Questions & Answers Overview
Questions and Answers is a SharePoint Framework web part that stores everything in a SharePoint list of your own site and reads and writes it with the rights of the signed-in user. That single fact answers most security questions, but the details matter when you decide who may ask, who may publish and what leaves the tenant. This article is the reference for those decisions.
Summary for administrators
| Question | Answer |
|---|---|
| Which API permissions does the package request? | None |
| Whose identity is used? | The signed-in user, for every read and write |
| Where are questions, answers, attachments and comments stored? | In one SharePoint list on the site where the web part runs |
| Does the web part store anything elsewhere? | No — not on Vitextra servers and not in the browser |
| Who can read the knowledge base? | Everybody with Read on the list (and the page) |
| Who can ask a question? | Users with the Add Items permission on the list |
| Who can publish answers? | Users who can edit items of the list |
| What is sent to Vitextra? | Technical identifiers for the license check and usage telemetry; no content |
| Third-party services? | Only YouTube or Vimeo players, when an editor puts such a link into a question |
Permissions of the solution
- The package requests no API permissions: nothing appears on the API access page of the SharePoint admin center, and the web part never calls Microsoft Graph.
- The web part uses the SharePoint REST API of the current site to read lists, items, attachments and comments, to create the list and its columns, to add a question and to add a comment. Every call carries the identity of the signed-in user; SharePoint applies its permissions to each one.
- The live profile card of the contact person and of mentioned users is the standard SharePoint component, loaded from SharePoint itself.
The list
The web part creates (or connects to) a custom list with the columns described in KB10382. Questions and Answers Web Part Settings Reference. It is an ordinary list in Site contents:
- it inherits the permissions of the site unless you break the inheritance;
- it is covered by the retention, eDiscovery, audit and backup of your tenant like any list;
- versioning can be enabled in the list settings to keep the history of answers;
- it is created with NoCrawl set, so its items do not appear in SharePoint search results or in Microsoft 365 search — the web part has its own search. If you want the questions to be found by the global search, clear Allow items from this list to appear in search results → Yes in List settings → Advanced settings;
- deleting the web part from a page does not delete the list; deleting the list deletes the questions, their attachments and comments (recoverable from the recycle bin for the usual period).
The web part's own settings — the connected list, the switches, sort and page size — are stored in the web part properties of the page.
Who can do what
Three roles follow from the SharePoint permission levels on the list:
| Role | Needs | Can |
|---|---|---|
| Reader | Read on the list (and on the page) | Browse, search, expand answers, open attachments, follow links, copy links to questions, see comments |
| Asker | Add Items on the list — included in Contribute and Edit | Everything a reader can, plus Ask a Question and adding comments |
| Editor | Edit Items on the list — included in Contribute and Edit | Everything above, plus writing answers, setting categories, attachments, and Published = Yes |
The Ask a Question button is shown only when the web part confirms that the user has Add Items on the list; the switch in the property pane enables the feature, the permission decides who sees it. Unpublished questions are never returned to the web part, whatever the user's permissions; an editor sees them only in the list.
Letting people ask without letting them publish
Contribute lets a user add items and edit any item — including setting Published = Yes on somebody else's draft, or changing an answer. To keep publishing in the hands of the editors while everybody may ask:
- Open the list, Settings → List settings → Advanced settings.
- Under Item-level Permissions, set Create and Edit access to Create items and edit items that were created by the user.
- Give the broad audience Contribute on the list and the editors' group Edit (or make them list owners); Edit and higher are not restricted by the item-level setting.
With this setting an employee can submit a question and later edit their own submission, but cannot touch other items. The editors publish. Optionally set Read access to Read all items (the default) so that the web part can show published questions to everybody.
❗ Important
Add Items on the list implies the ability to add attachments and comments to one's own items through the SharePoint user interface, not only through the web part. Keep the list's advanced settings (attachments, comments) in line with what you want to allow.
Guests
Guest users with access to the site are readers or askers according to their permission level; the live profile cards may show less information for guests. External sharing of the page does not share the list: a person who can open the page but not the list sees an error instead of the questions.
Attachments and comments
Attachments are stored with the list item in the list's own attachment folder; they follow the item's permissions and are deleted with it. Comments are the SharePoint list comments of the item (see KB10381. Comments, @Mentions and Deep Links in Questions and Answers); they can be disabled for the list in Advanced settings → Comments.
What is sent outside the tenant
| Purpose | What is sent | Where |
|---|---|---|
| License check | The Tenant ID, the object ID of the user, the site address, the identifier, name and version of the product | vitextra.com |
| Usage telemetry | An event when the web part loads (product and version, site ID and address, the object ID of the user, the interface language, whether the web part runs in Teams) and technical details of errors | Azure Application Insights |
| Product files | An ordinary request for the scripts and icons of the web part | static.vitextra.com, vitextra-storage.azureedge.net |
| Video players | When a question has a YouTube or Vimeo address and Video is shown: the browser loads the player from youtube.com or player.vimeo.com, which see the ordinary request of the user's browser | YouTube, Vimeo |
| File-type icons | Icons for attachment cards, loaded from Microsoft's CDN | static2.sharepointonline.com |
No question, answer, attachment or comment is sent to Vitextra or to any third party. The complete picture across Vitextra products is in KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR.
📝 Note
If your organization does not allow content from YouTube or Vimeo on the intranet, keep Video on Hide or use videos stored in SharePoint — a direct link to an .mp4 file in a document library plays in the browser's own player without any external request.
Reporting and export
Because the content is a list, the standard tools apply: Export to Excel from the list command bar, a Power BI report on the list (for example, questions per category, unanswered submissions by age), a Power Automate flow that notifies the editors when a question is submitted (trigger When an item is created with Published = No), and list alerts for the same purpose.
