Security & Permissions
Tenaxis governs SharePoint through Discover → Govern → Review → Remediate → Prove. Microsoft 365 remains the place to work with documents. This page describes the repository implementation, not an independent security certification.
Microsoft permissions
The executable permission inventory is packages/common/src/permissions.ts.
Admin sign-in uses delegated permissions: operations are constrained by the
signed-in administrator's Microsoft rights as well as the granted scopes.
Background jobs use that administrator's encrypted refresh token. Revocation,
Conditional Access and expired consent can interrupt jobs; failures need attention.
| Resource / type | Permission | Feature and representative API calls | Required / narrower alternative |
|---|---|---|---|
| OpenID Connect | openid, profile, email | Authenticate and identify the signed-in account | Sign-in |
| OpenID Connect | offline_access | Refresh sessions and background delegated access | Background operation; no password stored |
| Graph delegated | User.Read | /me profile | All sign-ins; employee sign-in requests no other Graph scope |
| Graph delegated | Group.ReadWrite.All | Create groups for governed provisioning; /groups and group settings | Admin connection; group read-only cannot provision |
| Graph delegated | GroupMember.ReadWrite.All | /groups/{id}/owners, /members, role add/remove | Admin connection; overlaps broader group permission but explicitly describes membership operations |
| Graph delegated | Directory.Read.All | User lookup, directory objects and disabled-account checks | Admin connection; narrower user/group scopes require feature-by-feature validation before replacing this scope |
| Graph delegated | Sites.ReadWrite.All | Site metadata, provisioning library/folder structures | Admin connection; site read-only cannot apply provisioning structures |
| Graph application | Sites.Read.All | /sites/getAllSites and pagination, including communication sites | Separately consented; required for tenant-wide inventory and coverage |
| SharePoint application | Sites.FullControl.All | SharePoint REST provisioning/settings and Tenant Administration CSOM policy read/write | Optional enhanced features consent; required for the implemented policy enforcement path |
These site permissions technically permit broader content access than Tenaxis's
metadata discovery requires. Removing the generic document browser/search/upload
UI does not turn broad Microsoft scopes into metadata-only permissions.
Files.ReadWrite.All and application Files.Read.All are no longer requested.
An existing Entra application registration must also have obsolete grants removed
by its administrator; changing code does not revoke consent already granted.
Why not Sites.Selected everywhere?
Selected permissions require explicit grants on selected sites. They can support
future limited-scope operations on already selected sites, but do not replace
application Sites.Read.All for getAllSites tenant-wide discovery. The current
SharePoint tenant administration policy implementation uses the enhanced
FullControl grant. A selected-site mode has not been implemented or validated;
Tenaxis does not silently substitute it and report full-estate coverage.
Microsoft references: getAllSites permissions, selected permissions.
Identity, isolation and review scope
Microsoft Entra sign-in establishes a tenant and user identity. The API resolves that identity server-side, checks tenant route boundaries and refreshes admin membership rather than trusting an old admin flag. Database relation checks reject cross-tenant site, template, review and automation associations. Automated tests exercise tenant boundaries; these are not a substitute for an independent penetration test.
By default, review links require an Entra-authenticated account in the review's tenant and an owner identity assigned in the review snapshot. Possession of the link alone is insufficient. Evidence records the authenticated account ID, UPN when available, authentication method, decisions and timestamps. It does not prove which physical person was using that account. Tenant MFA/Conditional Access is controlled by the customer in Entra.
An administrator may explicitly grant an email OTP fallback for one review to
an owner recorded in that review. This remains optional; it is not a tenant-wide
authentication switch. Six-digit codes expire after 15 minutes and permit three
attempts. Database transactions prevent concurrent attempt-count bypass and code
reuse. OTP sessions are review-bound, expire after 20 minutes, and are invalidated
by revocation, reassignment, regrant or code resend. The grant is checked again
in the transaction recording decisions. OTP evidence is labelled EMAIL_OTP,
not MICROSOFT_ENTRA; mailbox access does not establish an Entra-authenticated
identity or satisfy the customer's Entra MFA/Conditional Access requirements.
Reviews cover Microsoft 365 group owner and member roles. They do not calculate complete effective access through SharePoint groups, security groups, nested groups, sharing links or unique library/folder/item permissions. Communication sites can be inventoried without an M365 group; their group access scope is unavailable. Graph site application permissions are not user visitors.
Data accessed and stored
Stored data includes organisation identifiers, administrator/user names and UPNs, site metadata, group roles, governance configuration, review decisions, offboarding records, risk observations, job/audit outcomes and webhook deliveries. Refresh tokens are encrypted using the configured tenant secrets encryption key. Application credentials and signing keys are deployment secrets.
Generic document search, browsing and upload routes have been removed. Metadata and governance operations can create provisioning folder/library structures; this is distinct from ingesting customer document bodies for a portal. Webhooks transmit configured governance event payloads to customer endpoints. Payment and email integrations process their respective billing and notification data. The operator must confirm the providers actually enabled in deployment.
Audit, retention and deletion
Audit evidence is stored in PostgreSQL. It is a detailed recorded history, not a cryptographically tamper-evident or immutable ledger. Database operators can change data. Rule, webhook and departing-employee configuration deletion retains its historical records. Archiving a workspace keeps it governed and does not delete Microsoft content. Whole-tenant deletion intentionally deletes customer records, including evidence, and is a separate owner-only action.
Tenant owners can export governance evidence, disconnect Microsoft and request whole-tenant deletion through the tenant API. Disconnect blocks new Microsoft calls and disables automation/webhooks; in-flight calls may finish. Revoke the Microsoft consent grants in Entra as well. Deletion requires disconnect first and a five-minute drain interval. Database backups may retain deleted records until the operator's verified backup retention period expires.
Exports exclude review tokens. The JSON export has a 10,000-row per-category limit and reports an error rather than silently truncating evidence.
Deployment facts requiring operator verification
Before a pilot, confirm hosting region, database/storage encryption, TLS at the public proxy and database, backup schedule and retention, a tested restore, recovery objectives, monitoring recipients and subprocessors. The repository does not establish these guarantees. Public contractual promises must follow the verified deployment and legal review, not assumptions about a hosting vendor.