From b2181beb0768b70858851065470dfd0ecbedcafe Mon Sep 17 00:00:00 2001 From: dilucesr Date: Tue, 21 Jul 2026 15:23:55 -0700 Subject: [PATCH] Apply SharePoint Embedded docs review fixes (review 20260721-145410) Apply 116 fixes across all severities to 50 articles and llms.txt under docs/embedded/ from a full multi-agent docs review (style, accuracy, code) of all 51 embedded files. Verified accuracy/code fixes: - create-container-type.md: trial per-container storage limit 1 GB -> 200 MB (verified against SPO.Core SPTrialContainerType.cs; the 1 GB constant applies only to standard/default container types). - create-container-type.md and container-types-containers.md: clarify the 25 container-type cap applies to standard (non-trial) types, with one trial type counted separately (up to 26 total), and note 25 is the upper limit. - container-types-containers.md: ContainerTypeID -> Graph casing containerTypeId. - llms.txt: correct two machine-index URL slugs to match real page filenames (container-types-containers, setup-billing-microsoft-365-admin-center). Plus style/terminology/grammar/casing/link fixes across the set. ms.date bumped to 07/21/2026 on every edited file. Deferred (not applied): the "creating a container type requires no admin role" product/doc conflict, ms.author/ai-usage frontmatter (needs repo-wide decision), and unverified quota/date/availability claims lacking a concrete corrected value. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d4d88de-108b-4260-8798-529f5b1b0dc3 --- docs/embedded/admin/admin-overview.md | 12 +++--- .../apply-security-compliance-controls.md | 8 ++-- docs/embedded/admin/consuming-tenant-admin.md | 42 ++++++++++--------- docs/embedded/admin/create-apps-powershell.md | 6 +-- .../create-apps-sharepoint-admin-center.md | 12 +++--- .../admin/grant-admin-consent-permissions.md | 8 ++-- .../admin/install-sharepoint-embedded-app.md | 10 ++--- .../admin/manage-containers-powershell.md | 6 +-- ...nage-containers-sharepoint-admin-center.md | 4 +- .../admin/monitor-usage-billing-cost.md | 6 +-- docs/embedded/admin/review-audit-events.md | 4 +- ...etup-billing-microsoft-365-admin-center.md | 12 +++--- docs/embedded/build/agent-experiences.md | 16 +++---- .../build/archive-restore-containers.md | 6 +-- .../configure-authentication-authorization.md | 9 ++-- docs/embedded/build/container-metadata.md | 6 +-- docs/embedded/build/create-container-type.md | 6 +-- .../build/create-manage-containers.md | 4 +- docs/embedded/build/fluid-framework.md | 6 +-- docs/embedded/build/manage-files.md | 8 ++-- .../build/migrate-azure-blob-storage.md | 10 ++--- docs/embedded/build/open-office-files.md | 13 ++++-- docs/embedded/build/preview-files.md | 13 +++--- docs/embedded/build/quickstart-vscode.md | 10 ++--- .../build/register-application-permissions.md | 6 +-- .../build/respond-to-changes-webhooks.md | 4 +- .../embedded/build/search-containers-files.md | 4 +- .../build/share-files-manage-permissions.md | 4 +- .../sharepoint-embedded-knowledge-source.md | 8 ++-- .../build/sharepoint-embedded-mcp-server.md | 10 ++--- docs/embedded/llms.txt | 4 +- docs/embedded/overview.md | 4 +- docs/embedded/plan/app-tenant-architecture.md | 10 ++--- .../plan/authentication-permissions.md | 6 +-- docs/embedded/plan/choose-app-model.md | 32 +++++++------- docs/embedded/plan/choose-billing-model.md | 37 +++++++++------- .../plan/container-types-containers.md | 10 ++--- docs/embedded/plan/limits-calling-patterns.md | 6 +-- .../plan/security-compliance-governance.md | 24 +++++------ .../publish/choose-app-billing-model.md | 4 +- .../publish/customer-tenant-setup-guide.md | 6 +-- .../publish/prepare-customer-installation.md | 4 +- .../publish/validate-customer-installation.md | 4 +- docs/embedded/reference/audit-events.md | 6 +-- docs/embedded/reference/billing-meters.md | 8 ++-- docs/embedded/reference/glossary.md | 4 +- docs/embedded/reference/powershell.md | 4 +- docs/embedded/reference/troubleshooting.md | 6 +-- docs/embedded/scenarios-and-use-cases.md | 8 ++-- .../sharepoint-embedded-documentation.md | 6 +-- docs/embedded/whats-new.md | 10 ++--- 51 files changed, 245 insertions(+), 231 deletions(-) diff --git a/docs/embedded/admin/admin-overview.md b/docs/embedded/admin/admin-overview.md index 8f3de0cba..01c3b61de 100644 --- a/docs/embedded/admin/admin-overview.md +++ b/docs/embedded/admin/admin-overview.md @@ -1,7 +1,7 @@ --- title: Admin overview description: Learn how administrators manage SharePoint Embedded apps, containers, billing, and compliance in Microsoft 365. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -42,9 +42,9 @@ SharePoint Embedded administration commonly involves the following roles. | --- | --- | | Global Administrator | Assign the SharePoint Embedded Administrator role and perform any SharePoint Embedded admin task when needed. | | SharePoint Embedded Administrator | Manage SharePoint Embedded apps and containers through SharePoint admin center and supported SharePoint PowerShell cmdlets. | -| Tenant administrator | Manage apps and settings in the consuming Microsoft 365 tenant. | -| Compliance administrator | Configure Microsoft Purview audit, retention, DLP, eDiscovery, and related policies. | -| Security administrator | Configure security policies and investigate security events that apply to SharePoint Embedded content. | +| Tenant Administrator | Manage apps and settings in the consuming Microsoft 365 tenant. | +| Compliance Administrator | Configure Microsoft Purview audit, retention, Data Loss Prevention (DLP), eDiscovery, and related policies. | +| Security Administrator | Configure security policies and investigate security events that apply to SharePoint Embedded content. | The SharePoint Embedded Administrator role is available in Microsoft Entra and the Microsoft 365 admin center. @@ -54,7 +54,7 @@ It doesn't grant regular SharePoint site management access. For example, a SharePoint Embedded Administrator doesn't see the **Active sites** or **Deleted sites** pages in the SharePoint admin center and can't run site-specific SharePoint PowerShell cmdlets. -Likewise, the SharePoint administrator role doesn't administer SharePoint Embedded apps or containers. +Likewise, the SharePoint Administrator role doesn't administer SharePoint Embedded apps or containers. ### Assign the SharePoint Embedded Administrator role @@ -153,7 +153,7 @@ Some scenarios that need end-user interaction depend on the owning app to provid Review [Review audit events](review-audit-events.md) and [Apply security and compliance controls](apply-security-compliance-controls.md). -## SharePoint admin center versus PowerShell +## SharePoint admin center and PowerShell Use both management surfaces. diff --git a/docs/embedded/admin/apply-security-compliance-controls.md b/docs/embedded/admin/apply-security-compliance-controls.md index ea2415e68..e6a4e28d7 100644 --- a/docs/embedded/admin/apply-security-compliance-controls.md +++ b/docs/embedded/admin/apply-security-compliance-controls.md @@ -1,7 +1,7 @@ --- title: Apply security and compliance controls description: Apply Microsoft Purview and SharePoint controls to protect and govern SharePoint Embedded content. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -63,7 +63,7 @@ Use PowerShell to retrieve application and container details. 1. Retrieve details for a container. ```powershell - Get-SPOContainer -OwningApplicationId -Identity + Get-SPOContainer -Identity ``` Use the container site URL to target policies at specific SharePoint Embedded containers. @@ -72,7 +72,7 @@ For cmdlet details, see [Get-SPOContainer](/powershell/module/sharepoint-online/ ## Apply audit controls -Audit capabilities for SharePoint Embedded mirror existing SharePoint audit capabilities. User and admin operations performed in SharePoint Embedded applications are captured in the unified audit log. +Audit capabilities for SharePoint Embedded mirror existing SharePoint audit capabilities. The unified audit log captures user and admin operations performed in SharePoint Embedded applications. Use Microsoft Purview audit to search activity and investigate file, user, app, and admin operations. @@ -165,7 +165,7 @@ Global Administrators and SharePoint Embedded Administrators can set or remove s Set a label: ```powershell -Set-SPOContainer -Identity -SensitivityLabel +Set-SPOContainer -Identity -SensitivityLabel ``` Remove a label by using the supported container label command documented in [Manage containers with PowerShell](manage-containers-powershell.md). diff --git a/docs/embedded/admin/consuming-tenant-admin.md b/docs/embedded/admin/consuming-tenant-admin.md index 438bf6188..7ed9db344 100644 --- a/docs/embedded/admin/consuming-tenant-admin.md +++ b/docs/embedded/admin/consuming-tenant-admin.md @@ -1,7 +1,7 @@ --- title: Consuming tenant admin description: Understand the consuming tenant admin role and responsibilities for SharePoint Embedded. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.localizationpriority: high ai-usage: ai-assisted @@ -23,9 +23,11 @@ next: install-sharepoint-embedded-app.md > > Global Administrators can continue to execute SharePoint Embedded container cmdlets. > -> A global administrator can assign a user the SharePoint Embedded administrator role to act as a consuming tenant admin for SharePoint Embedded. +> A Global Administrator can assign a user the SharePoint Embedded Administrator role to act as a consuming tenant admin for SharePoint Embedded. -Organizations that use SharePoint Embedded applications in their Microsoft 365 tenants are consuming tenants. The consuming tenant administrator manages these applications and the containers that hold content. Consuming tenant administrators can manage applications registered in their tenant, tenant-level configurations, and security and compliance settings. This article describes enterprise manageability features that consuming tenant administrators can use through PowerShell cmdlets or the SharePoint admin center. +Organizations that use SharePoint Embedded applications in their Microsoft 365 tenants are consuming tenants. The consuming tenant administrator manages these applications and the containers that hold content. + +Consuming tenant administrators can manage applications registered in their tenant, tenant-level configurations, and security and compliance settings. They use PowerShell cmdlets or the SharePoint admin center for enterprise management tasks. ## Consuming tenant admin role @@ -48,33 +50,33 @@ The [fileStorageContainerTypeRegistration](/graph/api/resources/filestorageconta ### SharePoint Online Management Shell -On PowerShell, the SharePoint Embedded Admin can run the following cmdlets: +In PowerShell, the SharePoint Embedded Administrator can run the following cmdlets: -1. Enumerate applications in a tenant -1. Enumerate containers of an application in a tenant -1. Enumerate containers of an application sorted by storage usage -1. Enumerate archived containers of an application -1. Edit the sensitivity label on a container -1. Set the sharing capability configuration on a container +- Enumerate applications in a tenant +- Enumerate containers of an application in a tenant +- Enumerate containers of an application sorted by storage usage +- Enumerate archived containers of an application +- Edit the sensitivity label on a container +- Set the sharing capability configuration on a container For information on consuming tenant admin in PowerShell, see [Manage containers with PowerShell](manage-containers-powershell.md). ### SharePoint admin center -The SharePoint Embedded Admin can access the Active and Deleted containers page in the SharePoint admin center and perform SharePoint Embedded application-level and container-level actions. This includes the following: +The SharePoint Embedded Administrator can access the Active and Deleted containers page in the SharePoint admin center and perform SharePoint Embedded application-level and container-level actions. This includes the following: -1. View the Active container page -1. View the Archived container page -1. View the Deleted container page -1. View the detailed information of a container -1. Archive and reactivate containers -1. Soft delete, restore, and purge deleted containers +- View the Active container page +- View the Archived container page +- View the Deleted container page +- View the detailed information of a container +- Archive and reactivate containers +- Soft delete, restore, and purge deleted containers For information on consuming tenant admin in SharePoint admin center, see [Manage containers in SharePoint admin center](manage-containers-sharepoint-admin-center.md). ## Security and compliance administration -SharePoint Embedded uses Microsoft's comprehensive compliance and data governance solutions to help organizations manage risk, protect and govern sensitive data, and respond to regulatory requirements. Security and compliance solutions work in SharePoint Embedded in a similar way to Microsoft 365. These solutions help store data securely while making it easier for Compliance Administrators and SharePoint Embedded Administrators to enforce critical security and compliance policies on the content. For information on supported security and compliance capabilities, see [Plan security, compliance, and governance](../plan/security-compliance-governance.md). +SharePoint Embedded uses Microsoft 365 compliance and data governance solutions to help organizations manage risk, protect and govern sensitive data, and respond to regulatory requirements. Security and compliance solutions work in SharePoint Embedded in a similar way to Microsoft 365. These solutions help Compliance Administrators and SharePoint Embedded Administrators enforce security and compliance policies on content. For information on supported security and compliance capabilities, see [Plan security, compliance, and governance](../plan/security-compliance-governance.md). ## Set up billing for pass-through container type @@ -84,9 +86,9 @@ To use a pass-through billing SharePoint Embedded app, a Global Administrator ne For detailed meter information, see [Billing meters](../reference/billing-meters.md). -SharePoint Embedded employs a pay-as-you-go (PAYG) billing model through an Azure subscription. Billing is determined by how much data in GB you store in SharePoint Embedded in active and archived states, transactions used to access and modify the container and container contents, and data that's egressed from the SharePoint Embedded platform. Each of these factors contributes to the overall cost, ensuring that you only pay for the resources and services you use. You can view this usage and billing details in the [Microsoft Cost Management](https://portal.azure.com/). +SharePoint Embedded uses a pay-as-you-go (PAYG) billing model through an Azure subscription. Billing is determined by how much data in GB you store in SharePoint Embedded in active and archived states, transactions used to access and modify the container and container contents, and data that's egressed from the SharePoint Embedded platform. You can view usage and billing details in [Microsoft Cost Management](https://portal.azure.com/). -SharePoint Embedded has four GA billing meters, as shown. For the private preview agent message meter, see [Billing meters](../reference/billing-meters.md). Refer to the [product page](https://adoption.microsoft.com/sharepoint/embedded/) for pricing details. +SharePoint Embedded has four generally available billing meters, as shown. For the private preview agent message meter, see [Billing meters](../reference/billing-meters.md). Refer to the [product page](https://adoption.microsoft.com/sharepoint/embedded/) for pricing details. | SharePoint Embedded Service Meters | Meter Unit | | ---------------------------------- | -------------- | diff --git a/docs/embedded/admin/create-apps-powershell.md b/docs/embedded/admin/create-apps-powershell.md index 64d7b2746..2e75ad144 100644 --- a/docs/embedded/admin/create-apps-powershell.md +++ b/docs/embedded/admin/create-apps-powershell.md @@ -1,7 +1,7 @@ --- title: Create apps with PowerShell description: Create and configure SharePoint Embedded apps with SharePoint PowerShell. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -33,7 +33,7 @@ Make sure you have: > [!IMPORTANT] > Choose the billing method when you create the container type. You can't change the billing method after creation. -## Create a standard billed app +## Create an app that uses standard billing Use standard billing when the organization that owns the app pays for SharePoint Embedded usage. @@ -47,7 +47,7 @@ Set up billing for the standard container type by assigning an Azure subscriptio Add-SPOContainerTypeBilling -ContainerTypeId -AzureSubscriptionId -ResourceGroup -Region ``` -## Create a pass-through billed app +## Create an app that uses pass-through (customer) billing Use pass-through billing when the consuming tenant pays for SharePoint Embedded usage. diff --git a/docs/embedded/admin/create-apps-sharepoint-admin-center.md b/docs/embedded/admin/create-apps-sharepoint-admin-center.md index 3ea7daeb8..369d9aec1 100644 --- a/docs/embedded/admin/create-apps-sharepoint-admin-center.md +++ b/docs/embedded/admin/create-apps-sharepoint-admin-center.md @@ -1,7 +1,7 @@ --- title: Create apps in SharePoint admin center description: Create a SharePoint Embedded app from the SharePoint admin center and validate the new app registration. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -82,7 +82,7 @@ Use it to verify app creation and to start installation when an app is ready. *Figure 3: The Create app panel registers a Microsoft Entra app, assigns owners, and sets the billing type in a single flow.* -## Choose the Entra app registration option +## Choose the Microsoft Entra app registration option In **Entra app registration**, choose one option. @@ -91,7 +91,7 @@ In **Entra app registration**, choose one option. | New app | You want the admin center flow to create a new Microsoft Entra application registration. | | Use an existing Entra app | You already have a Microsoft Entra app and want to associate it with the SharePoint Embedded app. | -If you choose **New app**, enter the new Entra app name. +If you choose **New app**, enter the new Microsoft Entra app name. If you choose **Use an existing Entra app**, search by application ID or application name. @@ -164,7 +164,7 @@ For Graph Explorer documentation, see [Use Graph Explorer to try Microsoft Graph ## Submit the app -1. Review the Entra app registration selection. +1. Review the Microsoft Entra app registration selection. 1. Review the app owners. 1. Review billing type. 1. Review advanced settings. @@ -172,7 +172,7 @@ For Graph Explorer documentation, see [Use Graph Explorer to try Microsoft Graph When you select **Create app**, the admin center completes these steps together: -- Registers the Microsoft Entra app, or associates the existing Entra app you selected. +- Registers the Microsoft Entra app, or associates the existing Microsoft Entra app you selected. - Creates the SharePoint Embedded app and its associated container type. - Installs the app in your tenant. - Attaches billing when you select **Owner org** and **Setup now**. @@ -221,7 +221,7 @@ Continue with these tasks. Use these checks if creation fails or the app isn't usable. - Confirm your account has the SharePoint Embedded Administrator role. -- Confirm the selected existing Entra app exists and is available in the tenant. +- Confirm the selected existing Microsoft Entra app exists and is available in the tenant. - Confirm owners resolve in the people picker. - Confirm required billing fields are complete. - Confirm owner organization billing uses a valid Azure subscription and resource group. diff --git a/docs/embedded/admin/grant-admin-consent-permissions.md b/docs/embedded/admin/grant-admin-consent-permissions.md index 09b22d268..83d7479e8 100644 --- a/docs/embedded/admin/grant-admin-consent-permissions.md +++ b/docs/embedded/admin/grant-admin-consent-permissions.md @@ -1,7 +1,7 @@ --- title: Grant admin consent and permissions description: Review SharePoint Embedded permissions, grant admin consent, and verify the consent state in a consuming tenant. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -19,7 +19,9 @@ outcome: Grant admin consent for a SharePoint Embedded app and validate permissi next: setup-billing-microsoft-365-admin-center.md --> -Grant admin consent when a SharePoint Embedded app needs high-privilege permissions in your Microsoft 365 tenant. Application permissions require admin consent. Delegated flows can avoid tenant-wide admin consent, but they still require the appropriate admin role for registration or per-user consent for container access. To learn more, see [Grant admin consent](/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal). +Grant admin consent when a SharePoint Embedded app needs high-privilege permissions in your Microsoft 365 tenant. + +Application permissions require admin consent. Delegated flows can avoid tenant-wide admin consent, but they still require the appropriate admin role for registration or per-user consent for container access. To learn more, see [Grant admin consent](/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal). Use this article to review requested permissions, grant consent, and troubleshoot common consent failures. @@ -55,7 +57,7 @@ These are the permissions that the owning application needs to act on the consum | Permission | Why the app requests it | Consent note | | --- | --- | --- | | [`FileStorageContainerTypeReg.Selected`](/graph/permissions-reference#filestoragecontainertyperegselected) | Register the container type in the consuming tenant. | The app can request this as delegated or application permission. If delegated registration is used, no admin consent is required but the user performing the registration must be a SharePoint Embedded Administrator or Global Administrator. | -| [`FileStorageContainer.Selected`](/graph/permissions-reference#filestoragecontainerselected) | Access containers and content for its container type in the consuming tenant. | The app can request this as delegated or application permission. If delegated access is used, no admin consent is required but each user of the app will need to consent when signing into the app. | +| [`FileStorageContainer.Selected`](/graph/permissions-reference#filestoragecontainerselected) | Access containers and content for its container type in the consuming tenant. | The app can request this as delegated or application permission. If delegated access is used, no admin consent is required but each user of the app will need to consent when signing in to the app. | ## Review requested permissions diff --git a/docs/embedded/admin/install-sharepoint-embedded-app.md b/docs/embedded/admin/install-sharepoint-embedded-app.md index 621914d49..f369c68ac 100644 --- a/docs/embedded/admin/install-sharepoint-embedded-app.md +++ b/docs/embedded/admin/install-sharepoint-embedded-app.md @@ -1,7 +1,7 @@ --- title: Install a SharePoint Embedded app description: Install or register a SharePoint Embedded app in a consuming tenant and validate the tenant setup. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -23,7 +23,7 @@ Install a SharePoint Embedded app when a consuming Microsoft 365 tenant needs to Installation makes the app visible for tenant administration, but the tenant may still need admin consent, container type permission registration, and billing setup before users can access content. -This article focuses on the consuming-tenant administrator path in the SharePoint admin center. +This article focuses on the consuming tenant administrator path in the SharePoint admin center. > [!IMPORTANT] > A consuming tenant admin is typically a user assigned the **SharePoint Embedded Administrator** role. @@ -39,9 +39,9 @@ Confirm these prerequisites. - You can sign in to the consuming tenant. - Your account has the SharePoint Embedded Administrator role or Global Administrator role. -- The SharePoint Embedded app exists in the owning tenant. +- The SharePoint Embedded app exists in the developer tenant. - You have the app identity or installation link provided by the app owner. -- You know whether billing is handled by the app owner or by the user organization. +- You know whether the app owner or consuming tenant pays for usage. - You know which permissions the app requests. - You can complete admin consent if the installation flow requires it. - You know whether the app is a single-tenant line-of-business app or a multitenant independent software vendor (ISV) app. @@ -54,7 +54,7 @@ A consuming tenant is the Microsoft 365 tenant where users run the SharePoint Em The consuming tenant admin manages the app and containers in that tenant. -For a single-tenant line-of-business app, the owning tenant and consuming tenant are usually the same. +For a single-tenant line-of-business app, the developer tenant and consuming tenant are usually the same. For a multitenant ISV app, each customer tenant is a consuming tenant and customer files remain in the customer Microsoft 365 tenant boundary. diff --git a/docs/embedded/admin/manage-containers-powershell.md b/docs/embedded/admin/manage-containers-powershell.md index ad79aa66a..cdce953a9 100644 --- a/docs/embedded/admin/manage-containers-powershell.md +++ b/docs/embedded/admin/manage-containers-powershell.md @@ -1,7 +1,7 @@ --- title: Manage containers with PowerShell description: Use SharePoint Online Management Shell to inventory and manage SharePoint Embedded apps and containers. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -117,7 +117,7 @@ Review your tenant sharing policy before overriding tenant sharing behavior. List active containers for a SharePoint Embedded application. ```powershell -Get-SPOContainer -OwningApplicationId | FT +Get-SPOContainer -OwningApplicationId | Format-Table ``` The `OwningApplicationId` is the ID of the SharePoint Embedded application. @@ -135,7 +135,7 @@ For command details, see [Get-SPOContainer](/powershell/module/sharepoint-online Sort containers by storage when investigating cost or growth. ```powershell -Get-SPOContainer -OwningApplicationId -SortByStorage | FT +Get-SPOContainer -OwningApplicationId -SortByStorage | Format-Table ``` Use `Ascending` or `Descending` for ``. diff --git a/docs/embedded/admin/manage-containers-sharepoint-admin-center.md b/docs/embedded/admin/manage-containers-sharepoint-admin-center.md index a2e8b6c6c..dd49cc4f6 100644 --- a/docs/embedded/admin/manage-containers-sharepoint-admin-center.md +++ b/docs/embedded/admin/manage-containers-sharepoint-admin-center.md @@ -1,7 +1,7 @@ --- title: Manage containers in SharePoint admin center description: View, inspect, delete, restore, and manage SharePoint Embedded containers in the SharePoint admin center. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -169,7 +169,7 @@ For broader controls, see [Apply security and compliance controls](apply-securit ## Archive a container -Archive a container when it's no longer actively used but must be retained for legal, compliance, or business purposes. Documents in an archived container can't be accessed by any user or application until the container is reactivated. +Archive a container when it's no longer actively used but must be retained for legal, compliance, or business purposes. No user or application can open documents in an archived container until you reactivate the container. > [!NOTE] > Container archival relies on Microsoft 365 Archive, which is in preview for SharePoint Embedded. Validate tenant availability, billing, and API behavior before you archive production containers. For more information, see [Archive and restore containers](../build/archive-restore-containers.md). diff --git a/docs/embedded/admin/monitor-usage-billing-cost.md b/docs/embedded/admin/monitor-usage-billing-cost.md index 961b16b37..2fa883e97 100644 --- a/docs/embedded/admin/monitor-usage-billing-cost.md +++ b/docs/embedded/admin/monitor-usage-billing-cost.md @@ -1,7 +1,7 @@ --- title: Monitor usage, billing, and cost description: Monitor SharePoint Embedded usage and pay-as-you-go costs with billing meters and Azure Cost Management. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -28,7 +28,7 @@ Cost is based on usage meters, so review storage, archived storage, API transact Use this article to understand cost drivers, review billing in Azure Cost Management, and establish operational controls. > [!IMPORTANT] -> Admin actions taken through the SharePoint admin center or SharePoint PowerShell aren't charged as SharePoint Embedded API transactions according to the SharePoint Embedded billing meters. +> Admin actions taken through the SharePoint admin center or SharePoint PowerShell aren't charged as SharePoint Embedded API transactions. ## Before you begin @@ -96,7 +96,7 @@ Egress refers to data downloaded from SharePoint Embedded to a customer's client Exempt transfers include: - File downloads from the SharePoint Embedded application server to the customer's Office Desktop client. -- File downloads from the SharePoint Embedded application server to the Web Application Companion (WAC). +- File downloads from the SharePoint Embedded application server to Office for the web. Review app download behavior when egress grows. diff --git a/docs/embedded/admin/review-audit-events.md b/docs/embedded/admin/review-audit-events.md index e473fb069..3b7ecd897 100644 --- a/docs/embedded/admin/review-audit-events.md +++ b/docs/embedded/admin/review-audit-events.md @@ -1,7 +1,7 @@ --- title: Review audit events description: Find and interpret SharePoint Embedded audit activity in Microsoft Purview audit. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -41,8 +41,6 @@ For supported SharePoint Embedded compliance capabilities, see [Security and Com ## Understand SharePoint Embedded audit coverage -Audit capabilities in SharePoint Embedded mirror existing SharePoint audit capabilities. - User and admin operations performed in applications hosted in SharePoint Embedded are captured, recorded, and retained in the unified audit log. Audit can help answer questions such as: diff --git a/docs/embedded/admin/setup-billing-microsoft-365-admin-center.md b/docs/embedded/admin/setup-billing-microsoft-365-admin-center.md index 218f41745..614cd0705 100644 --- a/docs/embedded/admin/setup-billing-microsoft-365-admin-center.md +++ b/docs/embedded/admin/setup-billing-microsoft-365-admin-center.md @@ -1,7 +1,7 @@ --- title: Set up billing in Microsoft 365 admin center description: Configure SharePoint Embedded pass-through billing in the Microsoft 365 admin center for a consuming tenant. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -19,7 +19,7 @@ outcome: Set up billing for SharePoint Embedded apps that are billed to the cons next: manage-containers-sharepoint-admin-center.md --> -Set up SharePoint Embedded billing in the Microsoft 365 admin center when your tenant uses an app with pass-through or user organization billing. +Set up SharePoint Embedded billing in the Microsoft 365 admin center when your tenant uses an app with pass-through (customer) billing. No user can access a pass-through SharePoint Embedded app before valid billing is configured for the SharePoint Embedded platform in the consuming tenant. @@ -55,11 +55,11 @@ SharePoint Embedded supports two billing models. | Billing model | Who pays | | --- | --- | -| Standard | The tenant that owns or develops the app is billed for consumption. | -| Pass-through | The tenant registered to use the app is billed for consumption. | +| Standard billing | The tenant that owns or develops the app is billed for consumption. | +| Pass-through (customer) billing | The tenant registered to use the app is billed for consumption. | > [!NOTE] -> A container type's billing model is set when the container type is created and can't be changed later. To switch billing models, the developer creates a new container type with the wanted model. +> A container type's billing model is set when the container type is created and can't be changed later. To switch billing models, the developer creates a new container type that uses the billing model they want. The following diagram shows standard billing, where consumption charges are billed to the tenant that owns or develops the app. @@ -163,7 +163,7 @@ Use these checks when setup fails. - The subscription is disabled or unavailable. - No resource group is available for billing setup. - The app uses pass-through billing but the consuming tenant hasn't turned on SharePoint Embedded apps. -- The app uses owner organization billing, so the app owner must resolve billing instead. +- The app uses standard billing, so the app owner must resolve billing instead. - Tenant policies restrict access to the Microsoft 365 admin center billing experience. ## Common access symptoms diff --git a/docs/embedded/build/agent-experiences.md b/docs/embedded/build/agent-experiences.md index 26b3582c8..accc08aef 100644 --- a/docs/embedded/build/agent-experiences.md +++ b/docs/embedded/build/agent-experiences.md @@ -1,7 +1,7 @@ --- title: Add Microsoft 365 Copilot and agent experiences description: Ground Copilot-style agents in SharePoint Embedded content and expose SharePoint Embedded to Microsoft Foundry. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: pemtaira ms.author: mawin ms.localizationpriority: high @@ -22,18 +22,18 @@ next: migrate-azure-blob-storage.md SharePoint Embedded agent experiences let your app answer questions over files stored in SharePoint Embedded containers. The recommended path is to use **Microsoft Foundry Agent Service** with a **SharePoint knowledge source** configured for SharePoint Embedded. For setup steps, see [Set up SharePoint Embedded as a Foundry knowledge source](sharepoint-embedded-knowledge-source.md). > [!CAUTION] -> The earlier **SharePoint Embedded agent SDK** (the React `ChatEmbedded` control) was **deprecated in March 2026** and replaced by [Microsoft Foundry Agent Service](/azure/foundry/agents/overview) with a [SharePoint knowledge source (preview)](/azure/search/agentic-knowledge-source-how-to-sharepoint-remote) configured for SharePoint Embedded. Use the Foundry knowledge source for new work. +> The earlier **SharePoint Embedded agent software development kit (SDK)** (the React `ChatEmbedded` control) is deprecated. For new work, use [Microsoft Foundry Agent Service](/azure/foundry/agents/overview) with a [SharePoint knowledge source (preview)](/azure/search/agentic-knowledge-source-how-to-sharepoint-remote) configured for SharePoint Embedded. ## Test user experience Sign in with a user who has a Microsoft 365 Copilot license when required. Upload supported files to a container, wait for indexing, open the chat, and ask questions the file content can answer. If answers omit expected files, check: -- Discoverability. -- Supported file formats. -- App access. -- User access. -- Scope selection. -- Indexing delay. +- Confirm the files are discoverable. +- Confirm the files use supported file formats. +- Confirm the app has access to the container. +- Confirm the signed-in user has access to the files. +- Confirm the chat experience is scoped to the expected containers. +- Allow time for indexing to complete. ## Next steps diff --git a/docs/embedded/build/archive-restore-containers.md b/docs/embedded/build/archive-restore-containers.md index bb1fc04aa..b919426d1 100644 --- a/docs/embedded/build/archive-restore-containers.md +++ b/docs/embedded/build/archive-restore-containers.md @@ -1,7 +1,7 @@ --- title: Archive and restore containers description: Archive inactive SharePoint Embedded containers and reactivate them with Microsoft Graph beta APIs. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: jaeccles ms.author: mawin ms.localizationpriority: high @@ -48,7 +48,7 @@ Call the Microsoft Graph beta archive action for the target container. POST https://graph.microsoft.com/beta/storage/fileStorage/containers/{containerId}/archive ``` -The caller must have the `Owner` or `PrincipalOwner` role on the container. Global Administrators and SharePoint Embedded Administrators can act on all containers. The app must also have write permission on the container. +The caller must have the `Owner` or `PrincipalOwner` role on the container. For tenant-wide administrative access across containers, use `FileStorageContainer.Manage.All` with a signed-in SharePoint Embedded Administrator or Global Administrator. The app must also have write permission on the container. An archived container is inaccessible until it's reactivated. Stop uploads, background processors, webhook-dependent workflows, and interactive edits before submitting the archive request. @@ -76,7 +76,7 @@ Call the Microsoft Graph beta unarchive action to reactivate an archived contain POST https://graph.microsoft.com/beta/storage/fileStorage/containers/{containerId}/unarchive ``` -Reactivation is instantaneous during the first seven days after archival. After seven days, reactivation can take up to 24 hours. Keep the container read and write actions disabled until the service reports that the container is active again. +Reactivation is instantaneous during the first seven days after archival. After seven days, reactivation can take up to 24 hours. For the Microsoft 365 Archive state timing, see [Archive states in Microsoft 365 Archive](/microsoft-365/archive/archive-states). Keep the container read and write actions disabled until the service reports that the container is active again. ## Design lifecycle controls diff --git a/docs/embedded/build/configure-authentication-authorization.md b/docs/embedded/build/configure-authentication-authorization.md index 79b3d393e..0561b0307 100644 --- a/docs/embedded/build/configure-authentication-authorization.md +++ b/docs/embedded/build/configure-authentication-authorization.md @@ -1,7 +1,7 @@ --- title: Configure authentication and authorization description: Configure Microsoft Entra ID authentication and SharePoint Embedded authorization for your application. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -59,7 +59,7 @@ Use delegated `FileStorageContainer.Selected` for access on behalf of a user. Use application `FileStorageContainer.Selected` for app-only access. -Application `FileStorageContainer.Selected` requires admin consent in the consuming tenant. Delegated `FileStorageContainer.Selected` does not require admin consent. +Application `FileStorageContainer.Selected` requires admin consent in the consuming tenant. Delegated `FileStorageContainer.Selected` doesn't require admin consent when the consuming tenant's user consent policies allow users to consent. Use `FileStorageContainer.Manage.All` for administrative capabilities on behalf of an administrator user across all governable container types in the consuming tenant. These capabilities include enumerating, deleting, restoring, purging, and updating containers and managing their permissions. @@ -142,7 +142,8 @@ These operations use exceptional access patterns: - Container type registration in the consuming tenant through the Microsoft Graph container type registration API (`FileStorageContainerTypeReg.Selected`). - SharePoint Embedded agent experiences through their own permission requirements. - **Search**: Microsoft Search on SharePoint Embedded content requires the delegated `Files.Read.All` permission in addition to `FileStorageContainer.Selected`. -- **Operations that require a user license**: [List containers](/graph/api/filestorage-list-containers) returns `403 Forbidden` for a delegated user who doesn't have a OneDrive (app-only calls aren't affected), and users need a Microsoft 365 license to appear in the Office @mentions people picker. +- **List containers with delegated access**: [List containers](/graph/api/filestorage-list-containers) returns `403 Forbidden` for a delegated user who lacks a provisioned OneDrive. App-only calls aren't affected. +- **Office @mentions people picker**: Users need a Microsoft 365 license to appear in the Office @mentions people picker. - **Administrative actions on containers**: `FileStorageContainer.Manage.All` requires the signed-in user to be a SharePoint Embedded Administrator or Global Administrator. For regular app access to containers, use `FileStorageContainer.Selected` with the required container type permissions. > [!IMPORTANT] @@ -172,7 +173,7 @@ The owning application grants container type application permissions through [co ## Manage container type owners -Any Microsoft Entra user that isn't an external identity can be a container type owner. Owner management through the [permissions](/graph/api/filestoragecontainertype-post-permissions?view=graph-rest-beta) navigation property on the [fileStorageContainerType](/graph/api/resources/filestoragecontainertype) resource is currently available only in Microsoft Graph beta. Each entry has the `owner` role and identifies the user through `grantedToV2`. +Any Microsoft Entra user who isn't an external identity can be a container type owner. Owner management through the [permissions](/graph/api/filestoragecontainertype-post-permissions?view=graph-rest-beta) navigation property on the [fileStorageContainerType](/graph/api/resources/filestoragecontainertype) resource is currently available only in Microsoft Graph beta. Each entry has the `owner` role and identifies the user through `grantedToV2`. - **Automatic assignment**: The user who [creates a container type](/graph/api/filestorage-post-containertypes) is automatically assigned as an owner. - **Add owners**: Use [`POST /containerTypes/{id}/permissions`](/graph/api/filestoragecontainertype-post-permissions?view=graph-rest-beta) to add owners. A container type can have at most three owners in total, including the creator who is automatically assigned as the first owner. diff --git a/docs/embedded/build/container-metadata.md b/docs/embedded/build/container-metadata.md index a12daa3fc..2c842998a 100644 --- a/docs/embedded/build/container-metadata.md +++ b/docs/embedded/build/container-metadata.md @@ -1,7 +1,7 @@ --- title: Store and query container metadata description: Define SharePoint Embedded metadata columns and query drive items by field values. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -25,11 +25,11 @@ Use metadata when your app needs structured fields on files in a SharePoint Embe Call the metadata APIs with an app-only or delegated bearer token. Use `FileStorageContainer.Selected` for application and delegated calls. -Container owners and managers can create, update, and delete columns. Container members can read and list columns. +Column API authorization depends on the caller's Microsoft Graph permissions and the container type application permissions granted to the app. ## Choose column types -SharePoint Embedded metadata supports these column type properties: `boolean`, `choice`, `currency`, `dateTime`, `hyperlinkOrPicture`, `number`, `personOrGroup`, and `text`. It also supports column settings such as `indexed`, `isDeletable`, `isSealed`, `name`, `readOnly`, and `type`. +SharePoint Embedded metadata supports these column type properties: `boolean`, `choice`, `currency`, `dateTime`, `hyperlinkOrPicture`, `number`, `personOrGroup`, and `text`. It also supports column settings such as `indexed`, `isDeletable`, `isSealed`, `name`, and `readOnly`. Column names must follow SharePoint rules. Don't use names that contain `!`, start with a digit or punctuation, contain spaces, look like spreadsheet cell references, represent localized true or false values, or use reserved names such as `Author`, `Created`, or `Description`. diff --git a/docs/embedded/build/create-container-type.md b/docs/embedded/build/create-container-type.md index 24c3dc57a..fee33e770 100644 --- a/docs/embedded/build/create-container-type.md +++ b/docs/embedded/build/create-container-type.md @@ -1,7 +1,7 @@ --- title: Create and configure a container type description: Create a trial or production SharePoint Embedded container type and configure its owning app and billing model. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: stpuceli ms.author: mawin ms.localizationpriority: high @@ -83,7 +83,7 @@ For Microsoft Graph, create the container type with the `trial` billing classifi The following restrictions apply to trial container types: - The tenant can have up to five containers of the container type. This includes active containers and those in the recycle bin. -- Each container has up to 1 GB of storage space. +- Each container has up to 200 MB of storage space. - The container type expires after 30 days, and access to any existing containers of that container type is then removed. - The developer must permanently delete all containers of an existing container type in trial status to create a new container type for trial. This includes containers in the deleted container collection. - The container type is restricted to work in the developer tenant. It can't be deployed in other consuming tenants. @@ -92,7 +92,7 @@ The following restrictions apply to trial container types: Use standard billing when the developer or app owner tenant pays for consumption. -Each tenant can create up to 25 container types in total. One of these can be a free trial container type; the rest are standard (billed) container types. +Each tenant can create up to 25 standard (billed) container types, with one trial container type counted separately, for up to 26 total container types. The 25 standard container type limit is the upper limit; new tenants may start with a lower default that can be raised on request. 1. Create or identify the owning Microsoft Entra ID application. 1. Create the container type with the `standard` billing classification. diff --git a/docs/embedded/build/create-manage-containers.md b/docs/embedded/build/create-manage-containers.md index ffd84d1fe..7cfbeb25f 100644 --- a/docs/embedded/build/create-manage-containers.md +++ b/docs/embedded/build/create-manage-containers.md @@ -1,7 +1,7 @@ --- title: Create and manage containers description: Create, list, update, recycle, restore, and delete SharePoint Embedded containers in your app. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: jaeccles ms.author: mawin ms.localizationpriority: high @@ -119,7 +119,7 @@ When listing containers: - Map results to your application data. > [!NOTE] -> Delegated list containers currently returns `403 Forbidden` if the user doesn't have a OneDrive. This dependency doesn't apply to app-only list calls. +> Delegated list containers currently returns `403 Forbidden` if the user lacks a provisioned OneDrive. This dependency doesn't apply to app-only list calls. ## Get a container diff --git a/docs/embedded/build/fluid-framework.md b/docs/embedded/build/fluid-framework.md index c98a46995..d20c00979 100644 --- a/docs/embedded/build/fluid-framework.md +++ b/docs/embedded/build/fluid-framework.md @@ -1,7 +1,7 @@ --- title: Add real-time collaboration with Fluid Framework description: Use Fluid Framework with SharePoint Embedded for synchronized collaborative application state. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: jaeccles ms.author: mawin ms.localizationpriority: high @@ -16,7 +16,7 @@ ai-usage: ai-assisted task_type: how-to audience: developer outcome: Run the Fluid item counter sample with a SharePoint Embedded app and container type. -next: agent-experiences.md +next: sharepoint-embedded-knowledge-source.md --> Use Fluid Framework when your SharePoint Embedded app needs real-time shared state, such as collaborative controls, live counters, cursors, annotations, or multi-user form state. Fluid provides client libraries for distributing, synchronizing, and saving shared data. @@ -61,7 +61,7 @@ After Webpack completes, open `https://localhost:8080`, sign in with tenant cred Use Fluid for collaborative application state that benefits from low-latency synchronization. Store durable documents and files in SharePoint Embedded containers. Persist final business output to your own durable model or to SharePoint Embedded files when your scenario needs audit, retention, search, or reporting. -Treat Fluid shared objects as user-visible collaboration state. Don't place secrets, access tokens, SAS URLs, or privileged Graph responses in shared data structures. +Treat Fluid shared objects as user-visible collaboration state. Don't place secrets, access tokens, shared access signature (SAS) URLs, or privileged Graph responses in shared data structures. ## Handle identity and access diff --git a/docs/embedded/build/manage-files.md b/docs/embedded/build/manage-files.md index 83989ef2f..c6e435356 100644 --- a/docs/embedded/build/manage-files.md +++ b/docs/embedded/build/manage-files.md @@ -1,7 +1,7 @@ --- title: Upload, download, and manage files description: Use Microsoft Graph DriveItem APIs to upload, download, organize, update, delete, and restore SharePoint Embedded files. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -42,7 +42,7 @@ Start with these Microsoft Graph references: - [Microsoft Graph file storage overview](/graph/api/resources/onedrive) > [!IMPORTANT] -> Use documented Microsoft Graph DriveItem and file storage APIs. Don't invent SharePoint Embedded-specific file API names. +> Use documented Microsoft Graph DriveItem and file storage APIs for file operations in SharePoint Embedded containers. ## Prerequisites @@ -123,7 +123,7 @@ Before replacing content: - Preserve the DriveItem ID where supported. - Update your app metadata after Graph succeeds. -Office files stored in SharePoint Embedded have versioning enabled automatically for Word, Excel, and PowerPoint. +Versioning is enabled by default for Word, Excel, and PowerPoint files stored in SharePoint Embedded, and is governed by the container type's item-versioning setting. See [Open Office files from your app](open-office-files.md) for Office behavior. @@ -165,7 +165,7 @@ After upload, add richer experiences: ## Validate file operations -Create a smoke test: +Create a quick end-to-end test: 1. Create a test container. 1. Create a folder. diff --git a/docs/embedded/build/migrate-azure-blob-storage.md b/docs/embedded/build/migrate-azure-blob-storage.md index d3fdbc13c..ffa1784cc 100644 --- a/docs/embedded/build/migrate-azure-blob-storage.md +++ b/docs/embedded/build/migrate-azure-blob-storage.md @@ -1,7 +1,7 @@ --- title: Migrate from Azure Blob Storage description: Move files from Azure Blob Storage into SharePoint Embedded containers with Microsoft Graph. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: stpuceli ms.author: mawin ms.localizationpriority: high @@ -15,7 +15,7 @@ ai-usage: ai-assisted @@ -126,17 +126,17 @@ Use `fail` when duplicate files shouldn't be overwritten. Change the conflict be ## Run the sample -The sample uses Microsoft Graph SDK 5.56.0, Azure.Identity 1.12.0, Azure.Storage.Blobs 12.21.0, CommandLineParser 2.9.1, and Newtonsoft.Json 13.0.3. +The sample uses the package versions specified in the sample project file, including the Microsoft Graph SDK, Azure.Identity, Azure.Storage.Blobs, CommandLineParser, and Newtonsoft.Json. ```console -dotnet run Program.cs -- --sasurl "" --tenantid "" --clientid "" --containerid "" [ --blobfile "" --outputfile "" ] +dotnet run -- --sasurl "" --tenantid "" --clientid "" --containerid "" [ --blobfile "" --outputfile "" ] ``` Use the optional blob list file for controlled batches and the optional output file to capture failed blobs for reruns. ## Validate migrated content -Compare source blob counts with destination drive item counts. Check folder paths, file sizes, upload failures, duplicate handling, and required metadata. Open representative files through your SharePoint Embedded app, then validate search and metadata queries after indexing has had time to complete. +Compare source blob counts with destination DriveItem counts. Check folder paths, file sizes, upload failures, duplicate handling, and required metadata. Open representative files through your SharePoint Embedded app, then validate search and metadata queries after indexing has had time to complete. Don't delete source blobs until business owners approve the migration result and retention requirements are satisfied. diff --git a/docs/embedded/build/open-office-files.md b/docs/embedded/build/open-office-files.md index bbbd2ec00..c4533e838 100644 --- a/docs/embedded/build/open-office-files.md +++ b/docs/embedded/build/open-office-files.md @@ -1,7 +1,7 @@ --- title: Open Office files from your app description: Launch Word, Excel, and PowerPoint files from SharePoint Embedded in Office web or desktop clients. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -131,7 +131,7 @@ ms-powerpoint:ofe|u|https://contoso.com/presentation.pptx ## Build a desktop client URL -Because `webUrl` points to Office Online for Office documents, build the desktop URI in two steps: +Because `webUrl` points to Office for the web for Office documents, build the desktop URI in two steps: 1. Get the `webUrl` of the parent folder. 1. Append the file name. @@ -156,7 +156,12 @@ Use redirect settings to route users back to your app when Microsoft 365 can't o `ApplicationRedirectUrl` configures the application redirect URL on the container type. Use it for the app route that handles file-return scenarios for your workload. -The `urlTemplate` setting controls where Microsoft 365 sends users for files without a supported viewer. Supported Office web viewer files, such as Word, Excel, and PowerPoint, open in the Office web viewer. PDF files open in the embedded viewer. Other file types redirect through `urlTemplate` when it's configured. If `urlTemplate` isn't configured, Microsoft 365 sends users to a Microsoft help page. +The `urlTemplate` setting controls where Microsoft 365 sends users for files without a supported viewer. Routing works this way: + +- Supported Office files, such as Word, Excel, and PowerPoint files, open in Office for the web. +- PDF files open in the embedded viewer. +- Other file types redirect through `urlTemplate` when it's configured. +- If `urlTemplate` isn't configured, Microsoft 365 sends users to a Microsoft help page. Set `settings.urlTemplate` with the Microsoft Graph `PATCH /storage/fileStorage/containerTypes/{containerTypeId}` API. Use a valid absolute `https://` URL that doesn't resolve to a loopback address. @@ -171,7 +176,7 @@ Content-Type: application/json } ``` -Microsoft 365 resolves supported tokens, URL-encodes their values, and substitutes them into the template. For example, supported tokens can include `{tenant-id}`, `{drive-id}`, `{folder-id}`, `{item-id}`, `{site-domain}`, `{list-id}`, and `{site-url}`. +Microsoft 365 resolves supported tokens, URL-encodes their values, and substitutes them into the template. Examples of supported tokens can include `{tenant-id}`, `{drive-id}`, `{folder-id}`, `{item-id}`, `{site-domain}`, `{list-id}`, and `{site-url}`; the supported token set can change. When your app receives a `urlTemplate` redirect, authenticate the user, parse the token values, and use Microsoft Graph to retrieve the file. If you need the canonical file URL, use the DriveItem `webDavUrl` property instead of `webUrl`. diff --git a/docs/embedded/build/preview-files.md b/docs/embedded/build/preview-files.md index 8748da8e4..c23635931 100644 --- a/docs/embedded/build/preview-files.md +++ b/docs/embedded/build/preview-files.md @@ -1,7 +1,7 @@ --- title: Preview files in your app description: Create Microsoft Graph preview links and embed supported SharePoint Embedded file previews in your app. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -62,7 +62,7 @@ For the current list, see [File types supported for previewing files in OneDrive ## Native PDF viewing -The SharePoint Embedded native PDF viewing experience supports **searching within the file**, **viewing comments and sticky notes** embedded on the file, and **printing** (added March 2026). These capabilities are available through the [driveItem: preview](/graph/api/driveitem-preview) API in **both the beta and v1.0** Microsoft Graph endpoints. +The SharePoint Embedded native PDF viewing experience supports **searching within the file**, **viewing comments and sticky notes** embedded on the file, and **printing** (added March 2026). These capabilities are available through the [driveItem: preview](/graph/api/driveitem-preview) API in **both the beta and v1.0** Microsoft Graph endpoints, and they can change as the preview experience evolves. ### Enhance the PDF previewer with query parameters @@ -79,6 +79,8 @@ Pass parameters as a JSON-encoded `embed` query string. You can include one or m | `mpp` | Enables the print icon and Ctrl+P printing. For example, `?&embed={"mpp":true}`. | | `mpsn` | Shows sticky note content when the PDF contains sticky notes. For example, `?&embed={"mpsn":true}`. | +These embed parameters are specific to the PDF preview experience and can change. + ## Prerequisites Before creating previews, make sure: @@ -87,6 +89,7 @@ Before creating previews, make sure: - Your app knows the container ID and DriveItem ID. - Your app can acquire a Microsoft Graph token. - The caller has permission to read the file. +- Your app has `FileStorageContainer.Selected` consent and the required container type permissions. - The file type is supported for preview. - Your UI can host an iframe or open a new page. @@ -244,12 +247,8 @@ Test with multiple file types and users: 1. Refresh an expired preview URL. 1. Confirm the fallback action works. -## Connect to the next build task +## Next steps After preview is working, add discovery experiences so users can find content across containers and files. -Continue to [Search containers and files](search-containers-files.md). - -## Next steps - - [Search containers and files](search-containers-files.md) diff --git a/docs/embedded/build/quickstart-vscode.md b/docs/embedded/build/quickstart-vscode.md index 0b7a9f690..7a49de8d0 100644 --- a/docs/embedded/build/quickstart-vscode.md +++ b/docs/embedded/build/quickstart-vscode.md @@ -1,14 +1,14 @@ --- -title: "Quickstart: Build your first app with VS Code" +title: "Quickstart: Build your first app with Visual Studio Code" description: Create a standard SharePoint Embedded container type in Visual Studio Code and run the sample application locally. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: mawin ms.author: mawin ms.localizationpriority: high ai-usage: ai-assisted --- -# Quickstart: Build your first app with VS Code +# Quickstart: Build your first app with Visual Studio Code **Applies to:** Developer @@ -108,7 +108,7 @@ If you skip billing setup or don't have the required Azure permissions, the tree You must register the container type in the consuming tenant before your app can create containers or access content. -1. After creation, follow the prompt to register the container type in the local tenant. +1. After creation, follow the prompt to register the container type in the consuming tenant. 1. If the prompt isn't visible, right-click the container type and select **Register**. 1. Review the permissions. 1. Grant admin consent in the browser. @@ -116,7 +116,7 @@ You must register the container type in the consuming tenant before your app can Registration configures the permissions the owning app can use against containers of the container type. -![Screenshot of the SharePoint Embedded extension prompting to register the container type on the local tenant, with the registration action highlighted.](../images/vsx-images/n7aregister-ct.png) +![Screenshot of the SharePoint Embedded extension prompting to register the container type in the consuming tenant, with the registration action highlighted.](../images/vsx-images/n7aregister-ct.png) ## Create your first container diff --git a/docs/embedded/build/register-application-permissions.md b/docs/embedded/build/register-application-permissions.md index 0c2c402dd..2a4c378e4 100644 --- a/docs/embedded/build/register-application-permissions.md +++ b/docs/embedded/build/register-application-permissions.md @@ -1,7 +1,7 @@ --- title: Register application permissions description: Register SharePoint Embedded container type application permissions in a consuming tenant. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: stpuceli ms.author: mawin ms.localizationpriority: high @@ -34,7 +34,7 @@ Registration controls: - Which app-only permissions each application has. - Whether guest applications can interact with the owning application's containers. -If registration is missing or incomplete, later calls can fail with access denied errors. +If registration is missing or incomplete, later calls can fail with access-denied errors. ## Understand who can register @@ -174,7 +174,7 @@ After registration succeeds: | Symptom | Likely cause | Action | |---|---|---| | `401 Unauthorized` | Missing or invalid token | Request a valid app-only token. | -| `403 Forbidden` | App lacks permission or isn't owning app | Confirm `FileStorageContainerTypeReg.Selected`, consent, and app ID. | +| `403 Forbidden` | App lacks permission or isn't the owning app | Confirm `FileStorageContainerTypeReg.Selected`, consent, and app ID. | | `404 Not Found` | Container type doesn't exist | Verify ID and tenant. | | Access denied on Graph calls | Registration missing or insufficient | Re-register with needed permissions. | | Admin can't find hidden permission | Portal doesn't expose it | Use an admin consent URL. | diff --git a/docs/embedded/build/respond-to-changes-webhooks.md b/docs/embedded/build/respond-to-changes-webhooks.md index f569f0879..35d3b21a2 100644 --- a/docs/embedded/build/respond-to-changes-webhooks.md +++ b/docs/embedded/build/respond-to-changes-webhooks.md @@ -1,7 +1,7 @@ --- title: Respond to file and container changes with webhooks description: Subscribe to SharePoint Embedded file and container changes and handle Microsoft Graph webhook notifications. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: jaeccles ms.author: mawin ms.localizationpriority: high @@ -25,7 +25,7 @@ Use Microsoft Graph webhooks when your app must react to file changes in a Share ## Create a notification endpoint -Expose an HTTPS endpoint that accepts `POST` requests. During local development, use ngrok to tunnel requests to a local server. +Expose an HTTPS endpoint that accepts `POST` requests. During local development, use a tunneling tool such as ngrok to tunnel requests to a local server. ```console ngrok http 3001 diff --git a/docs/embedded/build/search-containers-files.md b/docs/embedded/build/search-containers-files.md index d84b283b2..0fe1595a9 100644 --- a/docs/embedded/build/search-containers-files.md +++ b/docs/embedded/build/search-containers-files.md @@ -1,7 +1,7 @@ --- title: Search containers and files description: Search SharePoint Embedded containers and files with Microsoft Search in Microsoft Graph. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -22,7 +22,7 @@ next: container-metadata.md Use Microsoft Search in Microsoft Graph when your app needs keyword search across SharePoint Embedded containers or content. The search API ranks matching results and returns `drive` resources for containers or `driveItem` resources for files and folders. > [!NOTE] -> SharePoint Embedded search is in preview. Use the Microsoft Graph **`/beta`** endpoint because there's no `v1.0` search API for containers. Search supports delegated permissions only and follows the [exceptional access pattern](configure-authentication-authorization.md#handle-operations-not-exposed-through-graph). +> SharePoint Embedded search is in preview. Use the Microsoft Graph `/beta` endpoint because there's no `v1.0` search API for containers. Search supports delegated permissions only and follows the [exceptional access pattern](configure-authentication-authorization.md#handle-operations-not-exposed-through-graph). ## Choose the search scope diff --git a/docs/embedded/build/share-files-manage-permissions.md b/docs/embedded/build/share-files-manage-permissions.md index 6bc558b01..c67d8b897 100644 --- a/docs/embedded/build/share-files-manage-permissions.md +++ b/docs/embedded/build/share-files-manage-permissions.md @@ -1,7 +1,7 @@ --- title: Share files and manage permissions description: Grant targeted SharePoint Embedded file access with additive permissions and role-based sharing. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -78,7 +78,7 @@ If the user still has access after deletion, inspect inherited container roles, SharePoint Embedded supports a role-based sharing model on the container type. The restrictive model allows only `Owner` and `Manager` members to add new permissions to files. The open model allows container members and guests with edit permissions to add new file permissions. By default, a container type uses the open model. -Developers in the developer tenant control this container type setting. Design your UI so the share action is disabled or hidden when the current user's role can't add permissions. For administrative configuration, see [Admin overview](../admin/admin-overview.md). +Developers in the developer tenant control this container type setting. Design your user interface so the share action is disabled or hidden when the current user's role can't add permissions. For administrative configuration, see [Admin overview](../admin/admin-overview.md). ## Respect tenant sharing policy diff --git a/docs/embedded/build/sharepoint-embedded-knowledge-source.md b/docs/embedded/build/sharepoint-embedded-knowledge-source.md index d8d1890f9..3f7c08948 100644 --- a/docs/embedded/build/sharepoint-embedded-knowledge-source.md +++ b/docs/embedded/build/sharepoint-embedded-knowledge-source.md @@ -1,7 +1,7 @@ --- title: Set up SharePoint Embedded as a Foundry knowledge source description: Configure Microsoft Foundry Agent Service to use SharePoint Embedded content as a SharePoint knowledge source. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -31,16 +31,14 @@ Before you start, make sure you have: - A SharePoint Embedded app with at least one container. - The container type ID for the SharePoint Embedded app. - A Microsoft Foundry Agent Service project. -- At least one Microsoft 365 Copilot license in the tenant during preview. +- At least one Microsoft 365 Copilot license in the tenant during preview. Billing requirements after preview are subject to change. - Permission to update the container type registration in each consuming tenant where the agent must access content. -During preview, the Copilot license is required. Billing requirements after preview are subject to change. - ## Configure the SharePoint knowledge source Configure the Foundry SharePoint knowledge source with `remoteSharePointParameters.containerTypeId` set to your SharePoint Embedded container type ID. -For source-specific configuration details, see [SharePoint knowledge source properties](/azure/search/agentic-knowledge-source-how-to-sharepoint-remote#source-specific-properties). +For source-specific configuration details, see [SharePoint knowledge source properties](/azure/search/agentic-knowledge-source-how-to-sharepoint-remote#create-a-knowledge-source). ## Grant Foundry access to the container type diff --git a/docs/embedded/build/sharepoint-embedded-mcp-server.md b/docs/embedded/build/sharepoint-embedded-mcp-server.md index 0924bfdbd..b943284ee 100644 --- a/docs/embedded/build/sharepoint-embedded-mcp-server.md +++ b/docs/embedded/build/sharepoint-embedded-mcp-server.md @@ -1,7 +1,7 @@ --- title: Use the MCP server to build apps with a coding agent description: Use the open-source SharePoint Embedded MCP server with a coding agent to provision, configure, scaffold, and manage SharePoint Embedded applications through natural language. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.localizationpriority: high ms.author: grjoseph ms.reviewer: cindylay @@ -19,9 +19,9 @@ outcome: Use the SharePoint Embedded MCP server with a coding agent to provision next: quickstart-vscode.md --> -The SharePoint Embedded MCP server is an open-source [Model Context Protocol](https://modelcontextprotocol.io/) server that lets MCP-compatible AI clients set up and manage SharePoint Embedded applications through natural language. Supported clients include GitHub Copilot in Visual Studio Code or CLI, Claude Desktop, Cursor, and Azure AI Foundry. It's distributed as the [`@microsoft/spe-mcp`](https://github.com/microsoft/SharePoint-Embedded-MCP-Server) npm package and runs locally on your machine as a developer tool. +The SharePoint Embedded MCP server is an open-source [Model Context Protocol](https://modelcontextprotocol.io/) server that lets MCP-compatible AI clients set up and manage SharePoint Embedded applications through natural language. Supported clients include GitHub Copilot in Visual Studio Code or CLI, Claude Desktop, Cursor, and Microsoft Foundry Agent Service. It's distributed as the [`@microsoft/spe-mcp`](https://github.com/microsoft/SharePoint-Embedded-MCP-Server) npm package and runs locally on your machine as a developer tool. -Instead of clicking through portals and stitching together Microsoft Graph and Azure CLI commands by hand, you describe what you want—"create a trial container type for my app"—and the AI client calls the server's tools to do it. +Instead of clicking through portals and stitching together Microsoft Graph and Azure CLI commands by hand, describe what you want, such as "create a trial container type for my app." The AI client calls the server's tools to do it. > [!NOTE] > The SharePoint Embedded MCP server is an open-source developer tool released in preview. Its source code, full tool reference, and issue tracker live in the [microsoft/SharePoint-Embedded-MCP-Server](https://github.com/microsoft/SharePoint-Embedded-MCP-Server) repository on GitHub. @@ -35,7 +35,7 @@ Instead of clicking through portals and stitching together Microsoft Graph and A The server exposes tools that an AI client can call on your behalf, grouped by task: -- **Provisioning and status**: Check your signed-in identity and provisioning readiness, create the owning Microsoft Entra ID application, and create, register, list, update, or delete [container types](../plan/container-types-containers.md) and containers. A single `project_provision` tool can run the whole sequence—app → container type → billing → registration → container—in one call. +- **Provisioning and status**: Check your signed-in identity and provisioning readiness, create the owning Microsoft Entra ID application, and create, register, list, update, or delete [container types](../plan/container-types-containers.md) and containers. A single `project_provision` tool can run the whole sequence from app to container type, billing, registration, and container in one call. - **Billing**: Pick an Azure subscription and resource group, register the `Microsoft.Syntex` resource provider, link a container type to [standard billing](../administration/billing/billing.md), and inspect billing classification or trial expiry. - **Scaffold, run, and deploy**: Generate a runnable reference application (a React single-page app with Azure Functions, or a C# web app), write its runtime configuration from your provisioning state, seed sample content, run it locally, and deploy it to Azure. - **Content operations (opt-in)**: After a separate, explicit consent, upload files, create folders, search, preview, manage sharing and permissions, and archive or restore containers. @@ -143,7 +143,7 @@ The **content operations** tools are also gated behind a separate, explicit cons ## Related content - [SharePoint Embedded MCP server on GitHub](https://github.com/microsoft/SharePoint-Embedded-MCP-Server) – source code, full tool reference, and issues. -- [Quickstart: Build your first app with VS Code](quickstart-vscode.md) – a guided extension for getting started for free. +- [Quickstart: Build your first app with Visual Studio Code](quickstart-vscode.md) – a guided extension for getting started for free. - [SharePoint Embedded container types](../plan/container-types-containers.md) - [SharePoint Embedded app architecture](../plan/app-tenant-architecture.md) - [Authentication and authorization](configure-authentication-authorization.md) diff --git a/docs/embedded/llms.txt b/docs/embedded/llms.txt index 4040d0fad..a63b3555a 100644 --- a/docs/embedded/llms.txt +++ b/docs/embedded/llms.txt @@ -10,7 +10,7 @@ ## Plan a solution (architect, IT decision maker) - [Understand app and tenant architecture](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/app-tenant-architecture): Developer vs consuming tenant, app ownership, container types, where files live. - [Choose an app model: single-tenant or multitenant](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/choose-app-model): Enterprise LOB vs ISV; who owns, installs, and pays. -- [Understand container types and containers](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/container-types-and-containers): The container type/container model and ownership. +- [Understand container types and containers](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/container-types-containers): The container type/container model and ownership. - [Choose a billing model](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/choose-billing-model): Standard vs pass-through (consuming-tenant) billing. - [Plan authentication and permissions](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/authentication-permissions): Permission models, admin consent, app-only vs delegated. - [Plan security, compliance, and governance](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/plan/security-compliance-governance): Purview, DLP, retention, sensitivity labels, conditional access. @@ -47,7 +47,7 @@ - [Create apps with PowerShell](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/create-apps-powershell): Create SharePoint Embedded apps with SharePoint PowerShell. - [Install a SharePoint Embedded app](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/install-sharepoint-embedded-app): Register/install an app in your tenant. - [Grant admin consent and permissions](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/grant-admin-consent-permissions): Review and grant requested permissions. -- [Set up billing in Microsoft 365 admin center](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/setup-billing-m365-admin-center): Configure billing for a consuming tenant. +- [Set up billing in Microsoft 365 admin center](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/setup-billing-microsoft-365-admin-center): Configure billing for a consuming tenant. - [Manage containers in SharePoint admin center](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/manage-containers-sharepoint-admin-center): View and manage containers in the UI. - [Manage containers with PowerShell](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/manage-containers-powershell): Script container management. - [Monitor usage, billing, and cost](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/admin/monitor-usage-billing-cost): Track usage and cost drivers. diff --git a/docs/embedded/overview.md b/docs/embedded/overview.md index fd043dc52..850b47035 100644 --- a/docs/embedded/overview.md +++ b/docs/embedded/overview.md @@ -1,7 +1,7 @@ --- title: SharePoint Embedded overview description: Microsoft SharePoint Embedded is an API-only file and document management platform built on Microsoft 365. Start here and route to the right task. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.localizationpriority: high ai-usage: ai-assisted @@ -11,7 +11,7 @@ ai-usage: ai-assisted **Applies to:** All -Microsoft SharePoint Embedded is a cloud-based, API-only file and document management system you can use in any application. It lets app developers harness the Microsoft 365 file and document storage platform, and is suitable for enterprises building line-of-business applications and independent software vendors (ISVs) building multitenant applications. +Microsoft SharePoint Embedded is a cloud-based, API-only file and document management system you can use in any application. It lets app developers use the Microsoft 365 file and document storage platform, and is suitable for enterprises building line-of-business applications and independent software vendors (ISVs) building multitenant applications. SharePoint Embedded has no standalone end-user interface and doesn't offer a no-code option. You access it programmatically through Microsoft Graph, so using SharePoint Embedded always involves building or deploying an application. diff --git a/docs/embedded/plan/app-tenant-architecture.md b/docs/embedded/plan/app-tenant-architecture.md index 77a874f43..368da4fbe 100644 --- a/docs/embedded/plan/app-tenant-architecture.md +++ b/docs/embedded/plan/app-tenant-architecture.md @@ -1,7 +1,7 @@ --- title: Understand app and tenant architecture description: Plan how SharePoint Embedded apps, tenants, container types, and containers relate across developer and consuming tenants. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -63,7 +63,7 @@ An independent software vendor (ISV) app can be owned by the ISV tenant and used A SharePoint Embedded application is a Microsoft Entra ID application registration. -As an owning or guest application to a container type, the app has access to containers of that container type. +An owning or guest application has access to containers of its assigned container type. SharePoint Embedded requires a 1:1 relationship between an owning application and a container type. @@ -95,7 +95,7 @@ Use a container type to answer these architecture questions: For more detail, see [Understand container types and containers](../plan/container-types-containers.md). -## Container type registration resource +## Container type registration as a resource A container type registration is also a SharePoint Embedded resource. @@ -131,7 +131,7 @@ The partition doesn't have a SharePoint Online user experience. Documents in the partition are accessible through APIs and through app-provided content experiences. -Files remain inside the consumer's Microsoft 365 tenant boundary. +Files remain inside the consuming tenant's Microsoft 365 tenant boundary. The consuming tenant's Microsoft 365 settings apply to app documents, including supported Microsoft Purview security and compliance policies. @@ -197,7 +197,7 @@ In an ISV app: Use this model when one app is used by multiple customer tenants. -The following diagram shows a worked example. Contoso is an ISV that built a human-resources app on SharePoint Embedded and deployed it into Fabrikam, an auditing firm. Fabrikam also built its own LOB auditing app. Each app has its own container type: Contoso owns the HR app and its container type, and Fabrikam owns the auditing app and its container type. Fabrikam is the consuming tenant for both apps, so both stacks of containers are stored in Fabrikam's Microsoft 365 tenant. Fabrikam owns all the data stored in its Microsoft 365 tenant, including the HR App data. +The following diagram shows a worked example. Contoso is an ISV that built a human-resources app on SharePoint Embedded and deployed it into Fabrikam, an auditing firm. Fabrikam also built its own LOB auditing app. Each app has its own container type: Contoso owns the HR app and its container type, and Fabrikam owns the auditing app and its container type. Fabrikam is the consuming tenant for both apps, so both stacks of containers are stored in Fabrikam's Microsoft 365 tenant. Fabrikam owns all the data stored in its Microsoft 365 tenant, including the HR app data. ![Diagram of a worked ISV example. Contoso's HR application and its container type sit in the Contoso owning tenant. Both Contoso's HR app and Fabrikam's LOB auditing app operate in the Fabrikam consuming tenant, where each app's container stack is stored separately.](../images/apparchexample.png) diff --git a/docs/embedded/plan/authentication-permissions.md b/docs/embedded/plan/authentication-permissions.md index 70525a292..555e87a6f 100644 --- a/docs/embedded/plan/authentication-permissions.md +++ b/docs/embedded/plan/authentication-permissions.md @@ -1,7 +1,7 @@ --- title: Plan authentication and permissions description: Plan SharePoint Embedded authentication, admin consent, delegated access, app-only access, and container permissions. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: mawin ms.author: mawin ms.localizationpriority: high @@ -118,7 +118,7 @@ Container type creation, management, and registration are now Microsoft Graph op ## Container type application permissions -Container type application permissions are granted by the owning application through container type registration. +The owning application grants container type application permissions through container type registration. These permissions define what an application can do against containers of the container type. @@ -195,7 +195,7 @@ Exceptional access patterns include: - Container type management on owning tenants through Microsoft Graph. - Container type registration on consuming tenants through Microsoft Graph (`FileStorageContainerTypeReg.Selected`). -- Administrative container operations that require `FileStorageContainer.Manage.All` and a SharePoint Embedded Administrator or Global Administrator signed-in user. +- Administrative container operations that require `FileStorageContainer.Manage.All` and a signed-in user with the SharePoint Embedded Administrator or Global Administrator role. - Microsoft Search scenarios that require additional permissions during preview. - Operations that currently require a user license. diff --git a/docs/embedded/plan/choose-app-model.md b/docs/embedded/plan/choose-app-model.md index a9cfd5d7a..77c2e0e79 100644 --- a/docs/embedded/plan/choose-app-model.md +++ b/docs/embedded/plan/choose-app-model.md @@ -1,7 +1,7 @@ --- title: "Choose an app model: single-tenant or multitenant" description: Compare single-tenant and multitenant SharePoint Embedded app models before you create container types and containers. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: mawin ms.author: mawin ms.localizationpriority: high @@ -30,11 +30,11 @@ For architecture details, see [Understand app and tenant architecture](../plan/a | Requirement | Choose single-tenant LOB | Choose multitenant ISV | | --- | --- | --- | | App is built for one organization | Yes | No | -| App is sold or provided to multiple customer tenants | No | Yes | +| App is sold or provided to multiple consuming tenants | No | Yes | | Developer tenant and consuming tenant are usually the same | Yes | No | -| Customer tenants host their own containers and files | Not usually | Yes | +| Consuming tenants host their own containers and files | Not usually | Yes | | App owner pays for all usage by default | Often | Depends on billing model | -| Customer tenant admin must onboard the app | Sometimes | Yes | +| Consuming tenant admin must onboard the app | Sometimes | Yes | Both models use the same SharePoint Embedded primitives: @@ -66,17 +66,17 @@ This model is usually single-tenant because the same tenant owns and consumes th ## Multitenant ISV model -Use the multitenant ISV model when an ISV builds one app for multiple customer tenants. +Use the multitenant ISV model when an ISV builds one app for multiple consuming tenants. In this model: - The ISV owns or develops the app. - The ISV tenant usually owns the app registration. - The ISV tenant creates the container type. -- Each customer is a consuming tenant. -- Containers are created in each customer Microsoft 365 tenant. -- Files remain in the customer tenant boundary. -- Customer Microsoft 365 settings apply to that customer's content. +- Each customer tenant is a consuming tenant. +- Containers are created in each consuming tenant. +- Files remain in the consuming tenant boundary. +- Consuming tenant Microsoft 365 settings apply to that tenant's content. The ISV app provides the user experience and calls Microsoft Graph. Customer content stays with the consuming tenant. @@ -96,7 +96,7 @@ For an ISV app, the ISV owns both. In a single-tenant LOB model, admins in the same tenant can create the container type, grant consent, and configure billing. -In a multitenant ISV model, customer tenant admins must onboard the app for their tenant. +In a multitenant ISV model, consuming tenant admins must onboard the app for their tenant. The owning app must have a service principal in the consuming tenant and must receive admin consent to perform container type registration. @@ -108,9 +108,9 @@ Containers are created in the consuming tenant. For an enterprise LOB app, that's usually the enterprise tenant. -For an ISV app, each customer tenant has its own containers. +For an ISV app, each consuming tenant has its own containers. -This separation keeps customer files in the customer's Microsoft 365 tenant boundary. +This separation keeps files in the consuming tenant's Microsoft 365 tenant boundary. > [!IMPORTANT] > Don't design an ISV architecture that stores all customer files in the ISV tenant. SharePoint Embedded stores app documents in the consuming tenant. @@ -146,7 +146,7 @@ The developer tenant admin doesn't set up a billing profile when creating the pa After the container type is registered in the consuming tenant, the consuming tenant admin sets up the billing profile. -Use pass-through billing when each customer tenant should pay for its own usage. +Use pass-through billing when each consuming tenant should pay for its own usage. ## Consent and admin responsibilities @@ -157,10 +157,10 @@ Plan these responsibilities before implementation. | Create app registration | Enterprise tenant | ISV tenant | | Create container type | Enterprise tenant | ISV tenant | | Register container type | Same tenant | Each customer consuming tenant | -| Grant Microsoft Graph consent | Enterprise admin | Customer tenant admin for consuming tenant access | +| Grant Microsoft Graph consent | Enterprise admin | Consuming tenant admin | | Configure standard billing | Enterprise/developer | ISV/developer | -| Configure pass-through billing | Consuming tenant admin | Customer tenant admin | -| Govern content | Enterprise compliance admin | Customer compliance admin | +| Configure pass-through billing | Consuming tenant admin | Consuming tenant admin | +| Govern content | Enterprise compliance admin | Consuming tenant compliance admin | ## Which setup path to follow next diff --git a/docs/embedded/plan/choose-billing-model.md b/docs/embedded/plan/choose-billing-model.md index 5d4161b85..6fb9ed92c 100644 --- a/docs/embedded/plan/choose-billing-model.md +++ b/docs/embedded/plan/choose-billing-model.md @@ -1,7 +1,7 @@ --- title: Choose a billing model description: Compare standard and pass-through SharePoint Embedded billing models before you create production container types. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -44,7 +44,7 @@ The model determines which tenant is billed and which admin configures the billi ## Standard billing -With standard billing, all consumption-based charges are directly billed to the tenant that owns or develops the application. +With standard billing, Microsoft bills all consumption-based charges to the tenant that owns or develops the application. The admin in the developer tenant must establish a valid billing profile when creating a standard container type. @@ -63,24 +63,28 @@ The billing setup requires: - A SharePoint Embedded Administrator or Global Administrator to operate billing cmdlets. - Owner or contributor permissions on the Azure subscription for the admin who sets up billing. -The standard billing pattern creates the container type and then attaches an Azure billing profile (see [Create and configure a container type](../build/create-container-type.md)): +The standard billing pattern creates the container type with Microsoft Graph and then attaches an Azure billing profile (see [Create and configure a container type](../build/create-container-type.md)): -```powershell -New-SPOContainerType -ContainerTypeName -OwningApplicationId -ApplicationRedirectUrl +```http +POST https://graph.microsoft.com/v1.0/storage/fileStorage/containerTypes ``` -Attach the Azure billing profile: - -```powershell -Add-SPOContainerTypeBilling -ContainerTypeId -AzureSubscriptionId -ResourceGroup -Region +```json +{ + "name": "{ContainerTypeName}", + "owningAppId": "{OwningApplicationId}", + "billingClassification": "standard" +} ``` +Attach the Azure billing profile by using the SharePoint Embedded Visual Studio Code extension or an administrator-managed billing flow. + > [!IMPORTANT] > Every container type must have an owning application. A single owning app can only own one container type at a time. ## Pass-through billing -With pass-through billing, consumption-based charges are billed directly to the tenant registered to use the SharePoint Embedded application. +With pass-through billing, Microsoft bills consumption-based charges directly to the tenant registered to use the SharePoint Embedded application. Admins in the developer tenant don't need to set up a billing profile when creating a pass-through container type. @@ -95,12 +99,17 @@ Use pass-through billing when: Use this pass-through creation pattern: -```powershell -New-SPOContainerType -ContainerTypeName -OwningApplicationId -IsPassThroughBilling +```http +POST https://graph.microsoft.com/v1.0/storage/fileStorage/containerTypes ``` -> [!NOTE] -> Use the `-IsPassThroughBilling` switch with `New-SPOContainerType` when the consuming tenant pays for usage. +```json +{ + "name": "{ContainerTypeName}", + "owningAppId": "{OwningApplicationId}", + "billingClassification": "directToCustomer" +} +``` ## Billing meters diff --git a/docs/embedded/plan/container-types-containers.md b/docs/embedded/plan/container-types-containers.md index fb905b89b..d6eec3c11 100644 --- a/docs/embedded/plan/container-types-containers.md +++ b/docs/embedded/plan/container-types-containers.md @@ -1,7 +1,7 @@ --- title: Understand container types and containers description: Learn how SharePoint Embedded container types define app access and how containers store files in consuming tenants. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: shsaravanan ms.author: mawin ms.localizationpriority: high @@ -45,7 +45,7 @@ Each container type is strongly coupled with one SharePoint Embedded application ## Container type identity -The container type is represented on each container as an immutable property named `ContainerTypeID`. The property is used across the SharePoint Embedded ecosystem. It affects: +The container type is represented on each container as an immutable Microsoft Graph property named `containerTypeId`. The property is used across the SharePoint Embedded ecosystem. It affects: - Access authorization. - Trial exploration. @@ -73,7 +73,7 @@ For tenant architecture, see [Understand app and tenant architecture](../plan/ap ## Access authorization -A SharePoint Embedded application must be associated with a container type to access containers of that type. After association, the application has access to containers of that type according to application-container type permissions. The owning application has full access privilege by default to containers of the container type it's coupled with. Actual access also depends on whether the app uses delegated access or app-only access. +A SharePoint Embedded application must be associated with a container type to access containers of that type. After association, the application has access to containers of that type according to container type application permissions. The owning application has full access privilege by default to containers of the container type it's coupled with. Actual access also depends on whether the app uses delegated access or app-only access. For permission planning, see [Plan authentication and permissions](../plan/authentication-permissions.md). @@ -87,7 +87,7 @@ For trial container types: - Each developer can have only one trial container type in their tenant at a time. - The trial is valid for up to 30 days. - Up to five containers of the container type can be created, including active containers and containers in the recycle bin. -- Each container has up to 1 GB of storage. +- Each container has up to 200 MB of storage. - The container type is restricted to the developer tenant. A trial container type can't be converted to production. @@ -100,7 +100,7 @@ Container types are created with the Microsoft Graph `POST /v1.0/storage/fileSto A standard container type is used for non-trial scenarios. -By default, each tenant can have 25 container types at a time; one can be a free trial container type, and the rest are standard container types. You can request an increase through Microsoft support or your SharePoint Embedded onboarding contact. +By default, each tenant can have up to 25 standard container types, plus one free trial container type. You can request an increase through Microsoft support or your SharePoint Embedded onboarding contact. Standard container types are billable and must use a billing model. diff --git a/docs/embedded/plan/limits-calling-patterns.md b/docs/embedded/plan/limits-calling-patterns.md index a19ddafe2..eb3e902a3 100644 --- a/docs/embedded/plan/limits-calling-patterns.md +++ b/docs/embedded/plan/limits-calling-patterns.md @@ -1,7 +1,7 @@ --- title: Understand limits and calling patterns description: Plan SharePoint Embedded service limits, throttling behavior, retry handling, and performance-sensitive calling patterns. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: mawin ms.author: mawin ms.localizationpriority: high @@ -55,7 +55,7 @@ SharePoint Embedded enforces the following size limits. | Files and folders with additive permissions per container | 5,000 | | File size | 250 GB | | Version count per file | 500 (default automatic version history limit) | -| Number of users shared per folder or file | 5,000 | +| Number of users a folder or file can be shared with | 5,000 | An asterisk (`*`) indicates a limit you can request to increase. @@ -165,7 +165,7 @@ An asterisk (`*`) indicates a limit you can request to increase. Application limits are defined in resource units. -The actual requests per minute depends on the APIs you call and their resource unit cost. +The actual requests per minute depend on the APIs you call and their resource unit cost. To estimate your request rate, average about two resource units per request and divide the application resource unit limit by two. diff --git a/docs/embedded/plan/security-compliance-governance.md b/docs/embedded/plan/security-compliance-governance.md index 3f2c3b3be..1970cb179 100644 --- a/docs/embedded/plan/security-compliance-governance.md +++ b/docs/embedded/plan/security-compliance-governance.md @@ -1,7 +1,7 @@ --- title: Plan security, compliance, and governance -description: Plan how Microsoft Purview, audit, DLP, retention, labels, and access policies apply to SharePoint Embedded content. -ms.date: 07/13/2026 +description: Plan how Microsoft Purview, audit, data loss prevention, retention, labels, and access policies apply to SharePoint Embedded content. +ms.date: 07/21/2026 ms.reviewer: mawin ms.author: mawin ms.localizationpriority: high @@ -49,7 +49,7 @@ For tenant role planning, see [Understand app and tenant architecture](../plan/a ## Discover applications and containers -Compliance administrators may need container details to target policies. +Compliance administrators might need container details to target policies. Use this PowerShell discovery flow to retrieve container details for policy scope: @@ -82,15 +82,15 @@ SharePoint Embedded supports these Microsoft Purview capabilities: - Audit - eDiscovery - Data Lifecycle Management -- Data Loss Prevention +- Data Loss Prevention (DLP) -These capabilities work similarly to SharePoint content, with limitations where the app must provide user interaction. +These capabilities work for SharePoint Embedded content similarly to how they work for SharePoint content, with limitations where the app must provide user interaction. ## Audit Audit capabilities mirror the existing audit functionality supported in SharePoint. -User and admin operations performed in applications hosted in SharePoint Embedded are captured, recorded, and retained in the organization's unified audit log. +The organization's unified audit log captures, records, and retains user and admin operations performed in applications hosted in SharePoint Embedded. Audit events related to SharePoint Embedded include additional data to help filter results: @@ -105,11 +105,11 @@ For more information, see [Auditing solutions in Microsoft Purview](/purview/aud Compliance administrators can use Microsoft Purview eDiscovery tools to search, hold, and export SharePoint Embedded content. -To search all SharePoint Embedded content, configure eDiscovery Search for all SharePoint sites. +To search all SharePoint Embedded content, configure eDiscovery search for all SharePoint sites. This includes SharePoint sites and SharePoint Embedded containers. -To limit eDiscovery Search to specific containers, choose sites under the SharePoint sites workload and provide the container URL. +To limit eDiscovery search to specific containers, choose sites under the SharePoint sites workload and provide the container URL. For more information, see [Microsoft Purview eDiscovery solutions](/purview/ediscovery). @@ -125,7 +125,7 @@ Because SharePoint Embedded has no built-in UI, app support is required for user For more information, see [Learn about Microsoft Purview Data Lifecycle Management](/purview/data-lifecycle-management). -## Data Loss Prevention +## Data Loss Prevention (DLP) Microsoft Purview Data Loss Prevention can identify, monitor, and automatically protect sensitive items stored in SharePoint Embedded applications. @@ -157,17 +157,17 @@ The label is applied at the **container level**: it sets the container's sensiti ## Block download policy -SharePoint Administrators or Global Administrators can block file downloads from SharePoint Embedded containers. +SharePoint Embedded Administrators can block file downloads from SharePoint Embedded containers. Use this command: ```powershell -Set-SPOSite -Identity -BlockDownloadPolicy $true +Set-SPOContainer -Identity -BlockDownloadPolicy $true ``` A SharePoint Advanced Management license is needed to enforce this policy. -For more information, see [Block download policy for SharePoint sites and OneDrive](/sharepoint/block-download-from-sites). +For more information, see [Set-SPOContainer](/powershell/module/microsoft.online.sharepoint.powershell/set-spocontainer). ## Conditional Access diff --git a/docs/embedded/publish/choose-app-billing-model.md b/docs/embedded/publish/choose-app-billing-model.md index cba02e832..fa625ed6e 100644 --- a/docs/embedded/publish/choose-app-billing-model.md +++ b/docs/embedded/publish/choose-app-billing-model.md @@ -1,7 +1,7 @@ --- title: Choose a billing model for your app description: Compare standard and pass-through billing for SharePoint Embedded apps before onboarding customer tenants. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: cindylay ms.author: mawin ms.localizationpriority: high @@ -61,7 +61,7 @@ The developer must establish a valid Azure billing profile for the container typ Choose standard billing when: -- You sell a bundled SaaS price and absorb or allocate SharePoint Embedded usage internally. +- You sell a bundled software as a service (SaaS) price and absorb or allocate SharePoint Embedded usage internally. - You want a simpler customer setup path. - Customers shouldn't configure an Azure subscription for your app. - You operate a managed service where your tenant owns the consumption relationship. diff --git a/docs/embedded/publish/customer-tenant-setup-guide.md b/docs/embedded/publish/customer-tenant-setup-guide.md index 645533d4b..793013956 100644 --- a/docs/embedded/publish/customer-tenant-setup-guide.md +++ b/docs/embedded/publish/customer-tenant-setup-guide.md @@ -1,7 +1,7 @@ --- title: Guide customers through tenant setup description: Give customer admins the SharePoint Embedded setup, consent, billing, and validation steps needed to install an ISV app. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: pemtaira ms.author: mawin ms.localizationpriority: high @@ -42,7 +42,7 @@ Ask the customer to confirm these prerequisites before the setup meeting or inst | Billing | An Azure subscription and resource group are available if the app uses pass-through billing. | | Support | The customer has your app ID, support contact, and validation checklist. | -Users don't need an Office license to collaborate on Microsoft Office documents stored in a container, except for documented exceptional experiences such as mentions. +Users don't need an Office license to collaborate on Microsoft Office documents stored in a container. Some features, such as resolving mentions, require a Microsoft 365 license for target users. ## Information to give the customer @@ -105,7 +105,7 @@ Ask the customer administrator to review: - Support and incident response commitments. - Billing model. -If your installation flow is hosted in your SaaS admin portal, include screenshots or tenant-specific values in your handoff, and keep links stable so customer admins can reuse the guide for production and disaster recovery. +If your installation flow is hosted in your software as a service (SaaS) admin portal, include screenshots or tenant-specific values in your handoff, and keep links stable so customer admins can reuse the guide for production and disaster recovery. ## Step 3: Grant admin consent diff --git a/docs/embedded/publish/prepare-customer-installation.md b/docs/embedded/publish/prepare-customer-installation.md index 7768fd43f..7726da87a 100644 --- a/docs/embedded/publish/prepare-customer-installation.md +++ b/docs/embedded/publish/prepare-customer-installation.md @@ -1,7 +1,7 @@ --- title: Prepare your app for customer installation description: Prepare a multitenant SharePoint Embedded app, container type, permissions, billing choice, and admin handoff for customer tenants. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: stpuceli ms.author: mawin ms.localizationpriority: high @@ -160,7 +160,7 @@ For single-tenant apps, you can [construct an admin consent URL](/entra/identity https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id={client_id}&redirect_uri={redirect_uri} ``` -Ensure your app's [redirect URI](/entra/identity-platform/reply-url) can handle admin consent flows. For the full permission model, see [Authentication and authorization](../build/configure-authentication-authorization.md). +Make sure your app's [redirect URI](/entra/identity-platform/reply-url) can handle admin consent flows. For the full permission model, see [Authentication and authorization](../build/configure-authentication-authorization.md). If your app uses guest application access, explain how the consuming tenant admin can view guest application permissions in administrative tools. diff --git a/docs/embedded/publish/validate-customer-installation.md b/docs/embedded/publish/validate-customer-installation.md index c35b1e4ca..f399a19c1 100644 --- a/docs/embedded/publish/validate-customer-installation.md +++ b/docs/embedded/publish/validate-customer-installation.md @@ -1,7 +1,7 @@ --- title: Validate customer app installation description: Validate SharePoint Embedded container type registration, permissions, containers, and billing after a customer installs an ISV app. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -87,7 +87,7 @@ To verify that your app is properly installed on the customer tenant: 1. Using the owning app, request an access token for the Microsoft Graph `.default` scope in the consuming tenant. 1. Verify that the access token includes `FileStorageContainer.Selected` and `FileStorageContainerTypeReg.Selected` in either the `scp` claim (for access on behalf of a user) or `roles` claim (for access without a user). -1. Use the token to [get the registration for your container type in the tenant](/graph/api/filestoragecontainertyperegistration-get). If a registration is returned, it means that your SharePoint Embedded app is installed correctly. +1. Use the token to [get the registration for your container type in the tenant](/graph/api/filestoragecontainertyperegistration-get). A returned registration confirms that your SharePoint Embedded app is installed correctly. > [!TIP] > You can also validate that your guest apps are properly set up by requesting an access token for the Microsoft Graph `.default` scope in the consuming tenant and validating that the scopes/roles you expect are present and that you can use the token to interact with content. Only the owning app can access a container type registration in a tenant. diff --git a/docs/embedded/reference/audit-events.md b/docs/embedded/reference/audit-events.md index ad71e5bcc..332464dd1 100644 --- a/docs/embedded/reference/audit-events.md +++ b/docs/embedded/reference/audit-events.md @@ -1,7 +1,7 @@ --- title: Audit events description: Reference for SharePoint Embedded container type audit events in the Microsoft Purview unified audit log. -ms.date: 07/10/2026 +ms.date: 07/21/2026 ms.reviewer: pemtaira ms.author: mawin ms.localizationpriority: high @@ -25,7 +25,7 @@ For step-by-step investigation guidance, see [Review audit events](../admin/revi ## Container type activities -These events are logged when a container type is created, updated, or deleted. They use the **Workload** value **SharePoint** and appear under the **SharePoint Embedded Container Type activities** category in Microsoft Purview audit. +Microsoft Purview audit logs record these events when a container type is created, updated, or deleted. They use the **Workload** value **SharePoint** and appear under the **SharePoint Embedded Container Type activities** category in Microsoft Purview audit. | Friendly name | Operation | Description | | --- | --- | --- | @@ -38,7 +38,7 @@ For the full list of audit activities, see [Audit log activities](/purview/audit ## Container type registration activities -These events are logged when a container type registration is created, updated, or deleted in a consuming tenant. A registration lets a SharePoint Embedded application operate in a given tenant. They use the **Workload** value **SharePoint** and appear under the **SharePoint Embedded Container Type Registration activities** category in Microsoft Purview audit. +Microsoft Purview audit logs record these events when a container type registration is created, updated, or deleted in a consuming tenant. A registration lets a SharePoint Embedded application operate in a given tenant. They use the **Workload** value **SharePoint** and appear under the **SharePoint Embedded Container Type Registration activities** category in Microsoft Purview audit. | Friendly name | Operation | Description | | --- | --- | --- | diff --git a/docs/embedded/reference/billing-meters.md b/docs/embedded/reference/billing-meters.md index e32be158f..749f141d4 100644 --- a/docs/embedded/reference/billing-meters.md +++ b/docs/embedded/reference/billing-meters.md @@ -1,7 +1,7 @@ --- title: Billing meters description: Reference for SharePoint Embedded pay-as-you-go billing meters and pricing resources. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: pemtaira ms.author: mawin ms.localizationpriority: high @@ -27,8 +27,8 @@ For setup guidance, see [choose a billing model](../plan/choose-billing-model.md | --- | --- | --- | --- | | Storage | $/GB | Files, documents, metadata, versions, recycle bin content, and deleted container collection content, in both active and archived states. | Storage is based on data stored in SharePoint Embedded. | | Archived storage | $/GB | Storage consumed by archived containers within a tenant. | Archiving moves data to the cold storage tier, which offers lower storage costs than active storage. | -| API transactions | $/Transactions | Each Microsoft Graph call made explicitly by the SharePoint Embedded application. | Internal service calls, such as eDiscovery queries and admin actions in SharePoint admin center or SharePoint PowerShell, aren't charged as application transactions. | -| Egress | $/GB | Data that exits the SharePoint Embedded platform, such as documents downloaded to a customer's client device or data transferred to a server operated by the customer. Charges are based on total volume transferred out (GB). | Downloads from the SharePoint Embedded application server to Office Desktop clients or Web Application Companion, the Microsoft-integrated Office web experience, aren't charged as egress. | +| API transactions | $/transaction | Each Microsoft Graph call made explicitly by the SharePoint Embedded application. | Internal service calls, such as eDiscovery queries and admin actions in SharePoint admin center or SharePoint PowerShell, aren't charged as application transactions. | +| Egress | $/GB | Data that exits the SharePoint Embedded platform, such as documents downloaded to a customer's client device or data transferred to a server operated by the customer. Charges are based on total volume transferred out (GB). | Downloads from the SharePoint Embedded application server to Office Desktop clients or Web Application Companion aren't charged as egress. Web Application Companion is the Microsoft-integrated Office web experience. | | Pay-as-you-go message (private preview) | Message | SharePoint Embedded agent interactions. | SharePoint Embedded agents use the Copilot Studio meter. Each agent interaction uses 12 messages. | ## Storage @@ -37,7 +37,7 @@ Storage consumption includes files and documents plus their metadata and version ## Archived storage -The Archived storage meter measures storage consumed by archived containers within a tenant. Archiving a container moves its data to the cold storage tier, which offers lower storage costs compared to active storage. Archived content is still billed, but at the archived-storage rate. +The Archived storage meter measures storage consumed by archived containers within a tenant. Archiving a container moves its data to the cold storage tier, which offers lower storage costs than active storage. Archived content is still billed, but at the archived-storage rate. ## API transactions diff --git a/docs/embedded/reference/glossary.md b/docs/embedded/reference/glossary.md index d708e7382..4f4d1ac1d 100644 --- a/docs/embedded/reference/glossary.md +++ b/docs/embedded/reference/glossary.md @@ -1,7 +1,7 @@ --- title: Glossary description: Concise definitions of common SharePoint Embedded terms and concepts. -ms.date: 06/25/2026 +ms.date: 07/21/2026 ms.reviewer: pemtaira ms.author: mawin ms.localizationpriority: high @@ -30,7 +30,7 @@ next: ../plan/choose-app-model.md | Multitenant app | An application model intended for use across customer tenants, commonly for independent software vendor (ISV) scenarios. See [choose an app model](../plan/choose-app-model.md). | | Standard billing | A billing model where consumption charges are billed to the tenant that owns or develops the application. See [choose a billing model](../plan/choose-billing-model.md). | | Pass-through (customer) billing | A billing model where consumption charges are billed directly to the consuming tenant registered to use the app. See [choose a billing model](../plan/choose-billing-model.md). | -| Owning application | The Microsoft Entra ID application registration strongly coupled with a container type; each owning app can own one container type at a time. See [app architecture](../plan/app-tenant-architecture.md). | +| Owning application | The Microsoft Entra ID application registration strongly coupled with a container type; each owning application owns exactly one container type. See [app architecture](../plan/app-tenant-architecture.md). | | Partition | The API-only SharePoint storage partition created in a consuming tenant for SharePoint Embedded app documents. See [SharePoint Embedded overview](../overview.md). | ## Related resources diff --git a/docs/embedded/reference/powershell.md b/docs/embedded/reference/powershell.md index dc3418f65..93f3c8661 100644 --- a/docs/embedded/reference/powershell.md +++ b/docs/embedded/reference/powershell.md @@ -1,7 +1,7 @@ --- title: PowerShell reference description: Reference for SharePoint Online PowerShell cmdlets used to administer SharePoint Embedded. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -57,7 +57,7 @@ For task guidance, see [manage containers with PowerShell](../admin/manage-conta Deleted containers can be restored from the deleted container collection within 93 days. Permanently deleting a container deletes all documents and files in it. If a container was in the archived state when it was deleted, restoring it returns it to the archived state. > [!NOTE] -> To enumerate Microsoft Loop containers, use owning app ID `a187e399-0c36-4b98-8f04-1edc167a0996`. +> To enumerate Microsoft Loop containers, use the owning application ID `a187e399-0c36-4b98-8f04-1edc167a0996`. ## Related resources diff --git a/docs/embedded/reference/troubleshooting.md b/docs/embedded/reference/troubleshooting.md index e454a84a8..9b20ad3da 100644 --- a/docs/embedded/reference/troubleshooting.md +++ b/docs/embedded/reference/troubleshooting.md @@ -1,7 +1,7 @@ --- title: Troubleshooting -description: Common SharePoint Embedded setup, auth, billing, Office, search, webhook, and admin issues. -ms.date: 07/09/2026 +description: Common SharePoint Embedded setup, authentication, billing, Office, search, webhook, and administration issues. +ms.date: 07/21/2026 ms.reviewer: pemtaira ms.author: mawin ms.localizationpriority: high @@ -27,7 +27,7 @@ Use this reference to identify likely causes and fixes. For end-to-end setup, se | Standard container type billing setup fails with `SubscriptionNotRegistered`. | `Microsoft.Syntex` isn't registered as a resource provider in the subscription. | Wait 5-10 minutes after the cmdlet sends the registration request, then retry. Ensure the admin has Owner or Contributor permissions on the Azure subscription. | [Choose a billing model](../plan/choose-billing-model.md) | | Access denied when calling container or file APIs. | The container type hasn't been registered in the consuming tenant, or the application lacks container type application permissions. | Grant admin consent, call the container type registration API, and verify delegated or app-only permissions include the required operations. | [Create and manage containers](../build/create-manage-containers.md) | | Delegated API calls return `403 Forbidden` when listing containers. | The signed-in user doesn't have a OneDrive. The List containers operation on behalf of a user requires the user to have a OneDrive. | Use app-only mode for list containers, or ensure the user has a OneDrive until this dependency is removed. | [Create and manage containers](../build/create-manage-containers.md) | -| Pass-through app users can't create new containers (or can't use the app before billing is first configured). | Pass-through billing hasn't been configured, SharePoint Embedded was turned off, or the linked Azure subscription was disconnected. A Global Administrator must set up billing in the Microsoft 365 admin center. | Have a Global Administrator configure pay-as-you-go services for SharePoint Embedded in the Microsoft 365 admin center and confirm the Azure subscription remains linked. Existing containers stay accessible while billing is misconfigured or disconnected. | [Monitor usage, billing, and cost](../admin/monitor-usage-billing-cost.md) | +| Pass-through app users can't access the app before billing is configured. | Pass-through billing hasn't been configured, SharePoint Embedded was turned off, or the linked Azure subscription was disconnected. A Global Administrator must set up billing in the Microsoft 365 admin center. | Have a Global Administrator configure pay-as-you-go services for SharePoint Embedded in the Microsoft 365 admin center and confirm the Azure subscription remains linked. Existing containers stay accessible while billing is misconfigured or disconnected. | [Monitor usage, billing, and cost](../admin/monitor-usage-billing-cost.md) | | Office documents open but mentions don't resolve expected users. | Mentions require target users to have a Microsoft 365 license and are restricted to people inside the consuming tenant organization. | Assign the required Microsoft 365 license to internal target users; don't expect guest or cross-tenant users in the mentions picker. | [Manage files](../build/manage-files.md) | | Search returns unexpected containers or content. | Microsoft Search runs in the context of the signed-in user and can return content the user can access unless scoped. | Include `ContainerTypeId` or `ContainerId` in the query string. If discoverability is disabled, set `includeHiddenContent` to `true` as described in [Build search experiences](../build/search-containers-files.md). | [Build search experiences](../build/search-containers-files.md) | | Search API calls fail because of permissions. | Search scenarios require delegated Microsoft Graph permissions during preview, including `Files.Read.All` in addition to `FileStorageContainer.Selected`. | Request and consent to the required delegated permissions and retest with a signed-in user. | [Build search experiences](../build/search-containers-files.md) | diff --git a/docs/embedded/scenarios-and-use-cases.md b/docs/embedded/scenarios-and-use-cases.md index 68242ecd3..5d630c9e3 100644 --- a/docs/embedded/scenarios-and-use-cases.md +++ b/docs/embedded/scenarios-and-use-cases.md @@ -1,7 +1,7 @@ --- title: Scenarios and use cases description: Explore scenarios and use cases for SharePoint Embedded. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: stpuceli ms.localizationpriority: high ai-usage: ai-assisted @@ -46,9 +46,9 @@ This pattern also suits business-critical or time-sensitive processes. SharePoin ### Description -When you build on SharePoint Online directly, a user with permissions can still open the underlying site without awareness from your application. Depending on their permission level, that user might change site settings or take other actions your application didn't intend. Those actions can have unintended consequences for your application or content. +When you build on SharePoint Online directly, a user with permissions can still open the underlying site outside your application. Depending on their permission level, that user might change site settings or take other actions your application didn't intend. Those actions can have unintended consequences for your application or content. -SharePoint Embedded is headless, so your custom application provides the only interface. If your application doesn't expose a way to change content or settings, a user can't bypass it through SharePoint Online. You decide which collaborative features, such as sharing, your application offers. +SharePoint Embedded has no standalone end-user interface, so your custom application provides the only interface. If your application doesn't expose a way to change content or settings, a user can't bypass it through SharePoint Online. You decide which collaborative features, such as sharing, your application offers. ### Examples @@ -77,7 +77,7 @@ SharePoint Embedded supports this scenario. The users of your application don't ### Why use SharePoint Embedded instead of SharePoint Online? -- You must segregate this data from the rest of your Microsoft 365 storage, yet keep it in scope for compliance tools like eDiscovery. +- You must segregate this data from the rest of your Microsoft 365 storage, yet keep it in scope for compliance tools like [eDiscovery](admin/apply-security-compliance-controls.md#apply-ediscovery). - Users need no Microsoft 365 licensing, and you avoid adding external users to SharePoint Online. - Containers give you a simple, flexible unit of data storage. diff --git a/docs/embedded/sharepoint-embedded-documentation.md b/docs/embedded/sharepoint-embedded-documentation.md index a7f8d8e82..8dbe1430e 100644 --- a/docs/embedded/sharepoint-embedded-documentation.md +++ b/docs/embedded/sharepoint-embedded-documentation.md @@ -1,7 +1,7 @@ --- title: SharePoint Embedded documentation description: Task-based index for SharePoint Embedded. Find the right page by what you're trying to do, whether you build apps or administer them. -ms.date: 07/13/2026 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.author: mawin ms.localizationpriority: high @@ -12,7 +12,7 @@ ai-usage: ai-assisted **Applies to:** All -SharePoint Embedded is a cloud-based, API-only file and document management platform built on Microsoft 365. Developers embed Office collaboration, Microsoft Purview compliance, and Copilot into their own apps — while documents stay inside each customer's Microsoft 365 tenant. +SharePoint Embedded is a cloud-based, API-only file and document management platform built on Microsoft 365. You can embed Office collaboration, Microsoft Purview compliance, and Copilot into your own apps while documents stay inside each customer's Microsoft 365 tenant. This page is organized by **task**. Find what you're trying to do and go straight to the page that does it. A machine-readable index is available in this folder as `llms.txt`. @@ -28,7 +28,7 @@ next: overview.md ## Choose a task path -Most tasks start from a build, publish, administer, govern, or planning path. Use the table to choose the path that matches your role and goal: +Most tasks start from a build, publish, administer, govern, or plan path. Use the table to choose the path that matches your role and goal: | You are… | You want to… | Start at | |---|---|---| diff --git a/docs/embedded/whats-new.md b/docs/embedded/whats-new.md index 728d4598c..750301374 100644 --- a/docs/embedded/whats-new.md +++ b/docs/embedded/whats-new.md @@ -1,7 +1,7 @@ --- -title: What's new in SharePoint Embedded? +title: What's new in SharePoint Embedded description: Updates about Microsoft SharePoint Embedded. -ms.date: 06/04/2025 +ms.date: 07/21/2026 ms.reviewer: dilucesr ms.localizationpriority: high ai-usage: ai-assisted @@ -57,7 +57,7 @@ next: overview.md ## November 2025 -- [SharePoint Embedded](./overview.md) is now available in [Microsoft 365 GCC](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc) (not yet GCC High or DoD) for US Government customers. For more information, see [Microsoft Graph national cloud deployments](/graph/deployments). +- [SharePoint Embedded](./overview.md) is now available in [Microsoft 365 Government Community Cloud (GCC)](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc) (not yet Government Community Cloud High (GCC High) or Department of Defense (DoD)) for US Government customers. For more information, see [Microsoft Graph national cloud deployments](/graph/deployments). - [SharePoint Embedded migration](/graph/api/resources/sharepointmigration-api-overview) APIs are now available in the v1.0 Microsoft Graph endpoint. ## October 2025 @@ -83,7 +83,7 @@ next: overview.md ## May 2025 -- The default limit for container types that a partner tenant can create is now 25. For more information, see [Limits and Calling Patterns](./plan/limits-calling-patterns.md#size-limits). -- The SharePoint Embedded agent switched to a consumption-based model for all users, whether they have a Copilot license. For more information, see [SharePoint Embedded agent](./build/agent-experiences.md). +- The default limit for container types that a developer tenant can create is now 25. For more information, see [Limits and Calling Patterns](./plan/limits-calling-patterns.md#size-limits). +- The SharePoint Embedded agent switched to a consumption-based model for all users, regardless of whether they have a Copilot license. For more information, see [SharePoint Embedded agent](./build/agent-experiences.md). - The guidance for granting admin consent to a SharePoint Embedded application now uses URL-based admin consent. For more information, see [Grant admin consent](./build/register-application-permissions.md#grant-admin-consent). - Documented an exceptional access pattern for operations that may require a user license. For more information, see [Handle operations not exposed through Graph](./build/configure-authentication-authorization.md#handle-operations-not-exposed-through-graph).