Permissions required to work with

Permissions required to Add, Register, Deploy and Activate the K2 Five App

Action	Required Permissions	Notes
Install the K2 Five app.	SharePoint: Full Control for the app catalog site	This is the app you install in the app catalog. You must have full control permission to add apps.
Register and Configure the application via the K2 Registration Wizard, and trust the K2 for SharePoint Online app.	SharePoint: Tenant Admin	If you do not run the Registration Wizard for the first time under an identity that has Site Collection Administration rights, it fails when uploading the K2 Five App. The users and groups configured as Solution Designers and Solution Participants when activating the Site Collection are granted K2 permissions.
Deploy the App	SharePoint: SharePoint Online Administrator/Site Collection Administrator on the app catalog site.
Activate the App	SharePoint: Site Collection Administrator for each site collection where the app will be deployed to.
Remove the App	SharePoint site: Full Control	The default Owners group typically has Full Control permission
Run the Registration Wizard, Uninstall, Configure K2 Permissions and Synchronize Groups	SharePoint site: Design	The default Owners group typically has Full Control permissions which includes Design permissions.

Permissions required to add K2 Web Parts

Action	Required Permissions	Notes
Add K2 Web Parts such as K2 worklist or K2 Forms viewer	App Catalog: Read SharePoint site: Edit Permission level: Add and Customize Pages	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. The default Members group typically has Edit permissions.

Permissions required to create or deploy applications with the K2 Five App

Action	Required Permissions	Notes
Create and edit Data, Forms, Workflows and Reports	App Catalog: Read SharePoint site: Edit SharePoint site: K2 Solutions Designers Group: Edit	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. The default Members group typically has Edit permissions. The default Owners and Members groups are typically included in the K2 Solution Designers role (configured using Configure K2 Permissions ). Users who will build applications with K2 should be added to the K2 Solutions Designers group.

Permissions required to use applications created with the K2 Five App

Action	Required Permissions	Notes
Start a Workflow, View a Workflow or access K2 Application User Pages (including Learn, Get Help, End User License) and running Reports.	App Catalog: Read SharePoint site: Read SharePoint site, K2 Solution Participants Group: Read SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint Lists and Libraries K2 workflows: Start and View permissions	All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog. The default Owners and Members groups typically contain the K2 Solution Participants groups. The default Owners and Members are typically included in the K2 Solution Participants role (configured using Configure K2 Permissions ). On deployment of the workflow, the K2 Solution Participants group is granted Start and View rights on the K2 workflow. Using K2 artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.
Sharing K2 Applications with external users – The ability to share K2 Applications with external users such as users outside an organization who can access SharePoint Online sites and documents but does not have a license for the SharePoint Online or Microsoft Office 365 subscription.	Permissions based on Site Collection Group membership SharePoint: Full Control required to enable sharing on the app catalog	External users inherit the runtime permissions of the group selected when sharing the site. Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232 Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Action

Required Permissions

Notes

Start a Workflow, View a Workflow or access K2 Application User Pages (including Learn, Get Help, End User License) and running Reports.

App Catalog: Read
SharePoint site: Read
SharePoint site, K2 Solution Participants Group: Read
SharePoint lists and libraries: Read and Edit permissions for users as required by the functions performed by the application on the SharePoint Lists and Libraries
K2 workflows: Start and View permissions

All users that use K2 in SharePoint (including list integration, creating, editing and deleting list items), require Read rights on the App Catalog.
The default Owners and Members groups typically contain the K2 Solution Participants groups.
The default Owners and Members are typically included in the K2 Solution Participants role (configured using Configure K2 Permissions ).
On deployment of the workflow, the K2 Solution Participants group is granted Start and View rights on the K2 workflow.
Using K2 artifacts on subsites may require Read rights on the root site of the site collection if permission inheritance is broken.

Sharing K2 Applications with external users – The ability to share K2 Applications with external users such as users outside an organization who can access SharePoint Online sites and documents but does not have a license for the SharePoint Online or Microsoft Office 365 subscription.

Permissions based on Site Collection Group membership

SharePoint: Full Control required to enable sharing on the app catalog

External users inherit the runtime permissions of the group selected when sharing the site.
Ensure that sharing has been enabled on the SharePoint Site Collection. See the following link for more information about sharing SharePoint sites: https://support.office.com/en-us/article/Share-sites-or-documents-with-people-outside-your-organization-80e49744-e30f-44db-8d51-16661b1d4232
Enable sharing on the app catalog site and share the app catalog site with external users by deselecting the option "Everyone except external users"

Permissions required to use K2 Web Parts

Action	Required Permissions	Notes
To view and use K2 Web Parts.	App Catalog: Read SharePoint site: Read SharePoint site, K2 Solution Participants Group: Read	To view and use a K2 Web Parts on subsites with broken inheritance, Read rights are required on the root site.

Permissions required to administer K2 Five App

Action	Required Permissions	Notes
Manage App Deployments, Registration wizard, Manage App Activations, End User License	SharePoint: Global Admin	The users and groups configured as Solution Designers and Solution Participants when activating the Site Collection are granted K2 permissions.
Access the K2 Management Page and administer the K2 environment	K2: Admin	Users require Admin permission in the K2 environment to access the K2 Management environment.

Permissions required to work with K2 Five for SharePoint