Permissions and security
coOrgChart is a SharePoint Framework (SPFx) web part. Its code runs in the browser of the person viewing the page, with that person’s own permissions.
Microsoft Graph permissions
| Permission | Type | Used for |
|---|---|---|
User.Read.All |
Delegated, read | People, managers, job titles, photos and extension attributes. |
Presence.Read.All |
Delegated, read | Teams presence on the cards. Optional. |
GroupMember.Read.All |
Delegated, read | Group filters (“only show members of group”). Optional. |
SharePoint grants these permissions once for the whole tenant. Approve them in the SharePoint admin center › Advanced › API access. coOrgChart never writes to Entra ID or Microsoft Graph.
The optional SharePoint list for additional employees is read with the viewer’s normal SharePoint permissions. Only the button that creates the list writes to SharePoint, and it needs permission to manage lists on that site.
Where your data is processed
- In the browser. coOrgChart loads the directory directly from Microsoft Graph into the viewer’s browser and builds the chart there.
- Cached on the device. To make repeat visits fast, the directory is cached in the browser’s local storage (12 hours by default, 0 to 72 hours configurable) and photos for 7 days. “Reload data now” clears the cache.
- Exports are created locally. PNG and PDF files are generated in the browser and saved on the device.
What reaches compleo
No names, photos or other directory data are ever sent to compleo or any other third party.
To check the licence, coOrgChart sends your tenant ID, your SharePoint address, its version, the number of people in the chart (only the number) and, once entered, your licence key to the compleo licence service, about every three days per browser. This service only stores what it needs to manage trials and subscriptions. Details are in the privacy policy. If the service can’t be reached, coOrgChart keeps working.
Good to know
- Filters and views control what the chart displays. They are not a security boundary: users can read the directory in other Microsoft 365 apps anyway.
- Disabled accounts and guests are never shown.