Permissions and consent
Kameleon leverages the Microsoft Identity Platform for both user authentication and authorization. To perform its core functionalities, Kameleon requires specific delegated permissions (on behalf of the user). For a comprehensive overview of permissions and consent in the Microsoft Identity Platform, refer to the official documentation: https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview?WT.mc_id=Portal-Microsoft_AAD_RegisteredApps
Sign in permissions
All Kameleon applications require the following permissions to enable user sign-in:
Permission | Purpose |
|---|---|
Enables user authentication into Kameleon applications | |
Grants access to basic user profile information | |
Allows the application to request refresh tokens | |
Permits sign-in and access to user information |
https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#openid-connect-scopes
Admin consent
In most cases, end users cannot grant consent to external applications. Therefore, admin consent is typically required at the organizational level.
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/user-admin-consent-overview
Application specific permissions
Office
No additional mandatory permissions required.
Publish to SharePoint and OneDrive
If the Publish feature is enabled, the following optional permissions are required:
Permission | Purpose |
|---|---|
Lists Microsoft Teams when saving documents | |
Lists Teams channels when saving documents | |
List SharePoint sites, libraries and folders and saves document and metadata to the selected SharePoint location |
Teams
In addition to the sign-in permissions, the Kameleon Teams application requires:
Permission | Purpose |
|---|---|
Lists SharePoint sites when creating documents | |
Lists Microsoft Teams when creating documents | |
Lists Microsoft Teams channels when creating documents | |
Saves documents and metadata to the selected SharePoint location |
Portal
No additional mandatory permissions required.
Integrations
Optional features in the Kameleon Portal can be enabled by granting admin consent to the Kameleon API-application. These integrations also use delegated permissions.
Integration | Permission | Purpose |
|---|---|---|
Reads list items from SharePoint | ||
Reads term sets and terms from SharePoint |
Content Tool
No additional mandatory permissions required.