Permissions required to work with K2 Cloud for SharePoint

Below is a list of permissions required to use the K2 for SharePoint App. The table below describes what permissions are required based on what tasks you're performing.

To view Microsoft Permission scopes see the Applications topic for more information.

Permissions required to Add, Register, Deploy and Activate the K2 App

Action	Required Permissions	Notes
Install the K2 for SharePoint app.	SharePoint: Full Control for the app catalog site	This is the app you install in the app catalog. You must have full control permission to add apps.
Register and Configure the application via the K2 Registration Wizard, and trust the K2 for SharePoint app.	SharePoint: Tenant Admin	If you do not run the Registration Wizard for the first time under an identity that has Site Collection Administration rights, it fails when uploading the K2 App.
Deploy the App	SharePoint: SharePoint Online Administrator/Site Collection Administrator on the app catalog site.
Activate the App	SharePoint: Site Collection Administrator for each site collection where the app will be deployed to.
Remove the App	SharePoint site: Full Control	The default Owners group typically has Full Control permission
Run the Registration Wizard, Uninstall, Configure K2 Permissions and Synchronize Groups	SharePoint site: Design	The default Owners group typically has Full Control permissions which includes Design permissions.

Permissions required to create or deploy applications with the K2 App

Action	Required Permissions	Notes
Create and edit Data, Forms, Workflows and Reports	App Catalog: Read SharePoint site: Edit	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. The default Members group typically has Edit permissions.

Permissions required to use applications created with the K2 App

Action	Required Permissions	Notes
Start a Workflow, View a Workflow or access K2 Application User Pages (including Learn, Get Help, End User License) and running Reports.	App Catalog: Read SharePoint site: Read SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint Lists and Libraries K2 workflows: Start and View permissions	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. Using K2 artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.
Sharing K2 Applications with external users – The ability to share K2 Applications with external users such as users outside an organization who can access SharePoint Online sites and documents but do not have a license for the SharePoint Online or Microsoft Office 365 subscription.	Permissions based on Site Collection Group membership SharePoint: Full Control required to enable sharing on the app catalog	External users inherit the runtime permissions of the group selected when sharing the site. Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232 Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Action

Required Permissions

Notes

Start a Workflow, View a Workflow or access K2 Application User Pages (including Learn, Get Help, End User License) and running Reports.

App Catalog: Read
SharePoint site: Read
SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint Lists and Libraries
K2 workflows: Start and View permissions

All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog.
Using K2 artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.

Sharing K2 Applications with external users – The ability to share K2 Applications with external users such as users outside an organization who can access SharePoint Online sites and documents but do not have a license for the SharePoint Online or Microsoft Office 365 subscription.

Permissions based on Site Collection Group membership

SharePoint: Full Control required to enable sharing on the app catalog

External users inherit the runtime permissions of the group selected when sharing the site.
Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232
Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Permissions required to administer K2 App

Action	Required Permissions	Notes
Manage App Deployments, Registration wizard, Manage App Activations, End User License	SharePoint: Global Admin
Access the K2 Management Page and administer the K2 environment	K2: Admin	Users require Admin permission in the K2 environment to access the K2 Management environment.