Password Vault Overview
Password Vault keeps each user's vault in a file in the app folder of that user's OneDrive. To read and write this file, the solution package requests exactly one Microsoft Graph permission: Files.ReadWrite.AppFolder. A tenant administrator must approve it once after the package is deployed; until then the web part cannot open or create any vault. This article explains the permission and the approval.
Why Password Vault needs the permission
The web part uses Microsoft Graph for three operations, all in the signed-in user's OneDrive app folder:
- finding the vault file vitextra-password-vault.json;
- creating it the first time the user opens Password Vault;
- reading it and saving it after every change.
Password Vault requests no other Microsoft Graph permission and needs no SharePoint list permissions: any user who can open the page can use his or her own vault.
What the permission allows and what it does not
| Aspect | Details |
|---|---|
| Permission type | Delegated: it works only on behalf of the signed-in user, never in the background and never without a user |
| Allows | Reading and writing files in the app folder of the signed-in user's own OneDrive |
| Does not allow | Reading or changing the user's other OneDrive files, other users' OneDrive, SharePoint sites, mail, calendars or directory data |
| Application (app-only) access | None; Password Vault has no service account and no background process |
📝 Note
In SharePoint Online, API permissions of SPFx solutions are granted to one Microsoft Entra ID application shared by all SPFx solutions in the tenant, SharePoint Online Web Client Extensibility. Once Files.ReadWrite.AppFolder is approved, it is available to every SPFx solution deployed in your tenant, and the app folder is the folder of that shared application. This is how the SharePoint Framework works for all vendors. Deploy only SPFx solutions that you trust; see the security notes in KB10360. How to Approve Microsoft Graph API Permissions for Vitextra Solutions in the SharePoint Admin Center.
How to approve the permission
The permission request is created when the Password Vault package is deployed to the tenant App Catalog (see KB10035. How to Install a Vitextra Product in SharePoint Online). You need the SharePoint Administrator or Global Administrator role.
1. Open the SharePoint admin center.
2. Go to Advanced > API access.
3. On the Pending requests tab, select the request of the Vitextra Password Vault package for Microsoft Graph / Files.ReadWrite.AppFolder.
4. Click Approve and confirm.
5. Check that the permission now appears on the Approved requests tab.
If Files.ReadWrite.AppFolder has already been approved for another SPFx solution, no new request appears: SharePoint reuses the existing grant. Users do not see a consent prompt; after the approval the web part works for everyone in the tenant, usually within a few minutes. If it does not, reload the page.
💡 Tip
For screenshots, PowerShell commands, partial approval, revoking permissions and the behaviour during updates, see KB10360. How to Approve Microsoft Graph API Permissions for Vitextra Solutions in the SharePoint Admin Center.
What users see until the permission is approved
The package can be deployed and the web part can be added to pages while the request is still pending. Without the permission, however, the web part cannot read or create the vault. Instead of the Set up PIN screen or the Enter PIN prompt, users see the message "Sorry, something went wrong. Please refresh the page and try again." with a Refresh button. No vault file is created.
After the approval, users press Refresh or reload the page, and the web part opens normally.
The same message appears if an approved permission is later removed on the Approved requests tab. Removing the permission does not delete any vault files: they stay in the users' OneDrive and open again once the permission is approved. For other causes of the message, see KB10459. Why Password Vault Does Not Load: "Something Went Wrong" and Permission Errors.
