Set Arborations up for your company

In one line

Delegated permissions only (User.Read, Sites.Selected), no secrets or certificates, and access to one SharePoint site that you create and grant. Nothing else in the tenant. Arborations cannot do anything when nobody is signed in, and every action appears in your sign-in logs as a named person.

Arborations (63686792-1aa5-4dc4-9d27-2b2a215a7376) is the one registration the desktop app, the phone app and the QGIS plugin sign in as, and the one that holds those permissions. Arborations Setup (76e252f9-d6dc-4de7-8dd7-5160d0208f57) is a second, separate registration used only on the desktop app's set-up page: it can see all sites, which is what creating one and handing Arborations the key needs, and which Arborations itself must never be able to do. It acts only as the administrator who is signed in to it, only while they are, and it can be removed from your Entra the moment set-up is done. Both are published by SG Arboricultural Consulting.

The short way: from the desktop app

1. Install Arborations on your own computer, from the Download page, and open it.

2. Press Set up Arborations for your company, on the Home page or under System › Set up. Seven lines, each with one button; the button at the top always does the next one:

1. The administrator signs in. A Microsoft 365 Global Administrator. Microsoft asks twice for Arborations Setup: once for its Microsoft Graph permissions (Have full control of all site collections, Sign in and read user profile), once for SharePoint (Have full control of all site collections). Accept both; it is this sign-in, and nothing stored, that the next three steps run as.
2. The site. Leave the name as Arborations and press Create or use it: a private team site appears at /sites/Arborations with you as its owner. If your administrator has already made a site, paste its address instead and it is used as it is.
3. Arborations is given the site. One button. This is the step that otherwise needs PowerShell. Arborations can now reach this site and no other.
4. Arborations signs in. The same account again, this time to Arborations itself. Microsoft shows Arborations' own prompt: the three items in step 3 below, nothing tenant-wide. Tick Consent on behalf of your organisation.
5. The licence. Type your company's name and start the free trial. It begins at once and covers everyone.
6. Arborations' lists are created on the site. A minute or two.
7. The people. Paste the sign-in addresses of everyone who will use Arborations, one per line. They become members of the site. More can be added later from the site's own members page.

3. Everyone signs in. The page ends by saying what to tell them: install the desktop app or the phone app, paste the site address, sign in with their own account. The QGIS plugin installs from the desktop app's Settings page.

The long way: by hand

Everything the set-up page does, as steps an administrator can take in the SharePoint admin centre, Entra and PowerShell, for an organisation that would rather not consent to a set-up helper at all. The result is identical.

Before you start

Who does this: someone who is a Global Administrator in Microsoft 365 (for step 3) and a SharePoint Administrator (for steps 1 and 4). In most small companies that is one person, often whoever set up Microsoft 365, or the IT provider.

What you need to hand: your tenant name (the part before .sharepoint.com when you open SharePoint), the names of the people who will use Arborations, and which one of them will connect first. Everyone who uses Arborations needs a Microsoft 365 licence that includes SharePoint, which every Business and Enterprise plan does.

What you end up with: one private SharePoint site that holds everything Arborations records, Arborations allowed into that site and nothing else, your people as members of it, and a trial licence for the organisation. The steps are in the order they have to happen.

1. Create a dedicated SharePoint site
2. Give your people access to it
3. Consent to the Arborations app
4. Grant the app that one site
5. Start the free trial
6. Connect and create the lists
7. Each person installs and signs in

Step 1. Create a dedicated SharePoint site

Arborations lives in one SharePoint site of its own. Everything it records, trees, projects, jobs, photos, the crew board, is a list or a library on that site, in your tenant, owned by you.

1. Go to admin.microsoft.com and sign in as an administrator. In the left menu choose Show all › SharePoint. That opens the SharePoint admin centre.
2. In its left menu choose Sites › Active sites, then press + Create at the top.
3. Choose Team site. If it asks for a template, choose the Standard team template.
4. Fill in the form:
   • Site name: Arborations. The site address fills itself in as /sites/Arborations; leave it.
   • Group owner: the person who will connect first and create Arborations' lists (step 6).
   • Privacy settings: Private. Only people you add can see it.
   • Language and time zone: yours. The language cannot be changed afterwards.
5. Press Next. It offers to add members now; you can do that here or in step 2. Press Finish.
6. Open the new site once and copy its address from the browser. It looks like https://yourtenant.sharepoint.com/sites/Arborations. Keep it: every person pastes this same address into the desktop app and the phone app.

The same steps in pictures. The site in them has its own name; the name is yours to choose, as long as everyone uses the address it produces.

Photos taken on site are stored here too. A tree survey of a few hundred trees with photos is a few gigabytes; a new site's default storage is plenty, and it draws on the tenant's pooled storage rather than a fixed quota.

Step 2. Give your people access to that site

Arborations can only reach what the signed-in person can reach, so membership of this site is how you decide who can use Arborations. There is no separate user list to keep.

1. Open the Arborations site in the browser. Press the Settings cog at the top right › Site permissions (on some tenants Site information › View all site settings › Site permissions).
2. Press Add members › Add members to group. Type each person's name and add them. Everyone who will use Arborations, in the office or in the field, goes in as a Member.
3. Make the person who will connect first an Owner: next to their name, change Member to Owner. Creating Arborations' lists on the site (step 6) needs owner rights; using Arborations afterwards does not.

A new starter later is just a new member of the site; someone who leaves is removed from it, and their access to Arborations ends with it. If you prefer, make a Microsoft 365 group or security group the member instead and manage people there.

Step 3. Consent to the Arborations app

Arborations signs people in through Microsoft's own sign-in page, as a registered application. The first time, Microsoft asks an administrator to agree to what the app may do for the organisation. The prompt is headed Permissions requested, names Arborations, and lists three things:

There are two ways to give that consent. Either is fine; do one.

At the first sign-in. A Global Administrator installs the desktop app (Download), opens Deployment, pastes the site address from step 1 and presses Connect Microsoft 365. Microsoft's page opens and shows Permissions requested, with the two items above. Tick Consent on behalf of your organisation, then press Accept. Done; the administrator carries straight on to step 5.

From a link. Signed in as a Global Administrator, open this; Microsoft shows the same prompt and Accept consents for the organisation:

The page it lands on afterwards may say the address could not be reached; the consent has still been recorded. Alternatively, in the Entra admin centre: entra.microsoft.com › Identity › Applications › Enterprise applications, find the app (it appears once anyone in your tenant has tried to sign in to it), open it, choose Permissions and press Grant admin consent for your organisation.

The word unverified under the name means Arborations has no Microsoft Partner Center badge, which is a partner-programme enrolment rather than a security check. The publisher is SG Arboricultural Consulting; the app registration ID below is how you confirm it.

If a person who is not an administrator signs in first, Microsoft shows Need admin approval instead. Nothing is wrong: they can type a note and press Request approval, or an administrator does one of the two things above and the person signs in again.

App registration, for your records: 63686792-1aa5-4dc4-9d27-2b2a215a7376, published by SG Arboricultural Consulting. There are no application permissions, no client secrets and no certificates: Arborations can do nothing while nobody is signed in, and every action appears in your sign-in logs as a named person.

Step 4. Grant the app that one site

Sites.Selected means Arborations can reach no site at all until an administrator names one. This step names the Arborations site, and only it. It is done once, with PnP PowerShell, Microsoft's community-maintained PowerShell module for SharePoint. Allow ten minutes the first time.

Install PnP PowerShell if the computer does not have it. Open PowerShell (on Windows, PowerShell 7 from the Start menu; on a Mac, install PowerShell from Microsoft, then run pwsh in Terminal) and run:

Register PnP once in your tenant. PnP PowerShell signs in through an app registration of its own, which a tenant has to have before it can connect. Skip this if your tenant already uses PnP. Run it as a Global Administrator; a browser window opens to consent:

It prints an application id (a client id). Keep it; the next command uses it.

Connect to the Arborations site as a SharePoint Administrator, then grant Arborations the site:

Replace yourtenant with your tenant name in both places. If your tenant already had PnP set up before 2024, Connect-PnPOnline works without -ClientId.

Check it. Still connected to the Arborations site:

It lists Arborations with Manage. Connect to any other site and run it again: Arborations is not listed. That is the whole of what Arborations can reach.

Why Manage. Arborations creates its own lists and libraries on the site the first time it connects (step 6), and Write does not allow creating lists. Manage is still confined to this one site; it gives Arborations nothing anywhere else.

To take it away later: Revoke-PnPAzureADAppSitePermission on the site, or delete Arborations under Enterprise applications in Entra. Access stops at once and the data stays in your SharePoint.

Step 5. Start the free trial

Open Arborations and sign in with your Microsoft 365 account (Deployment › paste the site address › Connect Microsoft 365). Because the organisation has no licence yet, the desktop app says so and points you to its Account page, under System in the left menu.

In the Start a free trial box, type your company's name and press Start a free trial. The trial begins at once, covers everyone in the organisation, and the Status line shows the day it ends. Then go back to Deployment and press Connect Microsoft 365 again to carry on.

The only things sent are your organisation's tenant ID and the company name you typed. One trial per organisation; when it ends, or to go straight to a subscription, email hello@arborations.com.au quoting the licence key the Account page shows.

Step 6. Connect and create the lists

Done once, by the site owner from step 2, in Arborations.

1. Deployment › paste the full site address into SharePoint site address › Connect Microsoft 365 › sign in. The right-hand card shows who is signed in; the status line says the site was found.
2. Press Provision SharePoint Lists. The desktop app creates Arborations' lists and libraries on the site: a minute or two, with progress shown as it goes. When it finishes, the Home page's Getting set up card ticks Arborations' lists on the site.
3. Add your people under Organisation › Consultants, so they can be put on projects and jobs. That is the last tick on the Home card, and it disappears.

Provisioning is safe to run again at any time, including after a Arborations update that adds a list or a column: it only ever adds what is missing and never changes or removes data. Check this site against the schema reports what is missing without changing anything.

Step 7. Each person installs and signs in

Desktop (Mac or Windows): install, open Deployment, paste the same full site address, press Connect Microsoft 365 and sign in with their own account. The desktop app keeps no sign-in between sessions, so Connect is pressed each time it opens. New versions are offered inside the desktop app.

Phone (iPhone, iPad, Android): on iPhone and iPad install through TestFlight; on Android from the beta invitation. On the sign-in screen enter the same site address under Your Arborations site, then sign in.

QGIS plugin (the consultants who draw plans): install QGIS 3.44 LTR, then in Arborations › Settings › Install the plugin into QGIS, restart QGIS, and press Sign in on the Arborations toolbar. The Download page has the zip route for a computer without the desktop app.

Nothing else is set up per person. What they can see and do follows from the site membership in step 2.

If something doesn't work

Checking it afterwards

Three checks, any time: Get-PnPAzureADAppSitePermission against any other site shows no Arborations; the Entra sign-in logs show Arborations sign-ins as named people; and the Arborations site's permissions page lists exactly the people you expect.

Questions IT usually asks