Questions & Answers Overview
Questions and Answers is a SharePoint Framework web part that stores everything in a SharePoint list of your own site and reads and writes it with the rights of the signed-in user. That single fact answers most security questions, but the details matter when you decide who may ask, who may publish and what leaves the tenant. This article is the reference for those decisions.
Summary for administrators
| Question | Answer |
|---|---|
| Which API permissions does the package request? | None |
| Whose identity is used? | The signed-in user, for every read and write |
| Where are questions, answers, attachments and comments stored? | In one SharePoint list on the site where the web part runs |
| Does the web part store anything elsewhere? | The product stores questions, answers, attachments and comments in the site’s SharePoint list. This is not a guarantee that every browser request or every dependency stays within the tenant. |
| Who can read the knowledge base? | Everybody with Read on the list and page |
| Who can ask a question? | Users with the Add Items permission on the list |
| Who can publish answers? | Users who can edit items of the list |
| What is sent to Vitextra? | Technical identifiers for the license check and usage telemetry; no content |
| Third-party services? | The shown license request contains technical identifiers, not question or answer fields. External images in Markdown, remote video URLs and links can contact their hosts. The Application Insights SDK and SharePoint components also make requests; assess their configuration and the content you publish rather than treating this article as a guarantee of no third-party traffic or browser storage. |
Permissions of the solution
- The package requests no API permissions: nothing appears on the API access page of the SharePoint admin center, and the web part never calls Microsoft Graph.
- The web part uses the SharePoint REST API of the current site to read lists, items, attachments and comments, to create the list and its columns, to add a question and to add a comment. Every call carries the identity of the signed-in user; SharePoint applies its permissions to each one.
- The live profile card of the contact person and of mentioned users is the standard SharePoint component, loaded from SharePoint itself.
The list
The web part creates (or connects to) a custom list with the columns described in KB10382. Questions and Answers Web Part Settings Reference. It is an ordinary list in Site contents:
- it inherits the permissions of the site unless you break the inheritance;
- Retention, eDiscovery, auditing and backup depend on the tenant’s configured services, policies and licensing; this web part does not configure or guarantee them.
- versioning can be enabled in the list settings to keep the history of answers;
- it is created with NoCrawl set, so its items do not appear in SharePoint search results or in Microsoft 365 search - the web part has its own search. If you want the questions to be found by the global search, set Allow items from this list to appear in search results to Yes in List settings → Advanced settings;
- deleting the web part from a page does not delete the list; deleting the list deletes the questions, their attachments and comments (recoverable from the recycle bin for the usual period).
The web part's own settings - the connected list, the switches, sort and page size - are stored in the web part properties of the page.
Who can do what
Three roles follow from the SharePoint permission levels on the list:
| Role | Needs | Can |
|---|---|---|
| Reader | Read on the list (and on the page) | Browse, search, expand answers, open attachments, follow links, copy links to questions, see comments |
| Asker | Add Items on the list - included in Contribute and Edit | Everything a reader can, plus Ask a Question and adding comments |
| Editor | Edit Items on the list - included in Contribute and Edit | Everything above, plus writing answers, setting categories, attachments, and Published = Yes |
The Ask a Question button is shown only when the web part confirms that the user has Add Items on the list; the switch in the property pane enables the feature, the permission decides who sees it. Unpublished questions are never returned to the web part, whatever the user's permissions; an editor sees them only in the list.
Limits of item-level permissions
Contribute normally allows users to add and edit items, including changing Published. The following setting limits editing to the user’s own items; it does not reserve publication for editors:
- Open the list, Settings → List settings → Advanced settings.
- Under Item-level Permissions, set Create and Edit access to Create items and edit items that were created by the user.
- Give the audience Contribute and configure the editors’ effective permissions separately. The Edit Items permission alone does not bypass item-level restrictions; Manage Lists does. The default Edit permission level includes Manage Lists. Microsoft
Users can still edit their own submission and set Published = Yes. There is no field-level publication control here. Read all items also allows reading unpublished items directly in the list; Published is only a web-part display filter. If strict editorial control or draft confidentiality is required, use separately configured and tested SharePoint permissions and a suitable workflow.
❗ Important
Add Items on the list implies the ability to add attachments and comments to one's own items through the SharePoint user interface, not only through the web part. Keep the list's advanced settings (attachments, comments) in line with what you want to allow.
Guests
Guest users with access to the site are readers or askers according to their permission level; the live profile cards may show less information for guests. External sharing of the page does not share the list: a person who can open the page but not the list sees an error instead of the questions.
Attachments and comments
Attachments are stored with the list item in the list's own attachment folder; they follow the item's permissions and are deleted with it. Comments are the SharePoint list comments of the item (see KB10381. Comments, @Mentions and Deep Links in Questions and Answers); they can be disabled for the list in Advanced settings → Comments.
What is sent outside the tenant
| Purpose | What is sent | Where |
|---|---|---|
| License check | The Tenant ID, the object ID of the user, the site address, the identifier, name and version of the product | vitextra.com |
| Usage telemetry | An event on each web-part render: version, site ID and URL, user object ID, site language ID, culture name, Teams flag and web-part name. Application Insights SDK collection must also be reviewed; the product code does not explicitly report caught data-service errors through trackException. | Azure Application Insights |
| Product files | An ordinary request for the scripts and icons of the web part | static.vitextra.com, vitextra-storage.azureedge.net |
| Video players | When a question has a YouTube or Vimeo address and Video is shown: the browser loads the player from youtube.com or player.vimeo.com, which see the ordinary request of the user's browser | YouTube, Vimeo |
| File-type icons | Icons for attachment cards, loaded from Microsoft's CDN | static2.sharepointonline.com |
The shown license request contains technical identifiers, not question or answer fields. External images in Markdown, remote video URLs and links can contact their hosts. The Application Insights SDK and SharePoint components also make requests; assess their configuration and the content you publish rather than treating this article as a guarantee of no third-party traffic or browser storage. KB10363. Where Vitextra Products Store Your Data: Privacy, Data Residency and GDPR
📝 Note
A direct SharePoint video URL uses the browser player and requests the video from SharePoint. Hiding Video does not block external Markdown images or followed links; check all published URLs.
Reporting and export
Because the content is a list, the standard tools apply: Export to Excel from the list command bar, a Power BI report on the list (for example, questions per category, unanswered submissions by age), a Power Automate flow that notifies the editors when a question is submitted (trigger When an item is created with Published = No), and list alerts for the same purpose.
