Administrator approval and consent for Qlik SaaS Office 365 Sharepoint Connector

[i_vladimirova]

Hello,

How can I get admin authorization for Qlik Office 365 Sharepoint Connector in Qlik SaaS? Who is the admin that will receive the access request notification?

I have attached below the messages received during the connection setup in Qlik SaaS.

The user that I'm using to log in when creating the connection has access to the specific Sharepoint site. What steps do I need to follow to get the authorization? I have read this article (https://support.qlik.com/articles/000101483), but I think it's related to Qlik Web Connectors for QlikSense Enterprise on-prem, not SaaS.

Thanks for your help!

I.V.

[Francisco_Fernandez · Accepted solution]

Hello,

The SaaS and on-premise version work the same way, that request will be sent either to the Application Administrator or Global Administrator on azure.

You would have to use one of those roles to register the application if this is the first time using the connector.

https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/

These are the current permissions requested when authenticating with the admin account on the connector :

https://community.qlik.com/t5/Knowledge-Base/Sharepoint-365-connector-current-permissions-requested/...

Best regards,

[IVL]

Thank you for your reply, Francisco!

[DavidFosterVF]

Does this mean that the connector 'app', by default, overrides user security and is given access to all content in the sharepoint tenancy? My assumption/hope is that the approval message is a bit misleading and does not mention that specific site collection access is dependent on the authenticated user.

[Francisco_Fernandez · Accepted solution]

Hi @DavidFosterVF ,

what the connector is doing is impersonating the user and keeping the same access level as the user that impersonates.

So it's not possible to access data that the user was not supposed to see.

Best regards,

[veronica1]

Hi @Francisco_Fernandez , @Albert_Candelario I've landed here following this post

https://community.qlik.com/t5/Security-Governance/Office-365-SharePoint-connector-permissions/td-p/1...

I'm interested in resolving the issue of the permission "in all site collections" as our IT is concerned about that.

From your answers it seems that the connector only impersonates the user and keeps the same level of access, but if it is so, why the different phrasing in the message?

Also, our users tested it and they reported they saw lists they were not supposed to see.

Last question. Our IT configured the grants as such (for now lists are disabled) but Qlik support told us that they should have given User consent instead of Admin consent, is that right?

Thanks so much in advance

Veronica

[veronica1]

also, it seems that these are the current api requested, which are delegated:

• Files.Read.All - Read all files that user can access.
• Files.ReadWrite - Have full access to user files.
• Sites.Read.All - Read items in all site collections.
• Sites.Manage.All - Create, edit, and delete items and lists in all site collections.
• Sites.ReadWrite.All - Edit or delete items in all site collections.
• offline_access - Maintain access to data you have given it access to
• User.Read - Sign in and read user profile.
• GroupMember.Read.All - Read group memberships.