permission Model: Delegated (User Impersonation)

SP Toolkit uses the Delegated Permissions model exclusively. It never uses Application Permissions.

The tool acts on behalf of the signed-in user. It cannot access any site, list, document, or item that the user themselves does not already have permission to access.

No API Permission Approval Required

SP Toolkit requires zero API permission approvals in SharePoint Admin Centre. The licence validation service is called over standard HTTPS — no Azure AD consent step is needed.

For cross-tenant migrations, Graph permissions (e.g., Sites.Read.All) are obtained at runtime via interactive MSAL login — the user explicitly authenticates in a popup and consents to the scopes.

4. Auditing & Logging

Because every action is performed under the signed-in user's identity, all operations are recorded in the Microsoft 365 Unified Audit Log under that user's name:

• File uploads → logged as the user
• List item creation → logged as the user
• Folder creation → logged as the user
• Permission changes → not performed (SP Toolkit does not modify permissions)

There are no service accounts, no background processes, and no daemon applications. When the browser tab closes, the tool stops.

5. Licence Validation — Full Transparency

SP Toolkit validates your subscription status by calling an Azure-hosted API. This is a standard SaaS licence heartbeat — it confirms your tenant has an active licence and tracks aggregate usage against plan limits.

What is sent

What is NOT sent — ever

• ❌ List names, item content, or metadata
• ❌ Document content or file names
• ❌ User names, email addresses, or directory data (except admin email during signup)
• ❌ Site URLs or tenant domain names
• ❌ Passwords, tokens, or credentials
• ❌ Field values, column definitions, or schema details

Response Integrity

Licence responses include a digitally signed ticket verified client-side using an RSA public key embedded in the SPFx manifest. This prevents tampering with licence status in transit.

6. Cross-Tenant Migration — Additional Security Context

For migrations between two separate Microsoft 365 tenants:

1. Source tenant app registration — The customer creates an Azure AD app registration in the source tenant with specific Graph API delegated permissions
2. Interactive user login — The user authenticates via an MSAL popup. SP Toolkit never sees or stores the password
3. Delegated access only — The app uses delegated permissions requiring the signed-in user to have corresponding access
4. Session-scoped tokens — Access tokens are stored in sessionStorage (cleared when the tab closes) with automatic refresh

Graph API Scopes (Cross-Tenant Source Reads)

These scopes are requested at runtime via interactive consent — they are not pre-granted at deployment time.

7. Network Footprint

Every external network destination the SP Toolkit web part contacts:

The first three are standard Microsoft 365 endpoints. The fourth is our licence check. Optional user-configured endpoints (AI providers, webhooks) are not active by default.

8. What SP Toolkit Does NOT Do

• ❌ Install agents, services, or background processes
• ❌ Require Global Admin or tenant-wide Application Permissions
• ❌ Store SharePoint content outside your Microsoft 365 tenant
• ❌ Create or modify SharePoint permissions or sharing settings
• ❌ Access Exchange, Teams chat, OneDrive personal, or any non-SharePoint workload
• ❌ Run when the browser tab is closed
• ❌ Require opening firewall ports or VPN tunnels
• ❌ Store credentials — authentication is handled entirely by Microsoft's identity platform

9. Deployment & Scoping

10. Summary