ShareMaster V2 is in beta, a complete rebuild. See what is new and request access →
Features All features overview
Migration Tools Overview Structure and content OneDrive ↔ SharePoint Content only Structure only Move / Copy Upload from this computer Download to this computer Dropbox to SharePoint Resume and incremental runs
Recycling Bin Overview Browse a site's recycle bin Empty recycle bins in bulk Restore and purge history
Archive Overview Configure the tenant On Demand Archive Restore Archived Files Archive Savings Report Blob Viewer
Optimise Storage Tools Overview Delete all items in a list Delete all files and folders in a library Remove empty folders Remove duplicate files Reduce image sizes Delete sites and subsites
SharePoint Tools Overview Tenant Explorer SharePoint Explorer Easy Settings Fix renamed groups List Explorer Search the Preservation Hold Library
Replace Overview Replace in SharePoint Replace in local files Find password-protected files
Shared Links Overview Report shared links Report unique permissions Remove a person from sharing links Remove shared links Remove unique permissions
Version History Overview Version trimming Version trimming report Reset file version
Reports Overview Inventory report Folder inventory Site and subsite storage Security matrix Teams permissions Pre-migration analysis Compare items Dropbox to Microsoft 365 compare Duplicate file report Empty folder report Image size report Recycle bin report Unused licences Report history
V2 beta Pricing Demos Blog Guides Use cases Compare Tools Alerts FAQ Contact Sign in Start free trial
  1. Home
  2. Documentation
  3. Archive

Step 1: Grant consent

One application, in your directory, with one permission

Archive needs an identity of its own to write placeholders on your behalf. This step creates that identity in YOUR directory, declares exactly one permission on it, and asks an administrator to approve it.

Makes changes. Creates an application registration in your Microsoft Entra directory.
On this page What it does How it runs How it works What you need What it will not do Read next

What it does

  • An application called ShareMaster Archive is created in your directory. It belongs to you, not to us: you can see it, audit it and delete it in the Entra admin centre.
  • It declares ONE permission: Sites.Selected. That is the narrowest SharePoint permission Microsoft offers.
  • Sites.Selected grants access to NO site at all until you grant it, site by site. So even after consent this application cannot reach a single document.
  • One application per organisation, never a shared ShareMaster one. A shared application would mean one endpoint, ours, receiving every customer's file clicks.
  • After the consent window closes, ShareMaster reads back what your directory ACTUALLY granted and fails loudly if anything beyond Sites.Selected appears.

How it runs

  1. The permission is resolved from Microsoft. The exact role id is looked up on Microsoft's own service principal rather than hard coded, so it cannot drift.
  2. The declaration is checked before it is sent. There is no moment in which a wider request exists on the wire.
  3. The application is created. Named, tagged as a ShareMaster Archive app, and given a reply address so consent can complete.
  4. ShareMaster approves it for you. As the Global Administrator signed in to ShareMaster - the same thing the Entra admin centre's Grant admin consent button does. A Microsoft approval page opens only if your tenant blocks that, and it opens inside ShareMaster, never your default browser.
  5. The grant is read back and verified. A callback saying approved is not evidence of what was approved.

How it works

The step starts by looking for an existing Archive application in your directory, found by a tag it carries rather than by its display name, so renaming it does not lead to a second one. If there is none, one is created with exactly one permission declared, Sites.Selected, on Microsoft Graph and on SharePoint, and that declaration is checked before the request is sent. The application is given the reply address that approval needs.

Approval is then made directly with your sign-in: the application's service principal is created if it is missing and Sites.Selected is assigned to it, which is what the Grant admin consent button in the Entra admin centre does. Microsoft's consent page opens only if that direct grant is refused, and it opens in the browser profile you signed in with, aimed at this tenant. Afterwards the permissions actually granted are read back, waiting briefly for them to replicate, and the step fails if anything outside Sites.Selected is present, naming each extra permission.

A second, separate grant is recorded for the whole organisation: permission for the Archive application to act as the person who clicks a placeholder, so it can read that placeholder and put the file back as them. Delegated permissions already on the application are merged, not replaced. Without this grant archived files can be downloaded but not restored, and the step says so in a dialog rather than showing a green tick. The grant is checked again each time the wizard opens and when the endpoint step runs, and topped up if it has gone.

Nothing in this step touches a SharePoint site or a file. Archive runs write with your own sign-in, not as this application; the application is used to sign in the person who clicks, to hold the file type registration, and to carry these grants.

What you need

  • An account that can approve applications: Application Administrator, Cloud Application Administrator or Global Administrator.

What it will not do

  • Consent does not give the application access to any site. An archive run started in the app reads and writes SharePoint as you, with your own sign-in.
  • Deleting the application later stops all archiving. It does not delete anything already archived, and it does not delete your placeholders.

See every feature