Storage Optimizer documentation

This section describes how we protect your data, including the authentication Storage Optimizer uses to connect to your SharePoint sites, the necessary permissions Storage Optimizer requires to access your SharePoint data, and the implications for data analysis.

Authentication and security

Storage Optimizer uses the so called “Modern Authentication” to connect to your SharePoint sites. Modern Authentication is an enhanced approach to identity management, offering significantly improved security for user authentication and access authorization. With modern authentication, you gain the flexibility to customize authentication policies according to your specific access control needs. By configuring access policies from a centralized location, you can efficiently manage access for all users, eliminating the need to set up access individually for each application requiring network access.
In modern authentication, the user’s sign-in process involves a secure exchange of authentication tokens rather than the actual password. When the user logs in at Microsoft, the authentication server generates a token that represents the user’s identity and access rights. This token is then provided to Storage Optimizer as proof of authentication. It contains specific information that the application needs to verify the user’s identity and authorization level without exposing the user’s password. By using this approach, Storage Optimizer never receives your password, but only a time-limited token.

Required permissions

To connect to your SharePoint, Storage Optimizer uses an application which must be registered within your Entra ID (formerly Azure Active Directory or AAD). This means that everything will be under your control. There is no need to grant access to any external subject which is outside of your management.
The registered application will get the minimum needed permissions for Storage Optimizer to scan and analyze your SharePoint sites. The Microsoft API permission model is granular, but still has some missing permissions. That is why, even though Storage Optimizer is only reading your SharePoint data, some read-write permissions are also required.

First, visit portal.azure.com and open your application on the “App registrations” page. Next, select “API permissions” from the left-side menu. Then, click the “Add a permission” button. From the options of Microsoft Graph and SharePoint, choose the “Application permissions” option. You can either scroll through the available permissions or use the search box to find the desired permissions by typing their names. Afterward, click on the “Add permissions” button and grant admin consent to them.

Storage Optimizer requires the following permissions from Microsoft Graph:

• Sites.Read.All – Read items in all site collections
• User.Read.All – allows reading full profiles of all users

Within SharePoint, Storage Optimizer mandates the following permissions:

• TermStore.Read.All – allows reading managed metadata
• Sites.Manage.All – allows reading and writing items and lists in all site collections

The Sites.Manage.All permission is required for:

1. Reading the collection of subsites of a site. Without this permission, Storage Optimizer is not able to process the subsites of your sites.
2. Reading the item count and the storage metrics of a folder.

Each operation is mandatory to analyze and show the correct SharePoint statistics for your tenant.

Data access and storage

The data analysis performed by Storage Optimizer is stored within a secure and self-contained environment. Specifically, all analyzed data is stored within a local database, securely hosted on the user’s computer, where the application has been installed. It is essential to emphasize that at no point during this process is any of the data transmitted or relayed to any external servers. Rather, the whole data remains strictly localized within the user’s device.
This stringent approach to data handling ensures a heightened level of privacy and confidentiality, safeguarding sensitive information from any potential exposure to external networks or unauthorized entities. As a result, users can rest assured that their valuable data remains under their exclusive control.
Storage Optimizer exclusively processes file metadata during its analysis, such as file name, size, creation/modification dates, and version information. It does not access or read the actual file content, preserving data privacy, and maintaining user confidence.