My Tasks Overview
My Tasks collects your tasks from several Microsoft 365 services and, optionally, from Azure DevOps. To do that it needs access to those services, and this access is requested in the standard way for SharePoint Framework solutions: the solution package declares the API permissions it needs, and a tenant administrator approves them once for the whole tenant.
This article lists the permissions, explains how to approve them, describes whose rights are used when the data is read, and states what the web part stores and where. It is intended for tenant administrators, security officers and site owners who must answer the question "What does this web part do with our data?".
Requested permissions
The solution package contains two web parts, My Tasks and Azure DevOps Query. Together they request the following API permissions:
| API | Permission | What it is used for |
|---|---|---|
| Microsoft Graph | User.Read | Basic information about the signed-in user. |
| Microsoft Graph | User.ReadBasic.All | Resolving the display names of the authors of Planner tasks, so that the Author column shows a name instead of an identifier. |
| Microsoft Graph | Tasks.ReadWrite | Reading the tasks assigned to the user in Microsoft Planner, Microsoft To Do and the flagged e-mail list (the Outlook source). |
| Azure DevOps | user_impersonation | Calling the Azure DevOps REST API on behalf of the signed-in user. Needed for the Azure DevOps source of My Tasks and for the Azure DevOps Query web part. |
All of these are delegated permissions: they work only in the context of a signed-in user and never give the web part rights of its own beyond what that user already has.
📝 Note
You need to approve a permission only when you use the matching data source. The SharePoint and Project sources do not need any Graph or Azure DevOps permission. However, the permission requests belong to the solution package, so they are shown in SharePoint admin center together, and it is simplest to approve all of them.
How a tenant administrator approves the permissions
After the solution has been added to the App Catalog and deployed (see KB10035. How to Install a Vitextra Product in SharePoint Online), the permission requests wait for approval. To approve them:
- Sign in to the Microsoft 365 admin center with an account that has the SharePoint Administrator or Global Administrator role, and open SharePoint admin center.
- In the left navigation, expand Advanced and select API access.
- On the Pending requests tab, find the requests from the Vitextra My Tasks package: Microsoft Graph (User.Read, User.ReadBasic.All, Tasks.ReadWrite) and Azure DevOps (user_impersonation).
- Select a request and choose Approve. Confirm the dialog. Repeat for every request.
- Switch to the Approved requests tab to check that all of them are listed.
Users do not see a consent prompt for these permissions. After the approval the web part works for all users of the tenant. If you update the solution later and the new version needs additional permissions, they appear again on the Pending requests tab; see KB10050. How to Update a Vitextra SPFx Solution in SharePoint Online.
❗ Important
An approved permission applies to all SharePoint Framework solutions in the tenant, not only to My Tasks. Review the Approved requests tab regularly, as you would for any other solution. If a permission is rejected or not yet approved, the corresponding source returns no tasks, and the Azure DevOps sources show an error about the access token or consent.
Whose rights are used
Nothing in My Tasks runs with elevated or shared service rights. Every call is made from the user's browser in the context of the signed-in user:
- Planner, To Do and Outlook – the tasks are requested from Microsoft Graph for the current user ("my tasks"). A person never sees the tasks of colleagues.
- SharePoint and Project – the tasks are found with the SharePoint Search REST API in the context of the current user. Security trimming applies: search returns only the items the user is allowed to open.
- Azure DevOps – the Azure DevOps REST API is called as the signed-in user, so the user sees only what he or she can already see in Azure DevOps. Changes made with the quick actions of the Azure DevOps Query web part need edit rights in Azure DevOps and are recorded in the work item history under the user's name.
The web part does not change your tasks
The My Tasks web part only reads tasks. It does not create, edit, complete or delete tasks in Planner, To Do, Outlook, SharePoint, Project Online or Azure DevOps. The permission name Tasks.ReadWrite is the name of the scope in Microsoft Graph that covers Planner, To Do and flagged e-mail tasks; the web part uses it for reading only.
The only feature that can write data is optional: the Quick actions of the Azure DevOps Query web part (change state, assign, set a due date, add a comment). They are turned off by default and work only with the rights of the user in Azure DevOps. See KB10306. Azure DevOps Query Viewer: Quick Actions (Change State, Assign, Set Due Date, Add Comment).
What is stored and where
- On Vitextra servers – no task data is stored. The tasks are loaded by the browser directly from Microsoft 365 or Azure DevOps and are displayed in the page.
- In the browser (localStorage) – personal view settings of each user: sort column and direction, the Due Date quick filter and the filter selections of My Tasks, and, for the Azure DevOps Query web part, the chosen columns and grouping of each query. The settings are kept per web part instance in the browser and on the device where they were made; they are not synchronized between devices and are removed when the browser data is cleared.
- In the browser (sessionStorage) – the last loaded list of tasks of My Tasks is kept for the current browser tab session for up to 15 minutes, so that the list appears instantly the next time; it is used only while the data source configuration is unchanged and is refreshed in the background. The cache disappears when the tab is closed.
- In SharePoint – the web part settings (data sources, columns, limits and so on) are stored in the properties of the web part on the page, like any other SharePoint web part.
💡 Tip
On a shared computer, clear the browser data of the SharePoint site (or use a private window) after work: this removes the cached task list and the personal view settings. See also KB10293. My Tasks: Filtering, Sorting and Personal View Settings.
Telemetry and licensing
Like other Vitextra products, My Tasks checks the license of your tenant and reports usage of the web part. The license check reports the tenant and the license state, which are shown in the About group of the property pane (Trial version, Active, Expired, Suspended, Canceled). The telemetry and the license check do not store the content of your tasks on Vitextra servers. For purchasing and activation, see KB10206. Vitextra Licensing and Account: How to Buy and Activate a License.
The product also works in Microsoft Teams in the same security model; see KB10301. How to Add My Tasks to Microsoft Teams.
If the permissions are approved and tasks are still missing, go to KB10307. Why Are My Tasks Missing or Not Loading?.
