Install Sharelio in your Microsoft 365

What exactly you're installing

A single SPFx package. It is not a code generator: it's a rendering engine that draws components from declarative JSON configurations.

That means the package you approve today is the same one that will be running a year from now, even if your team creates fifty components along the way. What changes is the configuration, not the code.

What that JSON can describe is bounded by a closed, auditable schema: which list to read, which columns to show, how to format them and how to filter them. The JSON cannot contain code, evaluable expressions, HTML, or arbitrary URLs. If you want to verify that before approving, ask us for the schema at hello@sharelio.com and we'll send it to you.

Step 1 — Deploy the package

1. Open your tenant's App Catalog (https://<your-tenant>-admin.sharepoint.com → More features → Apps).
2. Upload sharelio-host.sppkg to the Apps for SharePoint library.
3. In the dialog, tick “Make this solution available to all sites in the organization”. This deploys it once and makes it available everywhere — no need to add the app site by site.
4. Deploy.

Step 2 — Approve the permission

Deploying the package registers an API permission request that you have to approve.

1. SharePoint admin center → Advanced → API access.
2. You'll see a pending request:

Then Approve.

What you're approving, specifically

You're allowing the Sharelio web part, running inside your tenant, to ask Entra ID for a token for the Sharelio API.

• It's a delegated permission: it acts on behalf of whoever opens the page, with their exact limits. An employee who can't access a SharePoint list won't see it through Sharelio either.
• It's read-only, and only over the configuration of the components your own organisation has published. It grants no access to your documents, your mail, your lists or your directory.
• There is no secret to look after. Sharelio does not store credentials for your tenant: it only verifies the signatures Microsoft issues.

Where your data lives

In your tenant. Your tools' data lives in your SharePoint lists, where it already was. Sharelio does not copy it, does not store it and never sees it go past: the web part reads it straight from your SharePoint, from your employee's browser.

The only thing Sharelio keeps in its backend is the components' configuration — which list to read and how to draw it — not its contents.

What Sharelio can write in your SharePoint

Sharelio does write in your tenant: it creates the list a tool needs, and its components can open SharePoint's own new-item form so people can add records.

It's worth knowing exactly how, because the guarantee is not “we don't write”. It's this other one, which is stronger:

Sharelio has no identity of its own inside your SharePoint. Everything it does, it does as the person sitting in front of the screen, with their permissions.

There is no “Sharelio app” with permissions over your sites. We have not requested — and will not request — Microsoft Graph permissions over your lists. If the person using the component can't write to that list, SharePoint tells them no, exactly as if they had gone to the list and pressed “New”.

When someone places a component on a page and the list it needs doesn't exist yet, the web part says so and offers a button to create it. Pressing it creates the list with that person's own SharePoint session, exactly as if they had created it by hand.

• If that person can't create lists on that site, neither can Sharelio. There's no privilege escalation: SharePoint will say no, just as it would if they tried by hand. Your site permissions still have the last word.
• It never happens by surprise. Before anything is created, the full list of columns is shown and a button has to be pressed. It only happens in page edit mode: someone merely viewing a page never triggers a write.
• Nothing is ever destroyed. If the list exists, it's reused. If columns are missing, they're added. If a column exists with the same name and a different type, it stops and warns — it doesn't convert or overwrite, because someone's data may be in there.

If you want to prevent it entirely, you don't need to uninstall anything: just don't grant edit permissions on the site. Without them nobody can place a web part, and without placing it there's nothing to create.

How to revoke it

• Remove the permission: SharePoint admin center → Advanced → API access → select Sharelio → Remove.
• Retire the package: delete it from the App Catalog.

Components stop rendering immediately. Your lists and their data are untouched, because they never left your tenant.

Turning off one component without touching any of this

If what you want is to switch off one component (not the whole installation), IT doesn't need to get involved: it can be disabled centrally from Sharelio's governance panel, and it stops rendering on every page it was placed on.

The panel also records who created each component and when.