Administrator guide

Last updated: July 23, 2026

Read the following guide to find out all the important information about ShArc for IT administrators.

1. Introduction

Purpose of the guide

This guide provides administrators with detailed instructions and background information for configuring, maintaining, and supporting the ShArc solution in Microsoft 365 environments. It serves as a technical reference for day-to-day operations as well as long-term lifecycle management.

Target audience

The intended audience includes SharePoint administrators, Azure administrators, and IT personnel responsible for infrastructure integration and user support related to ShArc.

Overview of ShArc

ShArc is a solution for managing storage in SharePoint Online by relocating less frequently used content to Azure Blob Storage. The primary benefit is cost savings by archiving content to a more affordable storage tier. Additionally, this approach improves site performance and supports internal retention strategies. Users retain seamless access to their content while IT gains flexibility in managing storage growth.

2. System overview

Architecture components

ShArc consists of several key components, each playing a specific role in ensuring seamless archiving, secure data access, and integration with Microsoft 365:

SharePoint Online: Hosts the original document libraries. Once files are archived, stub files remain in place and continue to be managed through the familiar SharePoint interface.
Azure Blob Storage: Stores the archived content. Blob Storage is scalable, cost-efficient, and fully integrated into the Microsoft Azure ecosystem.
Azure Table Storage: Stores information about incomplete files for automatic cleanup. Like Blob Storage, Azure Table Storage is scalable, cost-efficient, and integrated into the Azure ecosystem.
ShArc App Service: A containerized web application running in the customer’s Azure tenant. It provides all backend logic and API handling necessary for policy execution, logging, and processing archive and restore events.
ShArc Client (SPA): The web frontend (single page application) served by the App Service. Administrators access this interface to trigger or monitor operations.
ShArc SharePoint solution (SPFx): Provides additional restore actions for archived files directly in SharePoint, including an inline Restore action and a context-menu action. The package can be activated tenant-wide or only on selected SharePoint sites.
ShArc Desktop Client (optional): Enables users to restore archived files from OneDrive-synced folders by double-clicking the .sharc file in Windows Explorer.
Log Analytics Workspace (optional): If enabled, this component collects operational logs and system telemetry for diagnostics or usage monitoring.
Azure Entra ID (formerly Azure AD): Provides centralized identity management, authentication, and role-based access control for all user interactions.

This architecture ensures that all data stays within the customer’s Azure environment and supports flexible deployment, scaling, and cost control.

Core workflow: archiving and restoring

Archiving

Files in SharePoint libraries are selected for archiving based on defined policies (e.g. last modified date, file size). Archive operations can be started for supported SharePoint scopes, including folders, document libraries, sites, and the tenant root.
ShArc moves the file content to Azure Blob Storage and replaces it with a stub file – a .sharc file containing a secure link to restore the file on demand. The stub retains:

File metadata
SharePoint file ID
File path
Original filename (plus .sharc extension)

Restoring

When a user opens a stub file, ShArc starts the restore flow or, for supported image and video files when preview is enabled, opens a preview page first. Once the restore is complete, the file is reinserted into SharePoint at its original location and opened automatically.

Access and transparency

Users interact with stub files through SharePoint, Teams, OneDrive, or, when deployed, the ShArc Desktop Client.
In SharePoint, users can restore archived files by selecting the file name. When the ShArc SharePoint solution is active, an inline Restore action and a “Restore with ShArc” context-menu action are also available.
When file preview is enabled and a suitable thumbnail is available, supported archived image and video files can be previewed without restoring the original file.
In OneDrive-synced folders on supported Windows devices, the optional ShArc Desktop Client allows users to restore a file by double-clicking its .sharc stub in Windows Explorer.
Stub files can be moved, renamed, deleted, or edited in terms of metadata.
All file metadata remains searchable. However, content-based search is only available after the file has been restored.
End users experience minimal workflow disruption. The primary visible difference is the presence of a .sharc file with a custom icon.

Technical deployment details

All ShArc components are deployed in the customer's Azure tenant.
The platform is designed to scale horizontally (adding more containers) and vertically (adjusting compute resources).
ShArc supports various storage tiers (e.g. Hot and Cool) depending on the customer's performance and cost needs.
The SPA runs fully client-side and only communicates with the ShArc API using valid, token-authenticated sessions.
The backend server is containerized and communicates securely via HTTPS.
Archived content never leaves the tenant’s cloud boundary.

Security model

All communication uses HTTPS with TLS encryption.
Admin interfaces are only available to SharePoint or Global Admins.
Only users with appropriate SharePoint permissions can view or trigger file restores.
Every API call requires a valid access token.
Authentication and authorization are enforced via Azure Entra ID using OAuth 2.0 (PKCE flow).

Scalability and performance

ShArc is optimized for large-scale deployments:

ShArc App Service can scale out across multiple containers.
Azure Blob Storage supports geo-redundancy, lifecycle rules, and access tiering.
Azure Table Storage supports geo-redundancy through the storage account.
SharePoint throttling is mitigated using retry logic, exponential backoff, and ISV tagging.

3. Roles and responsibilities

ShArc requires coordination across several administrative domains. The following roles are typically involved in setup, operation, and support:

SharePoint Administrator

Configures and manages document libraries and site structures.
Defines which sites, libraries, or folders are subject to archiving policies or exclusions.
Ensures permission settings align with ShArc access and restore processes.
Supports end users with SharePoint-related access or visibility issues.

Azure Administrator

Sets up and maintains Azure Blob Storage containers for ShArc.
Manages authentication, authorization, and access policies between Azure and Microsoft 365, ensuring that required permissions are in place for ShArc to operate correctly.
Monitors storage usage and ensures appropriate resource scaling.
Maintains the hosting environment for the ShArc App Service.

ShArc Administrator

Operates the ShArc management interface.
Creates and adjusts archiving policies.
Initiates restore jobs when needed (library/site/tenant level).
Reviews logs and handles error scenarios.
Serves as the primary point of contact for operational issues.

End User Support (Helpdesk / 1st-Level Support)

Assists users encountering issues with stub files (e.g. access errors, missing files).
Escalates technical problems to the appropriate admin (ShArc, SharePoint, or Azure).
Communicates expected behavior and limitations of ShArc to end users.

Note: These roles describe functional responsibilities rather than distinct individuals. Depending on the organization's size and structure, one person may take on multiple roles.

4. Prerequisites

The following technical requirements must be met before installing and operating ShArc:

Microsoft 365 & SharePoint Online

A Microsoft 365 tenant with active SharePoint Online usage.
Admin access to manage SharePoint sites and libraries.
Sufficient privileges to configure app permissions and site settings.

Azure Blob Storage setup

An Azure subscription with permission to create and manage Blob Storage accounts.
A designated storage container for archived file content.
Appropriate lifecycle and access policies defined in Azure to support durability and security.

Service account requirements

ShArc requires a dedicated Microsoft 365 service account for authentication and authorization when interacting with SharePoint Online and Azure resources.

Purpose of the service account

The service account is used by ShArc to:

Access SharePoint Online for archive and restore operations
Maintain access to all sites and libraries
Execute automated background jobs

The service account is not tied to an individual user and should be treated as a long-lived technical account.

Licensing requirements

The service account must be assigned a valid Microsoft 365 license that includes SharePoint Online and OneDrive access.

A license such as Microsoft 365 Business Standard, Business Premium, E3, or E5 is sufficient.
An E5 license is not mandatory; however, in environments with very large data volumes or intensive initial archiving, a higher license tier may help reduce SharePoint throttling.

The service account is not tied to an individual user and should be treated as a long-lived technical account.

Required permissions

The service account must be assigned the following permissions:

SharePoint Administrator role in Microsoft 365
Site Collection Administrator permissions on all SharePoint sites that are processed by ShArc

To simplify permission management, ShArc provides an optional background job that automatically assigns the service account as Site Collection Administrator across all site collections at regular intervals. This is strongly recommended for production environments to avoid restore or access limitations when files are moved between sites.

Security

ShArc does not impose any restrictions regarding Microsoft security features.
Multi-Factor Authentication (MFA) is recommended for the service account.
Privileged Identity Management (PIM) is not supported, as the service account requires permanent access.

Operational notes

During initial setup, a personal admin account can temporarily be used if a service account is not yet available; however, switching to a dedicated service account is recommended before moving to production.
The service account may appear as “Modified by” only in edge cases where the original user no longer exists in the tenant (for example in case of deleted users).
All actions performed by the service account are logged and auditable via Azure Log Analytics.

5. Licensing and access

ShArc is licensed based on the total volume of SharePoint data currently archived in Azure Blob Storage.

License metric

Licensing is tied to the maximum archived storage volume, measured in 1 TB increments. Only the highest volume reached at any time counts toward the license.
Once a file is restored to SharePoint, the corresponding storage capacity is released and becomes available again.

License increments and scalability

Customers can begin with a small volume (e.g. 1 TB or 2 TB) and increase their license as needed. Upgrades to higher license tiers are possible at any time.
A free proof-of-concept license is available.

Subscription model

Licenses are provided as annual subscriptions and include:

Technical support
Regular software updates
Full access to the ShArc platform

License scope

ShArc licenses are not tied to the number of users, SharePoint sites, or tenants.
Multi-tenant and partner use is supported via separate agreements.

Temporary overage tolerance

A 10% buffer beyond the licensed volume is allowed without technical enforcement or service interruption.
This is intended to accommodate unexpected data growth, migrations, or restructuring.
Customers will be proactively informed if usage approaches or exceeds the licensed threshold, and can choose to:
Review and reduce storage
Restore files
Or upgrade to the next license tier

Tenant binding and transfers

By default, licenses are bound to a specific Microsoft 365 tenant upon activation.
Transfers between tenants are not supported by default but can be approved by Layer2 in special cases (e.g. mergers, reorganizations, managed service setups).

Compliance and monitoring (coming soon)

ShArc will include built-in tools for license tracking and compliance:

Usage Reporting – Displays total used and available storage in the admin interface.
Threshold Alerts – Warnings when usage approaches 90% or exceeds the licensed volume.
Grace Period – A 10% overage is tolerated before any escalation.

Azure Blob Storage requirements

In addition to the ShArc license, customers must have an active Azure subscription and provision Azure Blob Storage.
Storage costs are billed directly via Azure and are not included in the ShArc license.

Customers can choose the storage tier that best fits their retention and access needs:

Hot Tier – Optimized for frequent access. Highest cost per GB stored, lowest access cost.
Cool Tier – For infrequently accessed data. Lower storage costs, but with higher access charges.

Support for additional tiers may be introduced in the future.

Access Control and permissions

ShArc implements fine-grained role-based access control (RBAC) using Microsoft Entra ID (formerly Azure AD). Roles are enforced both within the ShArc application and across the underlying infrastructure.

Application-Level Roles in ShArc

Administrator – Full access to configuration, policy management, logs, and monitoring
End User – Can view and restore archived files for which they have the required SharePoint permissions; no access to configuration or policies

Infrastructure-Level Roles (Azure RBAC)

Only designated Azure roles (e.g. subscription administrators, storage account owners) can access archived data at the Blob level
Azure Storage RBAC and Conditional Access policies enforce least-privilege access
All permissions are checked dynamically during key operations such as file restores, policy edits, and rule previews

This separation of access ensures that sensitive operations and storage access are tightly controlled and auditable.

6. Installation and setup

ShArc is deployed and updated via a PowerShell-based installation script. Prior to installation, the required permissions, service account, Azure subscription, and test data should be prepared. If Layer2 has explicitly informed the customer that an infrastructure update is required, the infrastructure update must be completed before capabilities that depend on the updated resources can be used.

Optional client-side components are deployed separately:

The ShArc SharePoint solution (SPFx) provides additional restore actions in SharePoint and can be activated tenant-wide or only on selected sites.
The ShArc Desktop Client can be deployed to supported Windows devices through Microsoft Intune or with the standalone installer. It requires a dedicated Entra ID app registration and tenant-wide admin consent.

7. Configuration options

The ShArc user interface is structured around a set of core functional areas for archiving, restoring, and policy management, complemented by global UI controls for configuration, system information, and display preferences.
This section outlines the available configuration options and how they are accessed within the interface.

Core functional areas

8. Monitoring and logs

For current information on how logging is handled in ShArc, including access to temporary Log Analytics-based logging, please refer to:
https://www.layer2-sharc.com/temporary-log-analytics-logging

9. Maintenance tasks

ShArc is designed as an “always-on”, low-maintenance solution. The technical core typically requires no manual intervention. However, a few organizational and operational checks should be performed regularly to ensure consistent behavior.

Archiving configuration review

Check if selected SharePoint URLs (folders/sites/libraries) are still valid and relevant.
Ensure that archiving thresholds (e.g. age, size) reflect current storage and performance objectives.
Review folder-level exclusions and validate that no business-critical or actively used content is unintentionally targeted.

Azure cost tracking

Regularly monitor Azure Blob Storage consumption and associated costs.
Validate that the storage tier, redundancy model, and lifecycle policies align with expected usage and budget.
Review Log Analytics cost impact if temporary logging is enabled.

Reviewing policies

Regularly validate that archiving conditions, exclusions, and policy logic match compliance and retention guidelines.
Adjust policy assignments when organizational structures or usage patterns evolve.

Token and access management

Monitor expiration of app credentials such as client secrets.

Version updates

Updates to ShArc are announced via email.
Application updates are applied when the ShArc App Service is stopped and started. Infrastructure updates are only required when Layer2 explicitly communicates this requirement and must be performed with the update mode of the installation script.
Feature-specific setup, such as deploying the ShArc Desktop Client, activating the ShArc SharePoint solution, or enabling file preview, may be required after an application or infrastructure update.

Cleanup routines

Remove deprecated policies or configuration objects.

Tenant-wide access sync

A background job ensures that the ShArc app account is explicitly registered as Site Collection Administrator on all SharePoint sites across the tenant.
This does not extend the app's permissions beyond what it already has via its Graph and SharePoint API scopes, but it makes its access visible in the site admin list.
The registration is essential to ensure restore functionality across sites, even if stub files are moved between locations.

10. Resources and troubleshooting

The following official Layer2 ShArc resources provide additional guidance, tools, and documentation for administrators. These pages are maintained continuously and reflect the current product state.