Permissions model

Orbit’s Microsoft Entra app registration holds zero application permissions: every Microsoft Graph call runs as the signed-in user, with that user’s own access, and nothing runs in the background against your tenant.

Understand delegated-only access

Delegated-only means:

• Orbit can never read a file the signed-in user cannot read.
• There is no service account, background crawler, or tenant-wide indexer.
• Revoking a user’s Microsoft 365 access ends their Orbit access to those files.

Review the sign-in permissions

Signing in asks for exactly two Graph permissions:

Permission	Purpose
User.Read	Read the signed-in user’s own profile.
Files.ReadWrite.All	Read and write the user’s OneDrive and SharePoint files — where notes live.

Approve further permissions just in time

Orbit asks for each remaining permission at the moment a user first touches the feature that needs it — never earlier:

Permission	Asked when the user first…	Admin consent required by default
Sites.Read.All	Browses or searches SharePoint sites, or embeds a Microsoft Stream video.	No
Sites.Manage.All	Creates a team workspace (Orbit creates the site’s Orbit document library). Asked together with Sites.Read.All in one prompt.	No
User.Read.All	Searches people to share or mention.	Yes
SharePoint AllSites.Read (delegated, SharePoint resource)	Opens a workspace’s Members roster.	No

Tenants that restrict user consent turn every “No” above into an admin approval. Orbit handles that without dead ends: the user sees Your organization requires admin approval with a Copy approval link button, and the admin’s approval is click-only — see Sign-in and consent troubleshooting. Admins who prefer one up-front approval can pre-consent everything — see Deploy Orbit in Microsoft 365.

Revoke access and audit denials

• Share revocation is immediate. Every request re-checks the share, so a revoked note share stops working on the next access; live co-editing sessions opened through a revoked share close within five minutes.
• Denied redemptions are audit-logged. Attempts to redeem a revoked or invalid share link are recorded as Note share redemption denied in the audit log, and repeated failures are throttled per user. Org admins review these events in the Audit section — see Organization admin settings.

Who can read or write a given workspace is decided by SharePoint and OneDrive permissions, not by Orbit — see Permissions for the roles users see in the product.

Up next: roll it out with Deploy Orbit in Microsoft 365.