Product / Knowledge Base / 10. How the App Works

10. How the App Works

User & Administration Guide — Version 1.0.0.24

Guide summary

Permissions Manager 365 is a client-side web part. It reads and changes SharePoint as the signed-in user.

On this page

Where it runs

Publisher: Chronodat LLC. Version 1.0.0.24. The web part runs on a modern SharePoint page, as a SharePoint full-page app, as a Teams channel tab, and as a Teams personal app. It does not include SharePoint Framework extensions, and it does not keep a server of its own for permission data.

Routing is a hash path on the host page, so the SharePoint or Teams URL stays put. An unknown hash opens Overview and says the address is not a page in the app.

Two lists on the host site

Setup creates two hidden lists. They are not on the quick launch, and search is off by default.

  • PM365Settings holds one note field, SettingsJson: product name, company, subline, support email, appearance, language, app admins (at most 40), the license key, and the inspection progress counts.
  • PM365Sites holds one row per site: URL, title, parent URL, discovery source (manual, csv, host, or search), inspection status, inheritance, sharing capability, and related summary fields.

After setup, both lists break role inheritance. The owners group receives Full Control. Each saved app admin receives Edit. Every other role assignment on those lists is removed. A caller who cannot manage permissions gets a refusal and the lists stay as they are.

What stays in the browser

Role assignments, principals, list objects, administrators, and group membership are not written to either list. They live in the browser for the session. Closing the browser drops assignments, objects, and the operation log. The catalog keeps only the inspection summary.

Inspection calls the target web as the signed-in user. A site the account cannot read becomes requiring access. A missing site becomes failed. The scan records a limit when SharePoint returns more role assignments, lists, or admins than the pass kept.

Writes that need a request digest take it from the target web. A security-validation failure refreshes the digest and retries once. Bulk changes and inheritance changes are planned in the browser, then applied one target at a time.

What stays out

  • No permission warehouse.
  • No elevation. The app never grants site collection administrator.
  • No expansion of nested groups, Azure AD groups, or Microsoft 365 group membership.
  • No crawl of a library for sharing links or unique items. Those reads are one item, or one page, when the user asks.
  • No tenant audit log and no restorable backup.