BI docs

Appearance

Permissions required: site and guest access ​

For site owners

This page is for site owners. You don't need it to build dashboards. Who does what?

This page covers the SharePoint access people need to open the site, including guests from outside your organisation. For who can view, edit and build dashboards inside Sintel BI, see Who can view, edit and build. For the permissions the app itself uses and where data goes, see Security and data.

Read access to the site ​

As with standard SharePoint, users must be in the site's Visitors group before they can open it. Many customers add Everyone except external users to the Visitors group.

Don't email everyone

When you add users or groups to a SharePoint group, untick the option to send an email to the new members. Otherwise you may email everyone in your organisation.

Once a user is in the Visitors group, they can open any Sintel BI dashboard that is public. Dashboards that aren't public, or are shared only with specific users or SharePoint groups, aren't visible to other users.

When you set up Sintel BI on a site, it creates a number of configuration lists and sets their permissions automatically. Don't change the content or permissions of these lists, as this can break the app. See Lists used by Sintel BI for details.

Sharing with external users ​

For administrators

Setting up access for external users needs a Microsoft 365 or SharePoint administrator.

Sintel BI dashboards can also be shared with external users, people from outside your organisation that you've invited. They use your site as trusted users, almost as if they were internal users of your tenant. Setting this up takes several steps, described in Microsoft's article Collaborate with guests in a site.

In short:

  1. Configure External Identities in Microsoft Entra ID (formerly Azure AD).
  2. Check the Microsoft 365 Group settings.
  3. Check the SharePoint settings (SharePoint admin centre > Policies > Sharing).
  4. Adjust the site settings (SharePoint admin centre > Sites > Active sites > Policies).
  5. If the site uses a Microsoft 365 group, open the group in Outlook and add the guest's email.
  6. The guest receives an invitation, selects Go to SharePoint, enters their email and receives a one-time passcode to verify their identity.
  7. Add the external users to the site's Visitors group.

The app catalog

The group ReadOnlyAccessToTenantAdminSite normally has read access to the app catalog, so you don't need to grant every external user access to your tenant app catalog yourself. In our experience it can take a while for new users to be added to this group, so you may need to add them to the Visitors group of the app catalog site manually. To do that, the tenant app catalog site must allow new guests: in the SharePoint admin centre, select your tenant app catalog site collection, then Site settings > More sharing settings > New and existing guests.

Final thoughts ​

Adding external users to the Visitors group gives them access to your site and to any public dashboards, or dashboards shared with the Visitors group.

If they also take part in workflows built with Sintel Apps forms, make sure they have:

  1. Contribute access to the main form list, to create or edit forms. Read access is enough to view them.
  2. Contribute access to the associated chat list, if it's used, to take part in conversations. Read access is enough to view the chat history.
  3. Contribute access to any linked lists, if they're used, to create child items. Read access is enough to view linked list items.