SPFx Solutions & Tenant-wide API Permissions
The question it answers: Which API permissions are granted to SPFx solutions tenant-wide, and which solutions are installed?
When an admin approves an API permission requested by an SPFx solution, it is granted to the shared ‘SharePoint Online Web Client Extensibility’ app - so every SPFx solution in the tenant can use it on behalf of every user. This report lists those permissions, pending requests and the solutions deployed from the tenant app catalog.
At a glance
Section titled “At a glance”| Where in the app | SharePoint Online › SharePoint Operations & Legacy › SPFx Solutions & API Permissions |
| Workload | SharePoint Online |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | sharepoint.operations.spfx-permissions |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Item | Category | Text |
| Permission / solution | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Detail | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Sites.FullControl.All | Office 365 SharePoint Online | Have full control of all site collections | certificate PnP |
Data sources it reads
Get-PnPApp -Scope TenantGet-PnPTenantServicePrincipalPermissionGrantsGet-PnPTenantServicePrincipalPermissionRequestsGet-PnPSiteCollectionAppCatalog
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/sharepoint.operations.spfx-permissions?size=100An AI assistant reads it with the MCP tool get_report and the id sharepoint.operations.spfx-permissions. The client needs the Read grant for SharePoint Online. See Using the API.