Deploying an .sppkg without being a global administrator
Last updated:
Yes, you can. Uploading an .sppkg to the tenant App Catalog and deploying it requires the SharePoint Administrator role, not Global Administrator. Approving the API permission requests that come with the package is done in the SharePoint admin center, and the SharePoint Administrator role covers that too.
This matters more than it sounds, because it is usually what stalls a deployment: the person who wants the tool asks IT, IT assumes it needs tenant-wide global admin consent, and the request goes into the queue that never moves. In most cases nobody has to touch Global Administrator at all — a role that a well-run organisation deliberately keeps to two or three people with privileged access management on top.
Which role does what
| Task | Minimum role |
|---|---|
| Create the tenant App Catalog (once, if it does not exist) | SharePoint Administrator |
| Upload the <code>.sppkg</code> to <em>Apps for SharePoint</em> | SharePoint Administrator |
| Deploy it to all sites in the organisation | SharePoint Administrator |
| Approve the package's API permission requests | SharePoint Administrator |
| Add the app to one specific site | Site owner |
| Grant tenant-wide admin consent to an Entra ID application directly | Global Administrator or Privileged Role Administrator |
The last row is the source of the confusion. Granting consent to an Entra ID app from the Entra portal is a global-admin action. But a SharePoint Framework package does not ask you to do that: it registers its permission request through SharePoint, and you approve it from SharePoint admin center → Advanced → API access, which the SharePoint Administrator role can reach.
The actual sequence
- Check the App Catalog exists. SharePoint admin center → More features → Apps. If there is no catalog, create it — one per tenant, and it only happens once in the tenant's life.
- Upload the package to the Apps for SharePoint library.
- Choose the deployment scope. The dialog offers to make the solution available to all sites in the organisation. Whether you should tick it depends on the package.
- Approve the API permissions, if the package requests any: SharePoint admin center → Advanced → API access. Read the requested scope before approving, not after.
That is the whole thing. Where organisations lose weeks is not in these four steps, which take about ten minutes: it is in the ticket, the security review and the meeting to decide who owns the decision.
When you genuinely do need a global administrator
- Assigning the SharePoint Administrator role itself. Someone with Global Administrator or Privileged Role Administrator has to grant it in the first place.
- Consenting to an Entra ID application that is not driven by a SharePoint package — a standalone SaaS product asking for Microsoft Graph permissions across your tenant, for example.
- Anything touching tenant-wide identity settings: conditional access, authentication methods, directory roles.
If a vendor tells you their SharePoint web part needs global admin consent, ask them which permission and why. Often the honest answer is that the product wants Microsoft Graph access to your data, which is a very different conversation from deploying a rendering component — and one worth having before the package is uploaded rather than after.
Frequently asked questions
Does approving API access grant the vendor access to our SharePoint data?
It depends entirely on what is being requested, which is why you should read the scope. A request for Microsoft Graph scopes such as Sites.Read.All does give broad access to your content. A request scoped to the vendor's own API only lets the web part obtain a token addressed to that vendor, which grants nothing over your tenant. Both appear in the same screen, so the name of the resource and the scope are what matter.
Can a site owner install a package without involving the SharePoint administrator?
No. A site owner can add an app to their site, but only once the package is already in the tenant App Catalog, which requires the SharePoint Administrator role. There is a site-level app catalog in some configurations, but it is disabled by default in most tenants and does not change who approves API permissions.
What if we do not have an App Catalog at all?
Then it has been never been created, which is common in tenants that have only used out-of-the-box SharePoint. A SharePoint administrator creates it from the admin center in a couple of minutes. It is a one-off for the whole tenant, not per package.
How do we review a package before deploying it?
Download it and inspect it — an .sppkg is a zip file containing the manifests and the client-side assets. The manifests declare the API permission requests, the component ids and whether the solution allows custom script. A vendor that will not let you download the package before you commit is telling you something. Sharelio publishes its package, its SHA-256 and a full permission manifest at sharelio.com/security.