Skip to content

docs: Document container type owner capabilities in SPE auth page#10751

Open
gnjoseph wants to merge 1 commit intoSharePoint:mainfrom
gnjoseph:grjoseph/spe-auth-ct-owner-capabilities
Open

docs: Document container type owner capabilities in SPE auth page#10751
gnjoseph wants to merge 1 commit intoSharePoint:mainfrom
gnjoseph:grjoseph/spe-auth-ct-owner-capabilities

Conversation

@gnjoseph
Copy link
Copy Markdown
Contributor

@gnjoseph gnjoseph commented Apr 1, 2026

Category

  • Content fix
  • New article

What's in this Pull Request?

Documents the shipped container type owner capabilities in the SharePoint Embedded authentication and authorization page:

  • Added Container type owner capabilities section under 'Managing SharePoint Embedded applications created in the owning tenant'
  • Documents the permissions navigation property on fileStorageContainerType (roles: owner, grantedToV2)
  • Documents how owners are managed: automatic assignment on create, POST to add (max 3), DELETE to remove, GET with expand or list permissions
  • Documents owner operations: CRUD on owned CTs, permissions management, container creation (delegated only)
  • Added cross-tenant caveat: owners are NOT propagated to consuming tenants
  • Added intersection model callout (app permissions x user permissions)
  • Added FSCTR.Selected removal guidance after container type registration (per Diego's recommendation to treat registration scopes as setup-time-only)

@learn-build-service-prod
Copy link
Copy Markdown
Contributor

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

@learn-build-service-prod
Copy link
Copy Markdown
Contributor

Learn Build status updates of commit eba7abc:

✅ Validation status: passed

File Status Preview URL Details
docs/embedded/development/auth.md ✅Succeeded View

For more details, please refer to the build report.

@gnjoseph gnjoseph force-pushed the grjoseph/spe-auth-ct-owner-capabilities branch from eba7abc to 875ea76 Compare April 1, 2026 20:51
@learn-build-service-prod
Copy link
Copy Markdown
Contributor

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

@learn-build-service-prod
Copy link
Copy Markdown
Contributor

Learn Build status updates of commit 875ea76:

✅ Validation status: passed

File Status Preview URL Details
docs/embedded/development/auth.md ✅Succeeded View

For more details, please refer to the build report.

@gnjoseph gnjoseph force-pushed the grjoseph/spe-auth-ct-owner-capabilities branch from 875ea76 to a347add Compare April 1, 2026 20:54
@learn-build-service-prod
Copy link
Copy Markdown
Contributor

Learn Build status updates of commit a347add:

✅ Validation status: passed

File Status Preview URL Details
docs/embedded/development/auth.md ✅Succeeded View

For more details, please refer to the build report.

@learn-build-service-prod
Copy link
Copy Markdown
Contributor

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

@gnjoseph gnjoseph force-pushed the grjoseph/spe-auth-ct-owner-capabilities branch from a347add to fc0d26f Compare April 1, 2026 21:08
@learn-build-service-prod
Copy link
Copy Markdown
Contributor

Learn Build status updates of commit fc0d26f:

✅ Validation status: passed

File Status Preview URL Details
docs/embedded/development/auth.md ✅Succeeded View

For more details, please refer to the build report.

@learn-build-service-prod
Copy link
Copy Markdown
Contributor

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.


[SharePoint Embedded Administrators](/entra/identity/role-based-access-control/permissions-reference#sharepoint-embedded-administrator) can manage all SharePoint Embedded applications created in the **owning** tenant. Additionally, any Microsoft Entra user that isn't an external identity can be assigned as an owner of a [container type](/graph/api/resources/filestoragecontainertype). Container type owners can manage that specific container type. To learn more about managing applications created in the owning tenant, see [SharePoint Embedded developer administrator](../administration/developer-admin/dev-admin.md).

##### Container type owner capabilities
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image

This was feedback given to me on this same article :)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using H4 instead


##### Container type owner capabilities

Container type owners are managed through the [permissions](/graph/api/filestoragecontainertype-post-permissions) navigation property on the `fileStorageContainerType` resource. Each permission entry has a role of `owner` and identifies the user via `grantedToV2`. Owners can be managed in the following ways:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit. Generally, a resource name is bolded instead if it's not linked. So like fileStorageContainerType or fileStorageContainerType.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated to be linked

- Add container type owner capabilities subsection under owning tenant management
- Document permissions navigation property (roles: owner, grantedToV2)
- Document owner CRUD, permissions management, and container creation capabilities
- Add cross-tenant caveat: owners are NOT propagated to consuming tenants
- Add intersection model callout (app permissions x user permissions)
- Add auto-assignment of creator as owner and guest user exclusion
@gnjoseph gnjoseph force-pushed the grjoseph/spe-auth-ct-owner-capabilities branch from fc0d26f to 8c33550 Compare April 2, 2026 21:39
@learn-build-service-prod
Copy link
Copy Markdown
Contributor

Learn Build status updates of commit 8c33550:

✅ Validation status: passed

File Status Preview URL Details
docs/embedded/development/auth.md ✅Succeeded View

For more details, please refer to the build report.

@learn-build-service-prod
Copy link
Copy Markdown
Contributor

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants