Library & File Plan Manager

1. SharePoint List: LibraryFilePlan

Location: your main site — https://modgovuk.sharepoint.com/teams/1598/.

LibraryFilePlan_list_template.csv — download this, then Site Contents → New → List → From CSV (or Excel) → upload it. SharePoint reads the embedded schema and creates every column with the correct type and Team's choices already filled in — no manual column-by-column setup. Delete the single placeholder row afterward, and rename the list to exactly LibraryFilePlan if it doesn't pick that up from the filename.

SharePoint List: PermissionIndex

Location: your main site, same as LibraryFilePlan.

PermissionIndex_list_template.csv — same idea: Site Contents → New → List → From CSV → upload, delete the placeholder row, rename to exactly PermissionIndex if needed.

2. Flow Field Fix: Create_FilePlan_Row

In Power Automate, open Create Library (App) → Edit → click Create_FilePlan_Row to expand it → click into its Body box → select all, delete → paste this in as the replacement → Save. Existing action, existing field, no re-import needed.

{
  "__metadata": { "type": "SP.Data.LibraryFilePlanListItem" },
  "Title": "@{triggerBody()?['DisplayName']}",
  "LibraryUrl": "@{body('Get_New_Library_Url')?['d']?['RootFolder']?['ServerRelativeUrl']}",
  "Team": "@{triggerBody()?['Team']}",
  "SubTeam": "@{triggerBody()?['SubTeam']}",
  "PrettyName": "@{triggerBody()?['DisplayName']}",
  "SiteUrl": "@{triggerBody()?['SiteUrl']}",
  "IsLimited": @{if(equals(triggerBody()?['IsLimited'], true), 'true', 'false')}
}

2b. Flow Field Fix: Get_Unique_Perm_Libraries (missing libraries bug)

Cause: this action asks SharePoint for every library with unique permissions, but never told it how many to return. SharePoint's _api/web/lists endpoint defaults to a page size of around 100 items per response and doesn't automatically continue to the next page — with enough lists on the site (including hidden/system ones counted before the filter narrows them down), the real Limited libraries near the end of that list never got reached, so the index silently stopped at whatever fit in the first page.

In Power Automate, open Rebuild Permission Index → Edit → click Get_Unique_Perm_Libraries to expand it → click into its Uri box → add &$top=5000 to the end → Save. Existing action, one field, no re-import needed.

_api/web/lists?$filter=BaseTemplate eq 101 and Hidden eq false and HasUniqueRoleAssignments eq true&$select=Title,Id,RootFolder/ServerRelativeUrl&$expand=RootFolder&$top=5000

2c. Flow Field Fix: Backfill File Plan (same DisplayName bug as 2)

Cause: found 25 Sep 2026 while investigating why some libraries showed raw, ugly names in scrFilePlan instead of a proper Pretty Name. This flow's own Create_FilePlan_Row action was writing to DisplayName, not PrettyName — the exact same silently-dropped-write bug fixed in section 2 above for Create Library (App), but never applied here since the two flows only share a pattern, not the actual action. Any library that was ever registered by running Backfill (rather than created through the app's own Create Library button) has no Pretty Name at all as a result.

In Power Automate, open Backfill File Plan → Edit → find the Create_FilePlan_Row action inside the If_Not_Already_Tracked condition, inside Apply_to_each_Library → click into its Body box → select all, delete → paste this in as the replacement → Save.

{
  "__metadata": { "type": "SP.Data.LibraryFilePlanListItem" },
  "Title": "@{items('Apply_to_each_Library')?['Title']}",
  "LibraryUrl": "@{items('Apply_to_each_Library')?['Url']}",
  "PrettyName": "@{items('Apply_to_each_Library')?['Title']}",
  "SiteUrl": "@{coalesce(triggerBody()?['SiteUrl'], 'https://modgovuk.sharepoint.com/teams/1598')}",
  "Team": "",
  "SubTeam": "",
  "IsLimited": @{if(equals(items('Apply_to_each_Library')?['Unique'], true), 'true', 'false')}
}

2d. Flow Surgery: Create Library (App) — Register Existing Library

Needed for scrAdminCreateLibrary v1.9's new "Register an existing library only" toggle. This adds a second path through the same flow — nothing gets deleted or recreated, and no new flow needs registering as a data source in the app.

1. Add two new trigger inputs. Open Create Library (App) → Edit → click the trigger (Power Apps) → under its inputs, add: RegisterOnly (type Yes/No, not required) and ExistingLibraryTitle (type Text, not required).
2. Add two "Initialize variable" actions right after the trigger, before Select_Categories: varOutDisplayName (String, leave the value blank) and varOutLibraryUrl (String, leave the value blank).
3. Add a Condition action right after those two, still before Select_Categories. Set it to check RegisterOnly is equal to true.
4. Move the existing chain into the "No" branch. Select Select_Categories through Create_FilePlan_Row (everything except the final Response action) — multi-select them (click the first, shift-click the last, or use the "..." menu → Select actions), Cut, then click inside the Condition's No branch and Paste.
5. At the end of the "No" branch (after Create_FilePlan_Row), add two Set variable actions:
   • Set varOutDisplayName to triggerBody()?['DisplayName']
   • Set varOutLibraryUrl to body('Get_New_Library_Url')?['d']?['RootFolder']?['ServerRelativeUrl']
6. In the "Yes" branch, add these actions in order:
   1. An HTTP action (Send an HTTP request to SharePoint) named Get_Existing_Library_Url: GET _api/web/lists/getbytitle('@{triggerBody()?['ExistingLibraryTitle']}')/RootFolder/ServerRelativeUrl, Site Address = the same dataset expression already used elsewhere in this flow (coalesce(triggerBody()?['SiteUrl'], 'https://modgovuk.sharepoint.com/teams/1598')).
   2. Another HTTP GET, Get_Existing_Row: _api/web/lists/getbytitle('LibraryFilePlan')/items?$filter=LibraryUrl eq '@{body('Get_Existing_Library_Url')?['d']?['ServerRelativeUrl']}'&$select=Id&$top=1 — same dedupe check Backfill already uses.
   3. A Condition, If_Not_Already_Tracked: length(body('Get_Existing_Row')?['d']?['results']) is equal to 0.
   4. Inside its "Yes": an HTTP POST, Create_FilePlan_Row_Register, same URI as the existing Create_FilePlan_Row (_api/web/lists/getbytitle('LibraryFilePlan')/items), with this body:
      New action bodyCopy

      {
        "__metadata": { "type": "SP.Data.LibraryFilePlanListItem" },
        "Title": "@{triggerBody()?['ExistingLibraryTitle']}",
        "LibraryUrl": "@{body('Get_Existing_Library_Url')?['d']?['ServerRelativeUrl']}",
        "PrettyName": "@{coalesce(triggerBody()?['DisplayName'], triggerBody()?['ExistingLibraryTitle'])}",
        "Team": "@{triggerBody()?['Team']}",
        "SubTeam": "@{triggerBody()?['SubTeam']}",
        "SiteUrl": "@{coalesce(triggerBody()?['SiteUrl'], 'https://modgovuk.sharepoint.com/teams/1598')}",
        "IsLimited": @{if(equals(triggerBody()?['IsLimited'], true), 'true', 'false')}
      }

   5. Still inside the "Yes" branch of If_Not_Already_Tracked, after that action: Set varOutDisplayName to triggerBody()?['ExistingLibraryTitle'], and Set varOutLibraryUrl to body('Get_Existing_Library_Url')?['d']?['ServerRelativeUrl'].
   6. In the "No" branch of If_Not_Already_Tracked (already registered): the same two Set variable actions, so the flow still responds cleanly instead of leaving the variables blank.
7. Move the existing Response action out from directly after Create_FilePlan_Row to sit after the whole Condition block (both branches). Update its body to read from the variables instead of the old direct references:
   Updated Response bodyCopy

   {
     "Success": true,
     "DisplayName": "@{variables('varOutDisplayName')}",
     "LibraryUrl": "@{variables('varOutLibraryUrl')}"
   }

8. Save. Test both paths manually before touching Power Apps: once with RegisterOnly off (normal creation, unchanged), once with it on and a real existing library's title.

2e. Flow Field Fix + New Column: Open Permissions Link

Want: a button on scrGroupSearch's library rows that opens that specific library's real SharePoint permissions page directly, in a new tab — no more hunting for it manually.

How it's possible: SharePoint's classic "Permissions for this document library" page is {site}/_layouts/15/user.aspx?obj={GUID}&List={GUID}, where the GUID is that specific list's internal ID. Confirmed 26 Sep 2026 from a real URL Allan copied out of Studio. Nothing we currently store has that GUID — LibraryFilePlan and PermissionIndex both only have the server-relative URL — but FP - Rebuild Permission Index already fetches it for every library it scans (its Get_Unique_Perm_Libraries step selects Id alongside Title and the URL), it just never saves it anywhere. Cheapest fix: capture it.

1. Add one column to PermissionIndex: SharePoint list settings → Create column → LibraryId, type Single line of text, Not Required.
2. Fix Select_Libraries first. This action runs right after Get_Unique_Perm_Libraries and reshapes its results down to just Title and Url before Apply_to_each_Library ever sees them — Id gets fetched from SharePoint one step earlier, then thrown away here. Open Select_Libraries → its Select box already has Title and Url mapped → add a third field:
   New field in Select_LibrariesCopy

   Id → @item()?['Id']

3. Edit the flow. Power Automate → FP - Rebuild Permission Index → Edit → find both Create_Index_Row and Create_Nested_Index_Row (inside Apply_to_each_Assignment → If_Not_System_Group, and inside the nested If_SharePoint_Group → Apply_to_each_Nested_Member) → click into each one's Body box → add one new line before the closing brace:
   New line for both actionsCopy

     "LibraryId": "@{items('Apply_to_each_Library')?['Id']}"

   Same expression in both actions — Apply_to_each_Library is the outer loop both actions already run inside, so its Id is available in each without any new lookup, once step 2 above has put it there.
4. Save the flow.
5. Refresh the PermissionIndex data source in Power Apps too, not just the flow. Adding a column directly to a SharePoint list doesn't make the app aware of it — Power Apps caches a data source's column schema separately, so colPermissionIndex keeps behaving as if LibraryId doesn't exist (silently blank, not an error) until this is done. Studio → Data panel → find PermissionIndex → Refresh (or remove and re-add if there's no direct refresh option) → reload the app so App.OnStart re-runs.

Launch(varTenantHost & "/teams/1598/_layouts/15/user.aspx?obj=" & EncodeUrl("{" & ThisItem.LibraryId & "}") & ",doclib&List=" & EncodeUrl("{" & ThisItem.LibraryId & "}"))

2f. New Flow: FP - Rebuild Library Stats

Why: scrManageLibraries is meant to be a housekeeping/audit view — Allan's own framing: spot libraries created a long time ago with zero files in them, so nobody's actually using them, and flag them for a "are you going to use this?" conversation. Needs two new facts about each real library that nothing currently tracks: when it was actually created, and how many items are in it right now.

RebuildLibraryStats_flow_import.zip — import this like every other flow (My flows → Import → Import Package (Legacy)).

What it does, or the manual build steps if the import doesn't work:

1. Create a new flow. Power Automate → My flows → New flow → Instant cloud flow → name it FP - Rebuild Library Stats → trigger: Power Apps (V2).
2. Trigger input (optional, not required): SiteUrl, type Text — same optional override pattern every other flow here uses.
3. Get_Libraries — HTTP request to SharePoint (or "Send an HTTP request to SharePoint" action): GET, Site Address = coalesce(triggerBody()?['SiteUrl'], 'https://modgovuk.sharepoint.com/teams/1598'), Uri:
   Get_Libraries UriCopy

   _api/web/lists?$filter=BaseTemplate eq 101 and Hidden eq false&$select=Title,Created,ItemCount,RootFolder/ServerRelativeUrl&$expand=RootFolder&$top=5000

   &$top=5000 is included from the start this time — the missing-libraries bug fixed in section 2b happened because an earlier flow forgot this on a similar query.
4. Select_LibraryStats — a Select action, From: body('Get_Libraries')?['d']?['results'], Map:
   Select_LibraryStats mapCopy

   Url: item()?['RootFolder']?['ServerRelativeUrl']
   Created: item()?['Created']
   ItemCount: item()?['ItemCount']

   All three fields explicitly mapped — the same class of bug fixed in section 2e happened because a Select action silently dropped a field nothing further downstream could then see. Don't repeat that here.
5. Apply_to_each_Library, foreach body('Select_LibraryStats'):
   1. Get_Existing_Row — HTTP GET, same Site Address as above: _api/web/lists/getbytitle('LibraryFilePlan')/items?$filter=LibraryUrl eq '@{items('Apply_to_each_Library')?['Url']}'&$select=Id&$top=1 — same dedupe-lookup pattern Backfill/Register-Existing-Library already use.
   2. If_Tracked: length(body('Get_Existing_Row')?['d']?['results']) greater than 0.
   3. Inside "Yes": Update_LibraryFilePlan_Row — HTTP POST, Uri _api/web/lists/getbytitle('LibraryFilePlan')/items(@{body('Get_Existing_Row')?['d']?['results'][0]?['Id']}), Headers Accept: application/json;odata=verbose, Content-Type: application/json;odata=verbose, IF-MATCH: *, X-HTTP-Method: MERGE (standard SharePoint REST update syntax, not specific to this app), Body:
      Update_LibraryFilePlan_Row bodyCopy

      {
        "__metadata": { "type": "SP.Data.LibraryFilePlanListItem" },
        "LibraryCreated": "@{items('Apply_to_each_Library')?['Created']}",
        "LibraryItemCount": @{items('Apply_to_each_Library')?['ItemCount']}
      }

   4. Nothing needed in "No" — a library that isn't tracked in LibraryFilePlan yet is a Backfill problem, not this flow's job.
6. No Response action needed — same as FP - Rebuild Permission Index, this is a fire-and-forget scan the app just reloads its own data after, it doesn't need anything handed back.
7. Save. Add it as a data source in Power Apps Studio (Data panel → Add data → Power Automate flows). Check the exact Power Fx identifier Studio gives it in the Insert/Data panel before wiring the button — don't assume it matches the display name exactly, the same lesson already learned twice this session (Delete Libraries, and the still-unconfirmed Create Library identifier).

3. Download & Import Flows

CreateLibraryApp_flow_import.zip — creates a library, registers it into LibraryFilePlan. The core flow everything else builds on.

BackfillFilePlan_flow_import.zip — one-time scan of every existing library on the site, registers anything not already tracked.

RebuildPermissionIndex_flow_import.zip — scans libraries with broken permissions and builds a fast, searchable index of their groups.

ManageLibraryPermissions_flow_import.zip — lists, adds, or removes a group directly on a chosen library, called live from the Admin screen.

DeleteLibrariesApp_flow_import.zip — checks each library for files, deletes the ones that are safe to delete (or all of them if overridden), and cleans up their LibraryFilePlan/PermissionIndex rows. Called live from the Manage Libraries screen.

RebuildLibraryStats_flow_import.zip — scans every library's real creation date and file count, writes them onto the matching LibraryFilePlan row. Powers the housekeeping/audit view on Manage Libraries (empty old libraries flagged for review). New 26 Sep 2026 — see the callout in section 2f before trusting this one blindly.

All six: Power Automate → My flows → Import → Import Package (Legacy).

What Create Library (App) does

Triggered from Power Apps (or manually, for testing). Per library:

1. Creates the library (BaseTemplate 101) with the correct sensitivity label for Normal vs Limited
2. Adds a CAT choice column (fill-in-your-own enabled) and a Status choice column (Draft / Under Review / Reviewed / Published / Final / Superseded / Expired)
3. Creates WiP view (items without a retention label) and Records view (items with one), both grouped by CAT
4. Renames the library's Title to the pretty display name
5. If Limited: breaks role inheritance completely, grants SG_Cadets-Admin-Ltd_MEM and SG_IHUB Full Control (fixed — nothing to fill in on the form, since a separate team owns creating/adding any other group later), then removes the flow-runner's own account (SharePoint auto-adds whoever breaks inheritance as a lockout safety net; the flow strips that back out)
6. Registers the new library into LibraryFilePlan

Site URL defaults to the main site if left blank — every action falls back to it via coalesce().

Testing Create Library (App)

Power Automate → My flows → Create Library (App) → Test → Manually.

First test: check the library exists with CAT + Status columns and WiP/Records views, its Title shows the pretty name, and a new row appeared in LibraryFilePlan with PrettyName populated.

Backfill Existing Libraries

LibraryFilePlan only tracks libraries created after this system existed. This flow seeds it from what already exists: scans every real document library (skipping SharePoint's own system libraries), and for anything not already tracked, adds a row with LibraryUrl, PrettyName, Title, SiteUrl filled in automatically, and IsLimited guessed from whether the library already has broken permission inheritance. Team, SubTeam are left blank — fill those in by hand afterward via SharePoint's grid/quick-edit view. Safe to run more than once — only adds what's missing.

Rebuild Permission Index

Power Apps can't read SharePoint permissions directly, and a search screen can't afford to live-query every library's permissions on every keystroke. This flow scans permissions once and writes a flat, fast-searchable copy into PermissionIndex; the group-search screen just filters that list.

Only scans libraries with broken/unique permissions (mostly your Limited libraries) — Normal libraries all inherit the exact same site-wide permissions, so indexing each individually would be pure noise. If a group is a native SharePoint Group, it also looks one level inside that group's own membership — this is how a nested DG_... AD group shows up in the index too, without needing Microsoft Graph.

Manage Library Permissions

This is the write counterpart to Rebuild Permission Index / Group Search, which are both read-only snapshots. This flow is called live, on demand, from the Admin screen — one flow, one trigger, an Action field ("List" / "Add" / "Remove") decides what it does:

• List — live role assignments for one library, straight from SharePoint (not the cached index), so it's always current
• Add — grants a SharePoint group (SG_...) a permission level on that library, reusing the exact same Get_Group_Id → Get_Role_Def_Id → Add_Role_Assignment pattern already proven in Create Library (App)
• Remove — removes a group's entire access to that library in one call (roleassignments/getbyprincipalid(id) with an HTTP DELETE), rather than needing to know which specific permission level to unwind

Delete Libraries (App)

Called from the Manage Libraries screen with a JSON array of library URLs, an Action (currently always "Delete" from the app — "Check" is accepted too but every branch other than Delete just reports counts and changes nothing, so it's there if you ever want a preview-only call), and a Force flag.

Per library: gets its live ItemCount via _api/web/GetList(url) (server-relative URL, not title — the one join key in this whole system guaranteed not to drift if someone renames a library directly in SharePoint). If Force is false and ItemCount > 0, that library is skipped and reported back, untouched. Otherwise it deletes the document library itself, its LibraryFilePlan row, and every PermissionIndex row that pointed at it.

4. Building the Power App

Create a new blank canvas app in Power Apps Studio.

Data connections

Data panel → Add data → add these before pasting any screen YAML:

'LibraryFilePlan'          (SharePoint → your main site → LibraryFilePlan)
'PermissionIndex'          (SharePoint → your main site → PermissionIndex)
'Create Library (App)'     (search Power Automate flows in Add data)
'Rebuild Permission Index' (search Power Automate flows in Add data)
'Manage Library Permissions' (search Power Automate flows in Add data)
'Delete Libraries (App)'   (search Power Automate flows in Add data)

App.OnStart

Select the App object (top of the tree, not any screen) → OnStart property → paste this in full:

Set(varTenantHost, "https://modgovuk.sharepoint.com");
ClearCollect(colFilePlan, 'LibraryFilePlan');
ClearCollect(
    colFilePlanFiltered,
    AddColumns(colFilePlan, TeamName, If(IsBlank(Team.Value) || Team.Value = "", "Uncategorised", Team.Value), SubTeamName, Coalesce(SubTeam.Value, ""), EffectiveName, If(IsBlank(PrettyName) || PrettyName = "", Title, PrettyName))
);
ClearCollect(
    colTeamGroups,
    Sort(
        AddColumns(
            GroupBy(colFilePlanFiltered, TeamName, GroupedItems),
            ItemCount, CountRows(GroupedItems),
            TeamSortKey, If(TeamName = "Uncategorised", "zzz_" & TeamName, TeamName)
        ),
        TeamSortKey,
        SortOrder.Ascending
    )
);
ClearCollect(
    colSubTeamGroups,
    AddColumns(
        GroupBy(
            Filter(colFilePlanFiltered, !IsBlank(SubTeamName) && SubTeamName <> ""),
            TeamName, SubTeamName, GroupedItems
        ),
        ItemCount, CountRows(GroupedItems)
    )
);
Clear(colFlatSource);
Collect(colFlatSource, AddColumns(colTeamGroups, RowType, "Team", SortKey, TeamSortKey, SubSortKey, "", RankInGroup, 0));
Collect(colFlatSource, AddColumns(colSubTeamGroups, RowType, "SubTeam", SortKey, If(TeamName = "Uncategorised", "zzz_" & TeamName, TeamName), SubSortKey, SubTeamName, RankInGroup, 1));
Collect(colFlatSource, AddColumns(colFilePlanFiltered, RowType, "Library", SortKey, If(TeamName = "Uncategorised", "zzz_" & TeamName, TeamName), SubSortKey, If(IsBlank(SubTeamName) || SubTeamName = "", "zzz_none", SubTeamName), RankInGroup, If(IsBlank(SubTeamName) || SubTeamName = "", 1, 2)));
ClearCollect(colExpandedKeys, Filter(Table({TeamName: "seed"}), false));
ClearCollect(colExpandedSubTeams, Filter(Table({SubTeamKey: "seed"}), false));
Set(varIsAdmin, Lower(User().Email) in ["allan.hamilton775@mod.gov.uk", "dan.smith391@mod.gov.uk"]);
ClearCollect(colQueue, Filter(Table({TechnicalName: "seed", DisplayName: "", Team: "", SubTeam: "", IsLimited: false, Categories: "", RegisterOnly: false, ExistingLibraryTitle: ""}), false));
Set(varQueueRunning, false);
Set(varQueueTotal, 0);
Set(varQueueDone, 0);
Set(varIndexRunError, false);
Set(varIndexRefreshing, false);
ClearCollect(colPermissionIndex, Filter('PermissionIndex', PermissionLevel <> "Limited Access" && PrincipalType <> "User"));
ClearCollect(colPermissionFiltered, colPermissionIndex);
ClearCollect(colLibraryGroups, Sort(AddColumns(GroupBy(colPermissionFiltered, LibraryUrl, LibraryTitle, GroupedItems), ItemCount, CountRows(GroupedItems), FlagSaysLimited, With({_lu: LibraryUrl}, Coalesce(LookUp(colFilePlan, LibraryUrl = _lu, IsLimited), false)), LibraryId, With({_lu: LibraryUrl}, LookUp(colPermissionFiltered, LibraryUrl = _lu, LibraryId))), LibraryTitle, SortOrder.Ascending));
Clear(colPermFlatSource);
Collect(colPermFlatSource, AddColumns(colLibraryGroups, RowType, "Library", SortKey, LibraryUrl, RankInGroup, 0, GroupSortKey, "", DirectGroupCount, With({_lu: LibraryUrl}, CountRows(Filter(colPermissionFiltered, LibraryUrl = _lu && (IsBlank(NestedUnderGroup) || NestedUnderGroup = ""))))));
Collect(colPermFlatSource, AddColumns(Filter(colPermissionFiltered, IsBlank(NestedUnderGroup) || NestedUnderGroup = ""), RowType, "Group", SortKey, LibraryUrl, RankInGroup, 1, GroupSortKey, GroupName, MemberCount, With({_gn: GroupName, _lu: LibraryUrl}, CountRows(Filter(colPermissionFiltered, NestedUnderGroup = _gn && LibraryUrl = _lu)))));
Collect(colPermFlatSource, AddColumns(Filter(colPermissionFiltered, !IsBlank(NestedUnderGroup) && NestedUnderGroup <> ""), RowType, "Member", SortKey, LibraryUrl, RankInGroup, 2, GroupSortKey, NestedUnderGroup));
ClearCollect(colExpandedLibs, Filter(Table({LibraryUrl: "seed"}), false));
ClearCollect(colExpandedGroups, Filter(Table({GroupKey: "seed"}), false));
ClearCollect(colSelectedLibraries, Filter(Table({LibraryUrl: "seed"}), false));
ClearCollect(colManageFiltered, colFilePlanFiltered);
ClearCollect(colEditQueue, Filter(colFilePlanFiltered, false));
ClearCollect(colDeleteSkipped, Filter(Table({LibraryUrl: "seed", Title: "seed", ItemCount: 0, Deleted: false}), false));
Set(varDeleteBusy, false);
Set(varDeleteStatus, "");
Set(varConfirmOverrideVisible, false);
Set(varDeletedCount, 0);
Set(varEditSaving, false);
Set(varEditSaveStatus, "")

5. Screens

For each: delete the existing screen if you already have one pasted, New screen (blank) → open the link → Copy YAML → paste. Rename the screen to match the name shown.

Designed, never built

This one still doesn't exist in Studio, no current plan to build it. The YAML below is a design snapshot from August 2026, never confirmed live.

6. Navigation Bar

Add this small nav bar to each of the three real screens. This is an add-on, not a full screen replacement: select the screen in the Tree view first, then paste. Four of the five buttons (everything except File Plan and Group Search) are gated by varIsAdmin, same check used everywhere else in this app. The remaining snippets below (for the three never-built screens) are kept only as reference for if those ever get built.

Paste onto scrFilePlan

Screens:
  scrFilePlan:
    Children:
      - recNavBarBg:
          Control: Classic/Button@2.2.0
          Properties:
            Text: =""
            DisplayMode: =DisplayMode.View
            Fill: =RGBA(30, 30, 45, 1)
            HoverFill: =RGBA(30, 30, 45, 1)
            PressedFill: =RGBA(30, 30, 45, 1)
            BorderThickness: =0
            X: =0
            Y: =0
            Width: =1000
            Height: =48
      - btnNavFilePlan:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="File Plan"
            X: =16
            Y: =6
            Width: =140
            Height: =36
            OnSelect: |-
              =Navigate(scrFilePlan)
      - btnNavGroupSearch:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Group Search"
            X: =164
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrGroupSearch)
      - btnNavCreateLibrary:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Create Library"
            Visible: =varIsAdmin
            X: =332
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrAdminCreateLibrary)
      - btnNavManagePermissions:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Permissions"
            Visible: =varIsAdmin
            X: =500
            Y: =6
            Width: =190
            Height: =36
            OnSelect: |-
              =Navigate(scrManagePermissions)
      - btnNavManageLibraries:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Libraries"
            Visible: =varIsAdmin
            X: =698
            Y: =6
            Width: =170
            Height: =36
            OnSelect: |-
              =Navigate(scrManageLibraries)

Paste onto scrGroupSearch

Screens:
  scrGroupSearch:
    Children:
      - recNavBarBg:
          Control: Classic/Button@2.2.0
          Properties:
            Text: =""
            DisplayMode: =DisplayMode.View
            Fill: =RGBA(30, 30, 45, 1)
            HoverFill: =RGBA(30, 30, 45, 1)
            PressedFill: =RGBA(30, 30, 45, 1)
            BorderThickness: =0
            X: =0
            Y: =0
            Width: =1000
            Height: =48
      - btnNavFilePlan:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="File Plan"
            X: =16
            Y: =6
            Width: =140
            Height: =36
            OnSelect: |-
              =Navigate(scrFilePlan)
      - btnNavGroupSearch:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Group Search"
            X: =164
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrGroupSearch)
      - btnNavCreateLibrary:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Create Library"
            Visible: =varIsAdmin
            X: =332
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrAdminCreateLibrary)
      - btnNavManagePermissions:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Permissions"
            Visible: =varIsAdmin
            X: =500
            Y: =6
            Width: =190
            Height: =36
            OnSelect: |-
              =Navigate(scrManagePermissions)
      - btnNavManageLibraries:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Libraries"
            Visible: =varIsAdmin
            X: =698
            Y: =6
            Width: =170
            Height: =36
            OnSelect: |-
              =Navigate(scrManageLibraries)

Paste onto scrAdminCreateLibrary

Screens:
  scrAdminCreateLibrary:
    Children:
      - recNavBarBg:
          Control: Classic/Button@2.2.0
          Properties:
            Text: =""
            DisplayMode: =DisplayMode.View
            Fill: =RGBA(30, 30, 45, 1)
            HoverFill: =RGBA(30, 30, 45, 1)
            PressedFill: =RGBA(30, 30, 45, 1)
            BorderThickness: =0
            X: =0
            Y: =0
            Width: =1000
            Height: =48
      - btnNavFilePlan:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="File Plan"
            X: =16
            Y: =6
            Width: =140
            Height: =36
            OnSelect: |-
              =Navigate(scrFilePlan)
      - btnNavGroupSearch:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Group Search"
            X: =164
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrGroupSearch)
      - btnNavCreateLibrary:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Create Library"
            Visible: =varIsAdmin
            X: =332
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrAdminCreateLibrary)
      - btnNavManagePermissions:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Permissions"
            Visible: =varIsAdmin
            X: =500
            Y: =6
            Width: =190
            Height: =36
            OnSelect: |-
              =Navigate(scrManagePermissions)
      - btnNavManageLibraries:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Libraries"
            Visible: =varIsAdmin
            X: =698
            Y: =6
            Width: =170
            Height: =36
            OnSelect: |-
              =Navigate(scrManageLibraries)

Paste onto scrManagePermissions

Screens:
  scrManagePermissions:
    Children:
      - recNavBarBg:
          Control: Classic/Button@2.2.0
          Properties:
            Text: =""
            DisplayMode: =DisplayMode.View
            Fill: =RGBA(30, 30, 45, 1)
            HoverFill: =RGBA(30, 30, 45, 1)
            PressedFill: =RGBA(30, 30, 45, 1)
            BorderThickness: =0
            X: =0
            Y: =0
            Width: =1000
            Height: =48
      - btnNavFilePlan:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="File Plan"
            X: =16
            Y: =6
            Width: =140
            Height: =36
            OnSelect: |-
              =Navigate(scrFilePlan)
      - btnNavGroupSearch:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Group Search"
            X: =164
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrGroupSearch)
      - btnNavCreateLibrary:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Create Library"
            Visible: =varIsAdmin
            X: =332
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrAdminCreateLibrary)
      - btnNavManagePermissions:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Permissions"
            Visible: =varIsAdmin
            X: =500
            Y: =6
            Width: =190
            Height: =36
            OnSelect: |-
              =Navigate(scrManagePermissions)
      - btnNavManageLibraries:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Libraries"
            Visible: =varIsAdmin
            X: =698
            Y: =6
            Width: =170
            Height: =36
            OnSelect: |-
              =Navigate(scrManageLibraries)

Paste onto scrManageLibraries

Screens:
  scrManageLibraries:
    Children:
      - recNavBarBg:
          Control: Classic/Button@2.2.0
          Properties:
            Text: =""
            DisplayMode: =DisplayMode.View
            Fill: =RGBA(30, 30, 45, 1)
            HoverFill: =RGBA(30, 30, 45, 1)
            PressedFill: =RGBA(30, 30, 45, 1)
            BorderThickness: =0
            X: =0
            Y: =0
            Width: =1000
            Height: =48
      - btnNavFilePlan:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="File Plan"
            X: =16
            Y: =6
            Width: =140
            Height: =36
            OnSelect: |-
              =Navigate(scrFilePlan)
      - btnNavGroupSearch:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Group Search"
            X: =164
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrGroupSearch)
      - btnNavCreateLibrary:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Create Library"
            Visible: =varIsAdmin
            X: =332
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrAdminCreateLibrary)
      - btnNavManagePermissions:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Permissions"
            Visible: =varIsAdmin
            X: =500
            Y: =6
            Width: =190
            Height: =36
            OnSelect: |-
              =Navigate(scrManagePermissions)
      - btnNavManageLibraries:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Libraries"
            Visible: =varIsAdmin
            X: =698
            Y: =6
            Width: =170
            Height: =36
            OnSelect: |-
              =Navigate(scrManageLibraries)

Paste onto scrEditLibraries

Screens:
  scrEditLibraries:
    Children:
      - recNavBarBg:
          Control: Classic/Button@2.2.0
          Properties:
            Text: =""
            DisplayMode: =DisplayMode.View
            Fill: =RGBA(30, 30, 45, 1)
            HoverFill: =RGBA(30, 30, 45, 1)
            PressedFill: =RGBA(30, 30, 45, 1)
            BorderThickness: =0
            X: =0
            Y: =0
            Width: =1000
            Height: =48
      - btnNavFilePlan:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="File Plan"
            X: =16
            Y: =6
            Width: =140
            Height: =36
            OnSelect: |-
              =Navigate(scrFilePlan)
      - btnNavGroupSearch:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Group Search"
            X: =164
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrGroupSearch)
      - btnNavCreateLibrary:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Create Library"
            Visible: =varIsAdmin
            X: =332
            Y: =6
            Width: =160
            Height: =36
            OnSelect: |-
              =Navigate(scrAdminCreateLibrary)
      - btnNavManagePermissions:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Permissions"
            Visible: =varIsAdmin
            X: =500
            Y: =6
            Width: =190
            Height: =36
            OnSelect: |-
              =Navigate(scrManagePermissions)
      - btnNavManageLibraries:
          Control: ModernButton@1.0.0
          Properties:
            Text: ="Manage Libraries"
            Visible: =varIsAdmin
            X: =698
            Y: =6
            Width: =170
            Height: =36
            OnSelect: |-
              =Navigate(scrManageLibraries)

7. Future Idea (Scoping Only, Not Started): Limited Sub-Site Migration

The problem: a separate sub-site (called "Limited") holds a large number of document libraries, every one of them genuinely Limited (its own permission groups, its own category setup), all created before this app's current build conventions existed. Microsoft is pushing tenants toward a flat site structure, so these need to move up to the main site (/teams/1598), not just sit on a sub-site indefinitely.

Hard constraint: no Microsoft Graph access. Allan has zero access to Graph, so nothing in this project can rely on it — not Graph's site-content-move-job APIs, not Graph-based file operations, nothing. Every flow in this app already only ever uses the SharePoint REST connector (_api/web/... via shared_sharepointonline) and that's the only mechanism available here too. This doesn't block the plan below — the one genuinely Graph-adjacent piece (bulk cross-site content transfer) is handled by SharePoint's own native browser UI, driven by Allan directly in his own session, not by an API call needing Graph permissions.

Decided direction: copy, not move. Allan's explicit call — leave every original library fully in place and untouched, copy its documents to a newly-created library on the main site, verify the copy is complete and correct, and only then flag (never auto-delete) the original for later manual deletion.

Allan's own curiosity, answered: do links break?

A SharePoint file's URL (and its internal unique ID) belongs to that specific file object, not to "the document" in some abstract sense. Since a copy leaves the original completely untouched, any existing link to the original — a "Copy link" share, a bookmarked URL, a link pasted in an email months ago — keeps working exactly as it does today, for as long as the original still exists. A link to the new copy is a brand-new URL; nothing carries old links over to it automatically, so anyone needing to reach the new copy needs a freshly generated link. The only point anything actually breaks is if/when the original is eventually deleted for real (whenever that happens, on Allan's own timeline, likely well after this) — at that point any old link still pointing at it will 404, same as deleting any file would do regardless of how it got migrated. Worth a quick real test (copy one file, confirm the original's existing link still resolves) before relying on this for anything that matters, rather than trusting this write-up alone.

What the new library needs, beyond a raw structural clone

• Full modern treatment, not a copy of the old setup. Built via the same logic as Create Library (App) — CAT column (fill-in-your-own), Status column, WiP/Records views, and critically the correct sensitivity label for Limited libraries, which a lot of the old sub-site libraries currently lack entirely. This is explicitly an upgrade on migration, not a like-for-like clone.
• Category values, not just the column. The old library's CAT column has real values already in use across its documents — these need identifying (distinct values actually used, not a guess) and pre-seeding onto the new column's choices, and each copied document needs its CAT value re-applied to match on the new side so nothing loses its category during the move.
• Same display name, but conformed to current naming (numeric team prefixes, matching every other library built since). Team/Sub-Team assignment per migrated library is a human decision Allan makes at migration time, not something to infer automatically from the old sub-site's own structure.
• Permissions replayed exactly, not recreated from scratch. Every source library's real grants already exist in PermissionIndex (GroupName/PermissionLevel per library) once a rebuild's been run against the sub-site too. The underlying SG_/DG_ groups already exist tenant-wide, so this is just re-applying existing group references at the same permission levels on the new library — no new groups need creating, matching Allan's own read of it ("permissions are not going to change... they exist already").

Verification before flagging anything for deletion

Given every one of these libraries is genuinely Limited, getting this wrong is a real security question, not just a UX one. Two checks, both cheap to build and both non-negotiable before a library gets flagged:

1. Permissions diff — re-scan the new library's real live permissions (same mechanism FP - Rebuild Permission Index already uses) and compare against what was intended to be replayed from the source. Any mismatch blocks flagging, full stop.
2. Content diff — confirm every document that existed on the source made it to the new library (file count and name comparison at minimum) before treating the copy as complete.

Only once both pass: cosmetically rename the old library's Title (its URL stays untouched, so nothing that already points at it breaks) to visibly flag it — something like appending "(Migrated — pending deletion)" — and add a matching field to LibraryFilePlan so it surfaces on scrManageLibraries with its own tick-box. Not every flagged library will necessarily get deleted on the same timeline, or at all — some may just get left, so this needs to be an explicit per-library opt-in Allan controls, never an all-or-nothing switch.

Open questions, not yet decided

• Separate small standalone tool, or a new screen bolted onto this app? Allan floated both as genuinely live options — this is a largely one-off bulk migration job, not a recurring day-to-day feature, so a cheap bespoke tool with just a handful of buttons might suit it better than extending the main app. Worth deciding at the start of the actual work, not guessing now.
• Exact automation boundary for the document copy step itself — whether it's driven entirely by Allan using SharePoint's native "Move to"/"Copy to" UI per library (simplest, safest, no new flow risk) or whether enough volume exists to justify scripting bulk copies via the SharePoint REST connector instead. Given "loads of them," worth a real count before assuming either way.

Recommended first step, whenever this actually starts (safe, read-only, useful on its own)

A pure audit/discovery pass before touching anything: scan every library on the Limited sub-site and produce a CSV (or a page in this guide) listing each one's name, its real current permission grants, the CAT values actually in use, document/version counts, and whether it already has a proper sensitivity label or not. Same read-only-scan shape as Rebuild Permission Index/Backfill File Plan already proven in this app — genuinely low-risk, and gives Allan and Claude something concrete to review together before any migration logic gets designed in detail.

Issues

Found a problem? Report it here.