> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowforma.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SharePoint integration
> How FlowForma works with SharePoint Online: where your data lives, reading and writing list data, creating lists, libraries and sites, document permissions, and sharing with people outside your organisation.
FlowForma is built on SharePoint Online. Your Flows, Forms, and documents are stored as SharePoint
lists, libraries, and files inside your own Microsoft 365 tenant, and the platform reads and writes
them using the same SharePoint APIs and the same SharePoint security you already run.
That has a practical consequence for process design: SharePoint is not a system you have to integrate
with, it is the system your process already lives in. A Flow can read a reference list, write a record
back, create the library the process needs, lock a document down to two named approvers, and hand a
link to a supplier outside your tenant, all without leaving the [Flow designer](/product/creating-flows/flow/flow-designer/overview).
## Where FlowForma sits in your tenant
FlowForma spans two boundaries, and it is worth being precise about which is which.
* **Your Microsoft 365 tenant holds your data.** Flows, Forms, form data, and documents are stored in
SharePoint Online in your tenant, in the region you have configured for Microsoft 365. The FlowForma
app is installed from the SharePoint app catalog and is built with Microsoft's SPFx framework.
* **FlowForma's Azure tenant runs the engine.** Workflow execution, business rule processing, document
generation, AI features, licensing, and usage data are handled by services FlowForma hosts in Azure.
Those services call into your tenant; they do not hold your process content.
* **All SharePoint access goes through two Entra ID enterprise applications.** One runs in the context
of the signed-in user, so SharePoint enforces that user's existing permissions. The other runs app-only
for operations that cannot be done as a user. Both must be consented at install time.
For the full picture, including diagrams, see [Architecture overview](/architecture/overview),
[Components](/architecture/components), [Data flow](/architecture/data-flow), and the
[SharePoint permission model](/architecture/permission-model).
## Reading data from SharePoint
Most processes need reference data that is already maintained somewhere in SharePoint: a cost centre
list, an approved supplier list, an asset register. FlowForma reads it in two ways.
| You want to | Use |
| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Let the user pick a value from a list | [Lookup question](/product/creating-flows/questions/question-types/lookup-question) |
| Pull one or many list items into the form automatically | [Get List Data](/product/creating-flows/business-rules/business-rule-types/data-integration-rules/get-list-data) |
| Let the user link to existing files in a library | [File links question](/product/creating-flows/questions/question-types/file-links) |
| Read a property from the user's Microsoft 365 profile | [Get user profile property](/product/creating-flows/business-rules/business-rule-types/data-integration-rules/get-user-profile-property) |
A **Lookup question** renders a drop-down populated from a SharePoint list column, with optional
filtering and ordering, so the user chooses from live reference data rather than a hard-coded choice
list. **Get List Data** goes further: it runs as a business rule on a form event and pushes list values
straight into questions, or into a [repeating table](/product/creating-flows/questions/question-types/repeating-table-question)
when you need several rows at once. It can also read document libraries and filter down to a specific
folder.
Both support **Available offline**, which caches the list on the device so the question still works in
the [mobile app](/product/mobile-app/overview) with no connection.
## Writing data back to SharePoint
The same rules work in the other direction, so a process can maintain the lists it depends on rather
than leaving someone to retype the result.
* [**Add/update list item**](/product/creating-flows/business-rules/business-rule-types/data-integration-rules/add-update-list-item):
create a new item in a list, or update an existing one, mapping form questions to list columns. The
new item's ID can be captured back into a question so later steps can act on it.
* [**Export Repeating Table data**](/product/creating-flows/business-rules/business-rule-types/repeating-table-rules/export-repeating-table-data):
push every row of a repeating table into a list in one operation, appending to or overwriting what is
already there, with the option to skip empty rows.
* [**Delete list item**](/product/creating-flows/business-rules/business-rule-types/business-rule-add-ons/delete-list-item):
remove an item as an add-on to a rule that has already located it.
Target the list dynamically with **List URL defined in a question** where several sites hold lists with
identical columns. You map the columns once, and the form decides at runtime which list to write to.
## Whose permissions does a rule run under?
By default, a rule acts as the signed-in user, so SharePoint refuses anything that user could not do by
hand. That is usually what you want, and it is what makes FlowForma's access model auditable.
It is also the most common cause of "the rule works for me but not for them". Where a process
legitimately needs to write to a list the user cannot see, for example a controlled register that
ordinary staff must not browse, **Add/update list item** and **Export Repeating Table data** offer
**Use app permissions**, which runs that single operation with the FlowForma application's access
instead. Use it deliberately and only on the rules that need it.
## Lists, libraries, and sites
A process can build the SharePoint structure it needs as it runs.
* [**Create list or library**](/product/creating-flows/business-rules/business-rule-types/sharepoint-actions-rules/create-list-or-library):
create a custom list or a document library, with the name and description taken from questions on the
form, and the outcome written back to a status question.
* [**Create site**](/product/creating-flows/business-rules/business-rule-types/sharepoint-actions-rules/create-site):
create a subsite from a template and set its owners, members, and visitors from person or group
questions.
* [**Document Action Rule**](/product/creating-flows/business-rules/business-rule-types/sharepoint-actions-rules/document-action-rule):
check in, check out, rename, delete, or recycle a document in a library, and capture its SharePoint
item ID.
If you are setting up reference lists by hand instead, see
[Create a list in SharePoint](/guides/how-to-articles/create-list-in-sharepoint) and
[Create a list from an existing template](/guides/how-to-articles/create-a-list-from-an-existing-template).
## Documents and permissions
Files uploaded to a form, and documents generated by it, are stored in the
[Form Documents](/product/form-documents) library in your tenant, under a folder structure you can
organise by flow, form, and step. It is an ordinary SharePoint document library, so views and
permissions work the way they do anywhere else. Access is controlled at three levels.
* **Who can see the flow or the step**: the [Security wizard](/product/security-wizard) sets read and
edit permissions for users and groups at flow and step level. Use it in preference to
[Step view permission](/product/creating-flows/business-rules/business-rule-types/permissions-rules/step-view-permission)
rules.
* **Who can open a specific document**: the
[Reset document permission](/product/creating-flows/business-rules/business-rule-types/permissions-rules/reset-document-permission)
rule applies Read, Contribute, or Full Control to a document or its parent folder, for the people
named in a person or group question, appending to or overwriting the inherited permissions. For
security reasons it only applies to documents created through the Flow designer.
* **What SharePoint itself allows**: every operation is still subject to the site's own permissions and
your tenant's conditional access policies. FlowForma does not sit outside them.
## Sharing outside your organisation
Two features cover external access, and they solve different problems.
* [**Generate Shareable Link**](/product/creating-flows/business-rules/business-rule-types/sharepoint-actions-rules/generate-shareable-link)
produces an anonymously accessible link to a single file or folder using Microsoft's External Sharing.
Use it to send a finished document, for example an approved proposal, to someone outside the tenant.
It requires a modern document library and external sharing enabled on the site collection.
* [**FlowForma Engage**](/product/flowforma-engage) lets an external user complete a step of the process
itself, either anonymously or authenticated with a Google or Microsoft account, without a licence in
your tenant. Use it when the outsider has to supply information or make a decision, not just receive a
file.
Generate Shareable Link creates a link that works for anyone who holds it. Pair it with
[Reset document permission](/product/creating-flows/business-rules/business-rule-types/permissions-rules/reset-document-permission)
and a considered expiry policy in SharePoint before using it for anything sensitive.
## Related pages
Every rule that acts directly on SharePoint content.
Reading and writing list data, SQL, APIs, and calendars.
The two enterprise applications behind every SharePoint call.
How FlowForma connects to Microsoft 365 and everything else.