Windows desktop admin tool for Lightning Tools SPFx apps in SharePoint Online. Download the latest version here.
As of November 2026, the only app-specific features are related to DeliverPoint Online, but some of the features can be used with any of our SPFx apps.
The app includes these features: tenant configuration, Site Collection app catalog deployment, tenant app catalog sync, and Microsoft Graph audit-log permission approval. It provides a guided UI for tasks that would otherwise require manual PowerShell scripting against SharePoint and Microsoft Graph.
See the end of this article, as well as the tooltips on each tab in the application, for information about permissions and access required for this app.
Application Tabs
DeliverPoint Tenant Settings
Purpose: Read/write DeliverPoint tenant storage keys on the tenant App Catalog site
Edits four storage keys used by the DeliverPoint SPFx web part via PnP storage entity APIs on the tenant App Catalog root web. Admins configure display options, export/job URLs, discover-permissions behavior, and storage management flags without editing SharePoint directly.
Required Permissions
Access to read/write app storage on the tenant App Catalog site. The signed-in account must be a Site Collection Administrator on the tenant App Catalog URL.
Usage
- Enter the tenant App Catalog HTTPS URL (e.g. https://contoso.sharepoint.com/sites/appcatalog).
- Enter the tenant root URL if prompted for PnP registration on first use.
- Click Load settings to read current values from SharePoint.
- Modify checkboxes, URLs, and AD group ignore list as needed. See below for details.
- Click Save settings to write all values in one batch.
- Use Clear sign-in to switch accounts on this PC.
Display & Access
This section sets values in the _lt_deliverPointCommonOptions tenant-wide variable.
Hide user avatars: By default, user avatars (profile pictures and cards) are displayed in DeliverPoint reports. This option allows them to be hidden.
Hide operations for non site collection admins: Permission operations (such as Grant and Copy permissions) are by default visible to anyone who can see the DeliverPoint menu, though only people with Full Control to the specified scope can actually use these operations. Checking this box will make these operations visible only to Site Collection Admins. (Note that if a non-SCA has generated a report, then the Actions menu will appear, but will only show the Export Report action.)
Export & Jobs
The following three options also set values in the _lt_deliverPointCommonOptions tenant-wide variable.
Use CSV format for export (not Excel): By default, DeliverPoint report exports are in Excel format. This option changes the export file to .csv instead.
Enable job rollback by default: The Rollback option for any DeliverPoint action is by default not enabled. Enabling this option globally will enable Rollback by default for all actions, although users can still disable Rollback on a given action.
Hide AD group modifying option in jobs: Only users who have the permission in M365 to modify M365 Group membership can actually do so, but this setting hides it entirely.
DeliverPoint Service URL: This optional field can be used to set the _lt_deliverPointServiceUrl tenant variable for the DeliverPoint Scheduling feature. This URL is set automatically during Azure deployment of the Scheduling feature.
Jobs Actions Web URL: This optional field can be used to set the _lt_deliverPointJobsActionsWebUrl tenant variable, which allows you to set a specific site where you wish to store DeliverPoint Job details (in a hidden list) and Report Template configurations (in a hidden list named LTReportTemplatesDPSPFX).
Discover Permissions
Include ignored AD groups in discover permissions report
AD groups to ignore: Here you can enter (and remove) Entra groups that should not appear on Discover Permissions Reports. This may be useful to reduce "noise" in your reports, by not reporting permissions for groups such as the "Everyone but external users", or other org-wide groups, that always have certain permissions to everything. However, note that users will not be aware that those groups are being ignored, so they may think they have a complete picture of permissions when they might not.
Storage
Disable storage management: This option removes DeliverPoint's Storage Management menu if your organization does not intend to purchase this add-on. Otherwise, if this feature has not been purchased, the menu options will appear greyed-out.
App Catalog Deployment
Overview
List site collections, create site collection app catalogs, upload/deploy .sppkg packages
Manages site collection app catalogs across a SharePoint tenant. Admins can enumerate site collections, create missing app catalogs, and upload/deploy or remove .sppkg packages to selected catalogs. This operates against site collection app catalogs — not the tenant-level app catalog URL used on the Storage Settings tab.
Usage Workflow
Enter the tenant root URL (https://contoso.sharepoint.com) and complete PnP sign-in/registration if needed.
Click Load site collections to populate the grid with catalog status.
Select sites, then click Create app catalog where catalogs are missing.
Browse to a .sppkg file.
Select target catalogs and click Upload and deploy (or remove packages from selected catalogs).
Use search/filter and select-all controls for bulk operations.
Site Collection Catalog Status
Status Meaning
Checking Status probe in progress
Enabled Site collection app catalog exists and is accessible
NotEnabled No site collection app catalog — can be created
Unavailable Catalog exists but is not accessible to the signed-in user
UnknownError Unexpected error during status check
Technical Details
Component Path
View Features\AppCatalogDeployment\AppCatalogDeploymentView.cs
Runner Shared\Pnp\DpAdminPnpPowerShellRunner.cs
Grid models SiteCatalogGridRow.cs, SiteCollectionCatalogStatus.cs
SPPKG manifest Shared\SppkgManifestReader.cs
PowerShell scripts:
Invoke-DpAdminPnPConnect.ps1 — shared PnP sign-in/session
Register-DpAdminPnPApp.ps1 — Entra ID app registration
Get-TenantSiteCatalogStatus.ps1 — list site collections + catalog status
Add-SiteCollectionAppCatalogs.ps1 — create missing catalogs
Deploy-SiteCollectionAppPackage.ps1 — upload and deploy .sppkg
Remove-SiteCollectionAppPackage.ps1 — remove packages from catalogs
Runner methods: LoadTenantSiteCatalogStatusAsync, CreateSiteCollectionAppCatalogsAsync, DeploySiteCollectionAppPackageAsync, RemoveSiteCollectionAppPackageAsync
Default catalog browse URL pattern: {siteCollectionRootUrl}/appcatalog
Required Permissions
SharePoint Administrator / tenant admin — for creating site collection app catalogs
Site Collection Administrator (or equivalent) on target site collections — for upload/deploy/remove operations
Tenant App Web Deployment
Overview
Browse tenant site/web tree, scan installed app instances, sync deployment to selected webs
Deploys or removes the DeliverPoint tenant catalog app on specific site collections and subsites. Includes a tenant-wide scan to inventory where the app is installed. Uses the tenant App Catalog (not site collection catalogs) as the package source.
Inner Sub-Tabs
Sub-Tab Purpose
Deploy/Remove Site/subsite TreeView — select webs and deploy or remove the tenant catalog app
Scan Tenant Inventory grid showing Title, Web URL, and Version on each web where the app is installed
Usage Workflow — Deploy/Remove
Enter the tenant App Catalog URL (persisted to settings.json).
Browse and select a .sppkg — the app validates it against the tenant catalog.
Click Load sites to build an expandable TreeView of site collections and subsites.
Check target webs in the tree.
Click Deploy to install or Remove to uninstall the tenant app on selected webs.
Use the search box to filter the site tree (debounced filter).
Usage Workflow — Scan Tenant
Switch to the Scan Tenant sub-tab.
Run a tenant-wide scan to find all webs with the DeliverPoint app installed.
Review the grid (Title, Web URL, Version) and use search to filter results.
Cancel an in-progress scan if needed.
Technical Details
Component Path
View Features\TenantAppWebInstallation\TenantAppWebInstallationView.cs
Tree rendering SiteWebTreeNodeTag.cs, SiteWebTreeNodeTextRenderer.cs
Scan grid TenantAppWebInstallScanGridRow.cs
Access errors SiteWebAccessErrorHelper.cs
PowerShell scripts:
Get-TenantCatalogPackageStatus.ps1 — validate .sppkg against tenant app catalog
Get-TenantSiteWebTree.ps1 — build site collection / subsite tree
Sync-TenantAppWebDeployment.ps1 — install/uninstall tenant catalog app on selected webs
Scan-TenantAppWebInstallations.ps1 — scan tenant for app installations
Runner methods: GetTenantCatalogPackageStatusAsync, GetTenantSiteWebTreeAsync, SyncTenantAppWebDeploymentAsync, ScanTenantAppWebInstallationsAsync
Package validation reads the SPPKG manifest via SppkgManifestReader to match product ID against the tenant catalog. Session state tracks validated catalog title, version, and app ID across operations.
Required Permissions
Site Collection Administrator (or equivalent) on target webs for deploy/remove. Tenant-wide read access for site tree loading and scan operations. Access to the tenant App Catalog for package validation.
Audit Log Permission
Overview
Approve Microsoft Graph permission for SPFx audit log scenarios
Grants the Microsoft Graph permission AuditLogsQuery.Read.All to the SharePoint Framework (SPFx) service principal, enabling DeliverPoint SPFx audit log scenarios. Uses Microsoft Graph PowerShell — not PnP.PowerShell.
Usage Workflow
Navigate to the Audit Log Permission tab.
Click Approve audit permission.
Complete Microsoft Graph sign-in (interactive or device-code flow).
Review the result: Granted, Already granted, or error details.
Device-code mode shows the login URL and code in the UI while running PowerShell hidden. Visible-console mode opens a PowerShell window for interactive login.
Graph Permission Details
Property Value
Permission scope AuditLogsQuery.Read.All
Resource (Microsoft Graph) 00000003-0000-0000-c000-000000000000
SPFx service principal 08e18876-6177-487e-b8b5-cf950c1e598c
Graph login scopes Application.ReadWrite.All, Directory.ReadWrite.All
Result States
Result Meaning
RESULT:GRANTED Permission was newly granted to the SPFx service principal
RESULT:ALREADY_GRANTED Permission already exists — no action needed
ERROR: ... Failure (missing Graph module, auth failure, insufficient privileges, etc.)
Technical Details
Component Path
View Features\ApiPermissionApproval\ApiPermissionApprovalView.cs
Runner SpfxAuditLogPermissionPowerShellRunner.cs
Execution modes SpfxAuditLogGrantExecutionMode.cs — visible console vs hidden device-code
Script Scripts\Grant-SpfxAuditLogPermission.ps1
The script uses Connect-MgGraph, Get-MgServicePrincipal, and Get-MgServicePrincipalOauth2PermissionGrant to check for existing grants before creating a new OAuth2 permission grant. Result is written as a one-line string to DPADMIN_GRANT_RESULT_FILE.
Required Permissions
Global Administrator or another Entra ID role that can grant Microsoft Graph application permissions via the device-login approval flow.
Technical Information
What is DeliverPoint Admin?
DeliverPoint Admin is a Windows desktop admin panel for managing DeliverPoint SharePoint Online deployments.
The application does not embed SharePoint CSOM or MSAL libraries. Instead, C# orchestrates the UI and launches PowerShell 7 child processes that perform all remote operations via PnP.PowerShell (tabs 1–3) or Microsoft Graph PowerShell (tab 4).
Architecture
┌─────────────────────────────────────────────────────────────┐
│ MainForm (Shell) ← DeliverPointAdmin\Shell\MainForm.cs
│ ├── PowerShell7InstallSection (prerequisite installer links)
│ ├── TabControl → 4 Feature UserControls (one tab per feature)
│ └── AppStatus (status bar)
└──────────────────────────┬──────────────────────────────────┘
│ spawns pwsh processes
▼
┌─────────────────────────────────────────────────────────────┐
│ PowerShell 7 scripts Features\*\Scripts\
│ ├── PnP.PowerShell (Tabs 1–3)
│ └── Microsoft.Graph (Tab 4)
└──────────────────────────┬──────────────────────────────────┘
│
▼
SharePoint Online / Microsoft Graph
Tech Stack
Layer Technology
UI WinForms (.NET 8, net8.0-windows)
Orchestration C# launches PowerShell 7 (pwsh) child processes
SharePoint operations PnP.PowerShell — storage entities, ALM app APIs, site/web tree
Graph operations Microsoft Graph PowerShell — OAuth2 permission grants
Authentication PnP interactive Entra ID app registration (device login); Graph device/interactive login
Packaging Advanced Installer (DeliverPointAdmin.aip)
Local config %AppData%\LightningTools\DeliverPointAdmin\settings.json
Requirements
To run the app:
Windows 10/11 x64 (ARM64 supported for bundled PowerShell 7 installers)
PowerShell 7 (pwsh) — required for all tabs
PnP.PowerShell — installed on demand when a tab needs it
Microsoft Graph PowerShell — required only for the Audit Log Permission tab
SharePoint Online permissions appropriate to each task
To develop: Visual Studio 2022 or .NET 8 SDK; open DeliverPointAdmin.sln.
Project Layout
DeliverPointAdmin/
├── Program.cs → entry point
├── Shell/ → MainForm, AppStatus, PowerShell7InstallSection
├── Features/ → one folder per tab (View + Scripts + models)
│ ├── TenantStorageSettings/
│ ├── AppCatalogDeployment/
│ ├── TenantAppWebInstallation/
│ └── ApiPermissionApproval/
├── Shared/ → PnP runner, config, auth, utilities
└── Redist/PowerShell7/ → bundled PowerShell 7 MSIs
Authentication (PnP)
Tabs that talk to SharePoint use PnP.PowerShell with a tenant-specific Entra ID app registration:
Enter the tenant root URL (e.g. https://contoso.sharepoint.com) on the relevant tab.
On first use, the app prompts to register PnP via Register-PnPEntraIDAppForInteractiveLogin (device login).
The resulting client ID is saved locally in settings.json under pnpTenantRegistrations.
Use Clear PnP sign-in on a tab to sign in with a different account.
There is no fixed Entra client ID in source code. Optional override: environment variable DPADMIN_PNP_CLIENT_ID. PnP login cache lives in ~\.m365pnppowershell.
C# ↔ PowerShell Contract
Scripts communicate results back to the WinForms host via environment variables and temp JSON files:
Environment Variable Purpose
DPADMIN_APP_CATALOG_RESULT_FILE Path for JSON result output (PnP tabs)
DPADMIN_APP_CATALOG_PAYLOAD_FILE Path for batch operation input payload
DPADMIN_TENANT_ROOT_URL SharePoint tenant root URL context
DPADMIN_PNP_CLIENT_ID Optional PnP client ID override
DPADMIN_PNP_TENANT_NAME Optional tenant name override
DPADMIN_GRANT_RESULT_FILE One-line result for Graph permission grant
DPADMIN_GRANT_AUTH_MODE DeviceCode or interactive for Graph login
Local Settings File
Path: %AppData%\LightningTools\DeliverPointAdmin\settings.json
{
"tenantAppCatalogUrl": "https://yourtenant.sharepoint.com/sites/appcatalog",
"tenantRootUrl": "https://yourtenant.sharepoint.com",
"pnpTenantRegistrations": [
{
"tenantRootUrl": "https://yourtenant.sharepoint.com",
"tenantName": "yourtenant.onmicrosoft.com",
"clientId": "00000000-0000-0000-0000-000000000000",
"applicationName": "DeliverPoint Admin PnP",
"registeredUtc": "2026-01-01T00:00:00Z"
}
]
}
Run, Build & Installer
Run from source:
dotnet run --project .\DeliverPointAdmin\DeliverPointAdmin.csproj
Build output is copied to DeliverPointAdmin\publish\ for Advanced Installer. The bootstrapper installs .NET Desktop Runtime 8 and PowerShell 7 if missing, then installs the app to %ProgramFiles%\DeliverPoint Admin\.
Technical Details for the DeliverPoint Tenant Settings tab
Component Path
View Features\TenantStorageSettings\TenantStorageSettingsView.cs
Runner TenantStorageSettingsPowerShellRunner.cs → DpAdminPnpPowerShellRunner
Options enum DeliverPointCommonOptions.cs
AD groups editor Controls\AdGroupsEditorControl.cs
PowerShell scripts:
Invoke-DpAdminTenantStorageSettings.ps1 — shared PnP session + storage entity helpers
Get-TenantStorageSettings.ps1 — load snapshot from SharePoint
Save-TenantStorageSettings.ps1 — batch write via Set-PnPStorageEntity
Storage entities use Tenant scope for writes; legacy Site scope values are read for migration compatibility. Connection targets the tenant App Catalog URL specifically.