This document discusses considerations for administrators when evaluating SharePoint Framework solutions. It raises questions about where solutions are hosted, what permissions and APIs they require, and if they allow embedding arbitrary scripts. The document recommends examining solutions closely with tools like Rencore to understand security, performance and upgrade impacts before deploying to production.

2. SharePoint Framework for administrators

5. rencore.com
• Where is the solution hosted?
• Does it require access to APIs?
• What JavaScript libraries does it use?
• Does it allow embedding arbitrary scripts?
• Can it be deployed globally?
• Does it activate extensions globally?
• What does it truly do?
Answer before deploying to production

6. rencore.com
• Who owns the hosting location
• Under which circumstances could the code change
• What is the SLA of the hosting location
Where is the solution hosted?

7. rencore.com
• Approved permissions can be used by all solutions but
also arbitrary scripts embedded on pages!
• Isolated web parts solve this but currently in preview
Does it require access to APIs?

8. rencore.com
• Does anyone know this library in your organization
• Where does it load libraries from
• What is the SLA of the hosting location
• What is the license of the library
• Are there any known vulnerabilities
What JavaScript libraries does it use?

9. rencore.com
• Circumvents the security measures offered by SPFx!
Does it allow embedding arbitrary scripts

10. rencore.com
• Simplifies consistency across all sites
• Doesn’t deploy site-level resources!
Can it be deployed globally?

11. rencore.com
• Simplifies consistency across all sites
• If you’re not careful you will enable functionality on all
sites!
Does it activate extensions globally?

12. rencore.com
What does the solution truly do?

13. rencore.com
• Don’t waste time on manually breaking open the package
and digging through the code
• With Rencore you will easily see:
• What’s inside the solution package
• If the solution has any vulnerabilities
• If the solution exposes you to any risks (eg. security, performance, upgrade)
• What is the impact of the solution on your environment
• More information at rencore.com
Easily examine solution’s contents and quality with
Rencore

14. rencore.com
• Trust developers but verify
• SharePoint Framework solutions are Full-Trust, treat
them as such
• Mind API grants
• Watch out for external scripts
• Manual inspection is tedious. Use tools
Takeaways

15. Free e-book. Learn:
- What is SharePoint
Framework?
- Considerations
- Solution management
- Security & governance
…and more!
url.rencore.com/spfx4admins

16. Waldek Mastykarz
Head of Product
SharePoint MVP
https://blog.mastykarz.nl
@waldekm

17. Secure. Modernize. Empower.