--- title: "Microsoft Graph Permission Files.ReadWrite.AppFolder: Why Password Vault Needs It and How to Approve It" description: "Why the Vitextra Password Vault web part requests the delegated Microsoft Graph permission Files.ReadWrite.AppFolder, what the permission allows and what it does not, how a SharePoint or Global Administrator approves it on the API access page of the SharePoint admin center, and what users see until it is approved." url: https://vitextra.com/en/support/kb/10454 language: en published: 2026-11-03 modified: 2026-11-03 products: - "Password Vault" author: "Līga Ozola" tags: ["Files.ReadWrite.AppFolder", "Password Vault permissions", "approve Files.ReadWrite.AppFolder SharePoint", "API access SharePoint admin center", "Microsoft Graph app folder permission", "SPFx delegated permission OneDrive", "Password Vault API access", "Password Vault something went wrong permission", "Vitextra Password Vault"] --- # Microsoft Graph Permission Files.ReadWrite.AppFolder: Why Password Vault Needs It and How to Approve It Why the Vitextra Password Vault web part requests the delegated Microsoft Graph permission Files.ReadWrite.AppFolder, what the permission allows and what it does not, how a SharePoint or Global Administrator approves it on the API access page of the SharePoint admin center, and what users see until it is approved. ## Overview [Password Vault](https://vitextra.com/en/products/password-vault) keeps each user's vault in a file in the app folder of that user's OneDrive. To read and write this file, the solution package requests exactly one Microsoft Graph permission: **Files.ReadWrite.AppFolder**. A tenant administrator must approve it once after the package is deployed; until then the web part cannot open or create any vault. This article explains the permission and the approval. ## Why Password Vault needs the permission The web part uses Microsoft Graph for three operations, all in the signed-in user's OneDrive app folder: - finding the vault file *vitextra-password-vault.json*; - creating it the first time the user opens Password Vault; - reading it and saving it after every change. Password Vault requests no other Microsoft Graph permission and needs no SharePoint list permissions: any user who can open the page can use his or her own vault. ## What the permission allows and what it does not | Aspect | Details | |---|---| | Permission type | **Delegated**: it works only on behalf of the signed-in user, never in the background and never without a user | | Allows | Reading and writing files in the app folder of the signed-in user's own OneDrive | | Does not allow | Reading or changing the user's other OneDrive files, other users' OneDrive, SharePoint sites, mail, calendars or directory data | | Application (app-only) access | None; Password Vault has no service account and no background process | ![The Password Vault request on the API access page](https://static.vitextra.com/articles/10454/pending-request-en.png) *The Password Vault request on the API access page* 📝 **Note** In SharePoint Online, API permissions of SPFx solutions are granted to one Microsoft Entra ID application shared by all SPFx solutions in the tenant, *SharePoint Online Web Client Extensibility*. Once *Files.ReadWrite.AppFolder* is approved, it is available to every SPFx solution deployed in your tenant, and the app folder is the folder of that shared application. This is how the SharePoint Framework works for all vendors. Deploy only SPFx solutions that you trust; see the security notes in [KB10360. How to Approve Microsoft Graph API Permissions for Vitextra Solutions in the SharePoint Admin Center](https://vitextra.com/en/support/kb/10360). ## How to approve the permission The permission request is created when the Password Vault package is deployed to the **tenant** App Catalog (see [KB10035. How to Install a Vitextra Product in SharePoint Online](https://vitextra.com/en/support/kb/10035)). You need the **SharePoint Administrator** or **Global Administrator** role. 1\. Open the **SharePoint admin center**. 2\. Go to **Advanced** > **API access**. 3\. On the **Pending requests** tab, select the request of the *Vitextra Password Vault* package for *Microsoft Graph* / *Files.ReadWrite.AppFolder*. 4\. Click **Approve** and confirm. 5\. Check that the permission now appears on the **Approved requests** tab. If *Files.ReadWrite.AppFolder* has already been approved for another SPFx solution, no new request appears: SharePoint reuses the existing grant. Users do not see a consent prompt; after the approval the web part works for everyone in the tenant, usually within a few minutes. If it does not, reload the page. 💡 **Tip** For screenshots, PowerShell commands, partial approval, revoking permissions and the behaviour during updates, see [KB10360. How to Approve Microsoft Graph API Permissions for Vitextra Solutions in the SharePoint Admin Center](https://vitextra.com/en/support/kb/10360). ## What users see until the permission is approved The package can be deployed and the web part can be added to pages while the request is still pending. Without the permission, however, the web part cannot read or create the vault. Instead of the **Set up PIN** screen or the **Enter PIN** prompt, users see the message "Sorry, something went wrong. Please refresh the page and try again." with a **Refresh** button. No vault file is created. ![Password Vault before the permission is approved](https://static.vitextra.com/articles/10454/error-not-approved-en.png) *Password Vault before the permission is approved* After the approval, users press **Refresh** or reload the page, and the web part opens normally. The same message appears if an approved permission is later removed on the **Approved requests** tab. Removing the permission does not delete any vault files: they stay in the users' OneDrive and open again once the permission is approved. For other causes of the message, see [KB10459. Why Password Vault Does Not Load: "Something Went Wrong" and Permission Errors](https://vitextra.com/en/support/kb/10459). ## Related articles - [KB10453. Where Password Vault Stores Your Passwords: The OneDrive App Folder](https://vitextra.com/en/support/kb/10453) - [KB10452. How Password Vault Protects Your Data: Encryption, PIN and Storage](https://vitextra.com/en/support/kb/10452) - [KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR](https://vitextra.com/en/support/kb/10363)