|
| 1 | +--- |
| 2 | +title: Install your SharePoint Embedded application for customers. |
| 3 | +description: Seamlessly install your SharePoint Embedded application on your customers' tenant. |
| 4 | +ms.date: 10/08/2025 |
| 5 | +ms.localizationpriority: medium |
| 6 | +--- |
| 7 | + |
| 8 | +# Install your SharePoint Embedded application for customers |
| 9 | + |
| 10 | +This guide provides instructions for developers looking to get their SharePoint Embedded (SPE) app installed on a Microsoft 365 consuming tenant. |
| 11 | + |
| 12 | +## Prerequisites |
| 13 | + |
| 14 | +This guide assumes that you created a SharePoint Embedded container type and developed your application. Learn more about [container types](../../getting-started/containertypes.md). |
| 15 | + |
| 16 | +The consuming tenant can be any Microsoft 365 tenant (including your own), but it must have at least one SharePoint license. |
| 17 | + |
| 18 | +## Overview |
| 19 | + |
| 20 | +Developers looking to get their SharePoint Embedded app installed on a tenant have a few tasks to complete: |
| 21 | + |
| 22 | +- Get the required admin permission grants for your app on the consuming tenant |
| 23 | +- Register your app's container type on the consuming tenant |
| 24 | +- Ensure your customer’s tenant completed [SharePoint Embedded pay-as-you-go billing setup](../../administration/consuming-tenant-admin/cta.md#set-up-billing-for-pass-through-app) if your container type is [configured for pass-through billing](../../administration/billing/billing.md#pass-through) |
| 25 | + |
| 26 | +### Application permissions to request |
| 27 | + |
| 28 | +Your app needs a minimum set of Microsoft Graph permissions to be installed on a consuming tenant. For more information, see [SharePoint Embedded authentication and authorization](../auth.md). |
| 29 | + |
| 30 | +1. [`FileStorageContainerTypeReg.Selected`](/graph/permissions-reference#filestoragecontainertyperegselected) delegated or application permission to register the SPE container type in the consuming tenant. When your app uses the delegated permission, the user performing the container type registration must be a [SharePoint Embedded Admin](/entra/identity/role-based-access-control/permissions-reference#sharepoint-embedded-administrator) or [Global Admin](/entra/identity/role-based-access-control/permissions-reference#global-administrator). The application permission requires admin consent, but the delegate permission doesn't require admin consent. |
| 31 | +1. [`FileStorageContainer.Selected`](/graph/permissions-reference#filestoragecontainerselected) delegated or application permission to interact with SharePoint Embedded content for the container type in the consuming tenant. This permission requires admin consent. |
| 32 | + |
| 33 | +> [!IMPORTANT] |
| 34 | +> Using SharePoint Embedded on behalf of a user is the recommended approach. This type of access enhances the security of your application. It also improves the auditability of actions performed by your application. |
| 35 | +
|
| 36 | +### Request admin consent |
| 37 | + |
| 38 | +Single-tenant apps (when the app is registered and is used in the same tenant) can benefit from getting admin consent from the Microsoft Entra directory administrator in a simplified manner. [Construct the admin consent URL](/entra/identity-platform/v2-admin-consent#request-the-permissions-from-a-directory-admin) and provide it to your Microsoft Entra directory administrator for them to grant admin consent. For example: |
| 39 | + |
| 40 | +```http |
| 41 | +https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id={client_id}&redirect_uri={redirect_uri} |
| 42 | +``` |
| 43 | + |
| 44 | +> [!NOTE] |
| 45 | +> Make sure your app's [redirect URI](/entra/identity-platform/reply-url) can [handle admin consent flows](/entra/identity-platform/v2-admin-consent#successful-response). |
| 46 | +
|
| 47 | +## In-app installation experience (recommended) |
| 48 | + |
| 49 | +You can facilitate the installation of your SharePoint Embedded app within your own app experience. We recommended that you use the [Microsoft Authentication Library (MSAL)](/entra/identity-platform/msal-overview) to handle all authorization steps. Here's the high-level process: |
| 50 | + |
| 51 | +1. Provide a [sign-in experience in your app](/entra/identity-platform/quickstart-web-app-sign-in) and obtain an [ID token](/entra/identity-platform/id-tokens) for the user |
| 52 | +1. Inspect and [validate the token](/entra/identity-platform/claims-validation) to extract the tenant ID and roles assigned to the user |
| 53 | +1. Determine if your app is already installed on the tenant |
| 54 | + 1. Request a Microsoft Graph access token with `FileStorageContainerTypeReg.Selected` application permission |
| 55 | + 1. Try to [get the registration for your container type](/graph/api/filestoragecontainertyperegistration-get). If your container type is already registered in the consuming tenant, you're done! |
| 56 | +1. Determine if the user has either the [Privileged Role Administrator](/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator) or [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator) roles by validating the `wids` claim in the ID token. |
| 57 | + 1. If the user isn't a Privileged Role Admin or Global Admin, it's unlikely that they can provide admin consent in the following steps. |
| 58 | +1. [Request admin consent](#request-admin-consent) for your app by navigating the user to the admin consent URL. |
| 59 | + 1. Ensure your app's redirect URI can handle this redirection appropriately so you can proceed with the next steps within the app experience. |
| 60 | +1. Once admin consent is granted, request a Microsoft Graph access token with `FileStorageContainerTypeReg.Selected` application permission |
| 61 | +1. [Create your container type registration](/graph/api/filestorage-post-containertyperegistrations) on the consuming tenant |
| 62 | +1. If your container type is [configured for pass-through billing](../../administration/billing/billing.md#pass-through), you should make a billable API call to confirm that billing is set up. For example, [create a container](/graph/api/filestoragecontainer-post). |
| 63 | + 1. If the call fails with a billing error, point the user to [set up SharePoint Embedded pay-as-you-go billing](../../administration/consuming-tenant-admin/cta.md#set-up-billing-for-pass-through-app). |
0 commit comments