Deploy Orbit in Microsoft 365

Use this guide when your organization is preparing Orbit for a Microsoft 365 tenant.

Orbit uses Microsoft sign-in, Microsoft Graph, OneDrive, and SharePoint. Team workspaces use a SharePoint site Orbit document library. Personal My Workspace uses a user’s OneDrive-backed Orbit folder. For the storage layout, see Where your notes live; for the full access model, see Permissions model.

Follow the deployment checklist

Step	Owner	Why it matters
Decide who administers Orbit	Orbit tenant owner	The first person from your organization to sign in becomes the Orbit tenant owner and assigns further admin roles.
Grant Entra consent	Microsoft 365 admin	Orbit needs Microsoft Graph access to read, write, share, and discover workspace locations.
Confirm SharePoint site ownership	Site owner or SharePoint admin	Team workspaces should live in sites owned by the right team.
Create or allow the Orbit library	Site owner or SharePoint admin	SharePoint workspaces use the site’s Orbit document library.
Install the Teams app if used	Teams admin	Teams links and the Orbit Teams home tab need the Teams app package.
Test a workspace	Workspace owner	Confirm sign-in, workspace creation, note creation, sharing, and Microsoft 365 access.

Grant Microsoft permissions and consent

Orbit uses incremental consent: sign-in asks only for what the core note-taking experience needs, and further permissions are requested in the app at the moment a user first touches the feature that needs them.

Requested at sign-in:

Permission	Purpose	Admin consent required
User.Read	Read the signed-in user’s profile.	No
Files.ReadWrite.All	Read, write, move, delete, and share OneDrive or SharePoint workspace files.	No (user-consentable by default)

Requested in-app, just in time:

Permission	Asked when the user…	Admin consent required
Sites.Read.All	First browses or creates a SharePoint team workspace.	No (user-consentable by default)
Sites.Manage.All	Same moment — creating a SharePoint workspace also creates the site’s Orbit document library. Asked together with Sites.Read.All in one prompt.	No (user-consentable by default)
User.Read.All	First searches people to share with or mention.	Yes (Orbit shows an “ask your admin” link)
SharePoint AllSites.Read (delegated, SharePoint resource)	First opens a workspace’s Members roster.	No (user-consentable by default; a separate SharePoint-resource approval in consent-restricted tenants)

Admins who prefer a single one-time approval can pre-consent everything at once with the tenant admin consent URL (https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id=...) — users then never see any in-app permission prompts for Graph.

The admin consent screen lists every permission declared on the Orbit app registration, not just the ones above. Orbit’s registration declares delegated permissions only — it holds zero application permissions, so Orbit never acts in your tenant except as a signed-in user.

Orbit also requests its own app/API permission, access_as_user. That permission is for calling Orbit’s own web application as the signed-in user; it is separate from Microsoft Graph permissions.

If consent is missing, users can sign in but workspace creation, people search, note sharing, and SharePoint-backed content fail — see Sign-in and consent troubleshooting.

Set up SharePoint workspaces

When a user creates a SharePoint team workspace, Orbit looks for an Orbit document library in the selected SharePoint site. If the library does not exist, Orbit creates it using the signed-in user’s own permissions (Sites.Manage.All plus their SharePoint access to the site).

Recommended setup:

• Use a SharePoint site owned by the team that owns the knowledge.
• Keep at least two site owners or tenant admins able to recover access.
• Treat the Orbit document library as product data.
• Manage broad access with Microsoft 365 groups or security groups where possible.
• Avoid renaming or deleting the Orbit library outside Orbit.

Provision OneDrive My Workspace

My Workspace is for personal notes, drafts, and experiments. It is backed by the user’s OneDrive and Orbit provisions it automatically on first use — users whose tenant has not provisioned OneDrive for them see a clear “OneDrive needs to be provisioned” message with a retry.

Do not use personal OneDrive workspaces as the long-term home for team knowledge. Move shared team knowledge into a SharePoint workspace.

Install the Microsoft Teams app

Orbit’s Teams app, Orbit Wiki, is a personal-tab experience. It embeds Orbit at /teams/home and keeps workspace and note navigation inside the Teams shell — see Use Orbit in Microsoft Teams for what users get.

Before uploading the Teams package:

• Confirm the Teams app package points to your Orbit production URL.
• Keep the Teams auth redirect URI (/teams/auth-end on the Orbit domain) configured in Entra.
• Keep the Orbit domain in the Teams manifest valid domains.
• Test opening Orbit from Teams desktop, web, and mobile if your organization supports all three.

Use the packaged Teams app from your Orbit deployment process or ask Orbit support for the current package.

Validate the deployment

After consent and Teams setup, test the full path:

1. Sign in with a normal Microsoft work account.
2. Open My Workspace and create a note.
3. Create a SharePoint workspace in a test site.
4. Confirm the site has an Orbit document library.
5. Add a second internal user to the SharePoint site’s members.
6. Share a note-specific link with that user.
7. Open the same note from Microsoft Teams if the Teams app is installed.
8. Open the Orbit document library directly in SharePoint.

Fix common deployment blockers

Symptom	Likely cause
Users can sign in but cannot create workspaces	Missing Microsoft 365 admin consent for Orbit, missing SharePoint permission, or the selected site cannot create the Orbit library.
SharePoint site search returns no usable site	Missing Sites.Read.All, restricted site visibility, or user lacks site access.
Workspace creation says the Orbit library is missing	Orbit cannot create the library or the site owner must create it first.
User search does not find people	Missing User.Read.All or tenant search restrictions.
Teams tab opens but sign-in does not complete	Teams redirect URI or valid domains are misconfigured.
A user can open a file in SharePoint but not in Orbit	The workspace is not registered in Orbit, or Orbit cannot verify the user’s access to the workspace root.

For symptom-by-symptom fixes, see Sign-in and consent troubleshooting.