Permissions required to integrate with SharePoint

Microsoft Azure Active Directory is now Microsoft Entra ID

Below is a list of permissions required to use the app. The table below describes what permissions are required based on what tasks you're performing.

To view Microsoft Permission scopes see the Applications topic for more information.

Nintex K2 Cloud (SPFx) app for SharePoint Online

Permissions required to add, register, and configure the app

Action	Required permissions	Notes
Install the app.	SharePoint: Site Owner for the app catalog site	This is the app you install in the app catalog. You need Site Owner rights on the SharePoint app catalog to add the app and enable it to all sites.
Register and configure the application via Management, and trust the app.	K2: Admin SharePoint: Global Admin	You need K2 Admin rights to add a new instance of the feature in Management. You need Global Admin rights in SharePoint to grant Nintex Automation for SharePoint app consent in Management.
Remove the app	SharePoint site: Full Control K2: Admin	The default Owners group typically has Full Control permission

Action

Required permissions

Notes

Install the app.

SharePoint: Site Owner for the app catalog site

This is the app you install in the app catalog. You need Site Owner rights on the SharePoint app catalog to add the app and enable it to all sites.

K2: Admin

SharePoint: Global Admin

You need K2 Admin rights to add a new instance of the feature in Management.

You need Global Admin rights in SharePoint to grant Nintex Automation for SharePoint app consent in Management.

Remove the app

SharePoint site: Full Control

K2: Admin

The default Owners group typically has Full Control permission

Permissions required to create or deploy applications with the app

Action	Required Permissions	Notes
Create and edit data, forms, workflows and reports	App catalog: Read SharePoint site: Edit	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. The default Members group typically has Edit permissions.

Permissions required to use applications created with the app

Action	Required Permissions	Notes
Start a workflow, view a workflow or access application user pages (including Learn, Get Help, End User License) and running reports.	App catalog: Read SharePoint site: Read SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint lists and libraries Workflows: Start and View permissions	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App catalog. Using artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.
Sharing applications with external users – The ability to share applications with external users such as users outside an organization who can access SharePoint Online sites and documents but do not have a license for the SharePoint Online or Microsoft Office 365 subscription.	Permissions based on Site Collection Group membership SharePoint: Full Control required to enable sharing on the app catalog	External users inherit the runtime permissions of the group selected when sharing the site. Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232 Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Action

Required Permissions

Notes

Start a workflow, view a workflow or access application user pages (including Learn, Get Help, End User License) and running reports.

App catalog: Read
SharePoint site: Read
SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint lists and libraries
Workflows: Start and View permissions

All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App catalog.
Using artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.

Sharing applications with external users – The ability to share applications with external users such as users outside an organization who can access SharePoint Online sites and documents but do not have a license for the SharePoint Online or Microsoft Office 365 subscription.

Permissions based on Site Collection Group membership

SharePoint: Full Control required to enable sharing on the app catalog

External users inherit the runtime permissions of the group selected when sharing the site.
Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232
Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Permissions required to administer the app

Action	Required Permissions	Notes
Manage the app in Management	K2: Admin	You need K2 Admin rights to administer the app in Management.

Action

Required Permissions

Notes

Manage the app in Management

K2: Admin

You need K2 Admin rights to administer the app in Management.

Legacy Nintex K2 for SharePoint app

Permissions required to add, register, deploy and activate the app

Action	Required permissions	Notes
Install the app.	SharePoint: Full Control for the app catalog site	This is the app you install in the app catalog. You must have full control permission to add apps.
Register and configure the application via the Registration Wizard, and trust the app.	SharePoint: Tenant Admin	If you do not run the Registration Wizard for the first time under an identity that has Site Collection Administration rights, it fails when uploading the K2 App.
Deploy the app	SharePoint: SharePoint Online Administrator/Site Collection Administrator on the app catalog site.
Activate the App	SharePoint: Site Collection Administrator for each site collection where the app will be deployed to.
Remove the app	SharePoint site: Full Control	The default Owners group typically has Full Control permission
Run the Registration Wizard, uninstall, configure permissions and synchronize groups	SharePoint site: Design	The default Owners group typically has Full Control permissions which includes Design permissions.

Permissions required to create or deploy applications with the app

Action	Required permissions	Notes
Create and edit data, forms, workflows and reports	App catalog: Read SharePoint site: Edit	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. The default Members group typically has Edit permissions.

Permissions required to use applications created with the K2 App

Action	Required permissions	Notes
Start a workflow, view a workflow or access application user pages (including Learn, Get Help, End User License) and running reports.	App catalog: Read SharePoint site: Read SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint lists and libraries Workflows: Start and View permissions	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App catalog. Using artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.
Sharing applications with external users – The ability to share applications with external users such as users outside an organization who can access SharePoint Online sites and documents but do not have a license for the SharePoint Online or Microsoft Office 365 subscription.	Permissions based on Site Collection Group membership SharePoint: Full Control required to enable sharing on the app catalog	External users inherit the runtime permissions of the group selected when sharing the site. Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232 Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Action

Required permissions

Notes

Start a workflow, view a workflow or access application user pages (including Learn, Get Help, End User License) and running reports.

App catalog: Read
SharePoint site: Read
SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint lists and libraries
Workflows: Start and View permissions

All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App catalog.
Using artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.

Permissions based on Site Collection Group membership

SharePoint: Full Control required to enable sharing on the app catalog

External users inherit the runtime permissions of the group selected when sharing the site.
Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232
Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Permissions required to administer the app

Action	Required permissions	Notes
Manage app deployments, Registration wizard, Manage app activations, End User License	SharePoint: Global Admin
Access the Management Page and administer the environment	K2: Admin	Users require Admin permission in the environment to access the Management environment.