Where FlowForma sits in your tenant
FlowForma spans two boundaries, and it is worth being precise about which is which.- Your Microsoft 365 tenant holds your data. Flows, Forms, form data, and documents are stored in SharePoint Online in your tenant, in the region you have configured for Microsoft 365. The FlowForma app is installed from the SharePoint app catalog and is built with Microsoft’s SPFx framework.
- FlowForma’s Azure tenant runs the engine. Workflow execution, business rule processing, document generation, AI features, licensing, and usage data are handled by services FlowForma hosts in Azure. Those services call into your tenant; they do not hold your process content.
- All SharePoint access goes through two Entra ID enterprise applications. One runs in the context of the signed-in user, so SharePoint enforces that user’s existing permissions. The other runs app-only for operations that cannot be done as a user. Both must be consented at install time.
For the full picture, including diagrams, see Architecture overview,
Components, Data flow, and the
SharePoint permission model.
Reading data from SharePoint
Most processes need reference data that is already maintained somewhere in SharePoint: a cost centre list, an approved supplier list, an asset register. FlowForma reads it in two ways.
A Lookup question renders a drop-down populated from a SharePoint list column, with optional
filtering and ordering, so the user chooses from live reference data rather than a hard-coded choice
list. Get List Data goes further: it runs as a business rule on a form event and pushes list values
straight into questions, or into a repeating table
when you need several rows at once. It can also read document libraries and filter down to a specific
folder.
Both support Available offline, which caches the list on the device so the question still works in
the mobile app with no connection.
Writing data back to SharePoint
The same rules work in the other direction, so a process can maintain the lists it depends on rather than leaving someone to retype the result.- Add/update list item: create a new item in a list, or update an existing one, mapping form questions to list columns. The new item’s ID can be captured back into a question so later steps can act on it.
- Export Repeating Table data: push every row of a repeating table into a list in one operation, appending to or overwriting what is already there, with the option to skip empty rows.
- Delete list item: remove an item as an add-on to a rule that has already located it.
Whose permissions does a rule run under?
By default, a rule acts as the signed-in user, so SharePoint refuses anything that user could not do by hand. That is usually what you want, and it is what makes FlowForma’s access model auditable. It is also the most common cause of “the rule works for me but not for them”. Where a process legitimately needs to write to a list the user cannot see, for example a controlled register that ordinary staff must not browse, Add/update list item and Export Repeating Table data offer Use app permissions, which runs that single operation with the FlowForma application’s access instead. Use it deliberately and only on the rules that need it.Lists, libraries, and sites
A process can build the SharePoint structure it needs as it runs.- Create list or library: create a custom list or a document library, with the name and description taken from questions on the form, and the outcome written back to a status question.
- Create site: create a subsite from a template and set its owners, members, and visitors from person or group questions.
- Document Action Rule: check in, check out, rename, delete, or recycle a document in a library, and capture its SharePoint item ID.
Documents and permissions
Files uploaded to a form, and documents generated by it, are stored in the Form Documents library in your tenant, under a folder structure you can organise by flow, form, and step. It is an ordinary SharePoint document library, so views and permissions work the way they do anywhere else. Access is controlled at three levels.- Who can see the flow or the step: the Security wizard sets read and edit permissions for users and groups at flow and step level. Use it in preference to Step view permission rules.
- Who can open a specific document: the Reset document permission rule applies Read, Contribute, or Full Control to a document or its parent folder, for the people named in a person or group question, appending to or overwriting the inherited permissions. For security reasons it only applies to documents created through the Flow designer.
- What SharePoint itself allows: every operation is still subject to the site’s own permissions and your tenant’s conditional access policies. FlowForma does not sit outside them.
Sharing outside your organisation
Two features cover external access, and they solve different problems.- Generate Shareable Link produces an anonymously accessible link to a single file or folder using Microsoft’s External Sharing. Use it to send a finished document, for example an approved proposal, to someone outside the tenant. It requires a modern document library and external sharing enabled on the site collection.
- FlowForma Engage lets an external user complete a step of the process itself, either anonymously or authenticated with a Google or Microsoft account, without a licence in your tenant. Use it when the outsider has to supply information or make a decision, not just receive a file.
Related pages
SharePoint actions rules
Every rule that acts directly on SharePoint content.
Data integration rules
Reading and writing list data, SQL, APIs, and calendars.
SharePoint permission model
The two enterprise applications behind every SharePoint call.
Integration architecture
How FlowForma connects to Microsoft 365 and everything else.