Start your free 30-day trial

Modern DFFS installs from either catalog — the package ships the manifests for both, so neither route is a workaround. Pick the one that matches your license and how much tenant access you have.

On a site collection license the site collection catalog is normally the better choice: the install matches what you licensed, and it keeps the package out of every other site in the organization.

What the app catalog shows you at install

Uploading an .sppkg is a governed step, not a silent one. SharePoint reads the package, shows you what you’re deploying, and asks you to trust it before it becomes available to any site — along with the scope choice above. Nothing is installed until an administrator confirms.

Modern DFFS requests no API permissions at all. A package that wanted Microsoft Graph or other tenant-level access would raise a pending request in the SharePoint admin center’s Advanced → API access page, waiting on a Global or SharePoint Administrator to consent. Modern DFFS declares none, so that step never appears — there is nothing to approve and no standing access granted to anyone.

It runs entirely as the signed-in user, within that user’s existing SharePoint permissions: it cannot read or write anything they couldn’t already reach through SharePoint directly. Updates work the same way — a new package version you deploy on your own schedule, so you control exactly when a change lands.

If your security team needs the full picture, that’s what the Architecture & Security Overview is for — data residency, the permission model, subprocessors, and a shared-responsibility matrix.

Creating a site collection app catalog

A site collection app catalog has to be created once by an administrator — there’s no UI for it, so it’s a short PowerShell job. After that, day-to-day uploads need no admin involvement.

Before you run it:

• You need the SharePoint Administrator or Global Administrator role to connect.
• The account must also be a site collection administrator on both the tenant app catalog and the target site — being a tenant admin alone isn’t enough.
• Your tenant app catalog must already exist — a site collection catalog can’t be created without it, and the cmdlet fails with an opaque Object returned by the following call stack is null error rather than a clear message. If your organization has never created one, do that first in the SharePoint admin center (More features → Apps). Multi-geo tenants need one per geo.

Replace contoso and the site URL with your own:

Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Add-SPOSiteCollectionAppCatalog -Site https://contoso.sharepoint.com/sites/YourSite

That’s the whole setup. The SharePoint Online Management Shell used above runs on Windows PowerShell 5.1 and signs you in interactively — no app registration needed. If you’d rather use PnP.PowerShell on PowerShell 7:

Connect-PnPOnline -Url https://contoso-admin.sharepoint.com -Interactive -ClientId <your-client-id>
Add-PnPSiteCollectionAppCatalog -Site https://contoso.sharepoint.com/sites/YourSite

Note the -ClientId: PnP.PowerShell v2 requires your organization to register its own Entra ID application first, and -Interactive won’t connect without it. If that isn’t already set up, the Management Shell route above is the quicker one.

After it’s created

1. An Apps for SharePoint library appears in that site — find it under Site contents.
2. Upload dffs.sppkg there and confirm the trust prompt.
3. You’ll be asked whether to “make this solution available to all sites in the organization”. Modern DFFS supports tenant-wide deployment, so the prompt appears here too — but from a site collection catalog it only ever reaches this site collection. Check it and DFFS is live on every site in the site collection straight away. Leave it unchecked and you add the app to individual sites yourself, which is the better choice if you want DFFS on only some of them.
4. Open a list — the DFFS setup button appears in the command bar.

The “all sites in the organization” wording is a known quirk of the SharePoint UI, not a description of what happens. Microsoft documents the behavior in Use the site collection app catalog.

To switch the catalog off later, an administrator runs Remove-SPOSiteCollectionAppCatalog -Site <site URL>. Despite the name it doesn’t delete anything — the Apps for SharePoint library stays visible, but solutions in it can no longer be deployed or used.

Changed your mind, or evaluating? Removing DFFS is reversible and never touches your list data — see turning DFFS off & uninstalling.