Set TIMBR up for your company

In one line

Delegated permissions only (User.Read, Sites.Selected), no secrets or certificates, and access to one SharePoint site that you create and grant. Nothing else in the tenant. TIMBR cannot do anything when nobody is signed in, and every action appears in your sign-in logs as a named person.

App registration: 63686792-1aa5-4dc4-9d27-2b2a215a7376, published by SG Arboricultural Consulting.

Before you start

Who does this: someone who is a Global Administrator in Microsoft 365 (for step 3) and a SharePoint Administrator (for steps 1 and 4). In most small companies that is one person, often whoever set up Microsoft 365, or the IT provider.

What you need to hand: your tenant name (the part before .sharepoint.com when you open SharePoint), the names of the people who will use TIMBR, and which one of them will connect first. Everyone who uses TIMBR needs a Microsoft 365 licence that includes SharePoint, which every Business and Enterprise plan does.

What you end up with: one private SharePoint site that holds everything TIMBR records, TIMBR allowed into that site and nothing else, your people as members of it, and a trial licence for the organisation. The steps are in the order they have to happen.

1. Create a dedicated SharePoint site
2. Give your people access to it
3. Consent to the TIMBR app
4. Grant the app that one site
5. Start the free trial
6. Connect and create the lists
7. Each person installs and signs in

Step 1. Create a dedicated SharePoint site

TIMBR lives in one SharePoint site of its own. Everything it records, trees, projects, jobs, photos, the crew board, is a list or a library on that site, in your tenant, owned by you.

1. Go to admin.microsoft.com and sign in as an administrator. In the left menu choose Show all › SharePoint. That opens the SharePoint admin centre.
2. In its left menu choose Sites › Active sites, then press + Create at the top.
3. Choose Team site. If it asks for a template, choose the Standard team template.
4. Fill in the form:
   • Site name: TIMBR. The site address fills itself in as /sites/TIMBR; leave it.
   • Group owner: the person who will connect first and create TIMBR's lists (step 6).
   • Privacy settings: Private. Only people you add can see it.
   • Language and time zone: yours. The language cannot be changed afterwards.
5. Press Next. It offers to add members now; you can do that here or in step 2. Press Finish.
6. Open the new site once and copy its address from the browser. It looks like https://yourtenant.sharepoint.com/sites/TIMBR. Keep it: every person pastes this same address into the Hub and the phone app.

The same steps in pictures. The site in them is called TimbrHub; the name is yours to choose, as long as everyone uses the address it produces.

Photos taken on site are stored here too. A tree survey of a few hundred trees with photos is a few gigabytes; a new site's default storage is plenty, and it draws on the tenant's pooled storage rather than a fixed quota.

Step 2. Give your people access to that site

TIMBR can only reach what the signed-in person can reach, so membership of this site is how you decide who can use TIMBR. There is no separate user list to keep.

1. Open the TIMBR site in the browser. Press the Settings cog at the top right › Site permissions (on some tenants Site information › View all site settings › Site permissions).
2. Press Add members › Add members to group. Type each person's name and add them. Everyone who will use TIMBR, in the office or in the field, goes in as a Member.
3. Make the person who will connect first an Owner: next to their name, change Member to Owner. Creating TIMBR's lists on the site (step 6) needs owner rights; using TIMBR afterwards does not.

A new starter later is just a new member of the site; someone who leaves is removed from it, and their access to TIMBR ends with it. If you prefer, make a Microsoft 365 group or security group the member instead and manage people there.

Step 3. Consent to the TIMBR app

TIMBR signs people in through Microsoft's own sign-in page, as a registered application. The first time, Microsoft asks an administrator to agree to what the app may do for the organisation. The prompt is headed Permissions requested, names TIMBR, and lists three things:

There are two ways to give that consent. Either is fine; do one.

At the first sign-in. A Global Administrator installs the Hub (Download), opens Deployment, pastes the site address from step 1 and presses Connect Microsoft 365. Microsoft's page opens and shows Permissions requested, with the two items above. Tick Consent on behalf of your organisation, then press Accept. Done; the administrator carries straight on to step 5.

In the Entra admin centre. Go to entra.microsoft.com › Identity › Applications › Enterprise applications, find TIMBR (it appears in the list once anyone in your tenant has tried to sign in to it once), open it, choose Permissions in its left menu and press Grant admin consent for your organisation. Sign in when asked and accept.

The word unverified under the name means TIMBR has no Microsoft Partner Center badge, which is a partner-programme enrolment rather than a security check. The publisher is SG Arboricultural Consulting; the app registration ID below is how you confirm it.

If a person who is not an administrator signs in first, Microsoft shows Need admin approval instead. Nothing is wrong: they can type a note and press Request approval, or an administrator does one of the two things above and the person signs in again.

App registration, for your records: 63686792-1aa5-4dc4-9d27-2b2a215a7376, published by SG Arboricultural Consulting. There are no application permissions, no client secrets and no certificates: TIMBR can do nothing while nobody is signed in, and every action appears in your sign-in logs as a named person.

Step 4. Grant the app that one site

Sites.Selected means TIMBR can reach no site at all until an administrator names one. This step names the TIMBR site, and only it. It is done once, with PnP PowerShell, Microsoft's community-maintained PowerShell module for SharePoint. Allow ten minutes the first time.

Install PnP PowerShell if the computer does not have it. Open PowerShell (on Windows, PowerShell 7 from the Start menu; on a Mac, install PowerShell from Microsoft, then run pwsh in Terminal) and run:

Register PnP once in your tenant. PnP PowerShell signs in through an app registration of its own, which a tenant has to have before it can connect. Skip this if your tenant already uses PnP. Run it as a Global Administrator; a browser window opens to consent:

It prints an application id (a client id). Keep it; the next command uses it.

Connect to the TIMBR site as a SharePoint Administrator, then grant TIMBR the site:

Replace yourtenant with your tenant name in both places. If your tenant already had PnP set up before 2024, Connect-PnPOnline works without -ClientId.

Check it. Still connected to the TIMBR site:

It lists TIMBR with Manage. Connect to any other site and run it again: TIMBR is not listed. That is the whole of what TIMBR can reach.

Why Manage. TIMBR creates its own lists and libraries on the site the first time it connects (step 6), and Write does not allow creating lists. Manage is still confined to this one site; it gives TIMBR nothing anywhere else.

To take it away later: Revoke-PnPAzureADAppSitePermission on the site, or delete TIMBR under Enterprise applications in Entra. Access stops at once and the data stays in your SharePoint.

Step 5. Start the free trial

Open TIMBR Hub and sign in with your Microsoft 365 account (Deployment › paste the site address › Connect Microsoft 365). Because the organisation has no licence yet, the Hub says so and points you to its Account page, under System in the left menu.

In the Start a free trial box, type your company's name and press Start a free trial. The trial begins at once, covers everyone in the organisation, and the Status line shows the day it ends. Then go back to Deployment and press Connect Microsoft 365 again to carry on.

The only things sent are your organisation's tenant ID and the company name you typed. One trial per organisation; when it ends, or to go straight to a subscription, email hello@timbrfield.com.au quoting the licence key the Account page shows.

Step 6. Connect and create the lists

Done once, by the site owner from step 2, in TIMBR Hub.

1. Deployment › paste the full site address into SharePoint site address › Connect Microsoft 365 › sign in. The right-hand card shows who is signed in; the status line says the site was found.
2. Press Provision SharePoint Lists. The Hub creates TIMBR's lists and libraries on the site: a minute or two, with progress shown as it goes. When it finishes, the Home page's Getting set up card ticks TIMBR's lists on the site.
3. Add your people under Organisation › Consultants, so they can be put on projects and jobs. That is the last tick on the Home card, and it disappears.

Provisioning is safe to run again at any time, including after a TIMBR update that adds a list or a column: it only ever adds what is missing and never changes or removes data. Check this site against the schema reports what is missing without changing anything.

Step 7. Each person installs and signs in

Hub (Mac or Windows): install, open Deployment, paste the same full site address, press Connect Microsoft 365 and sign in with their own account. The Hub keeps no sign-in between sessions, so Connect is pressed each time it opens. New versions are offered inside the Hub.

Field (iPhone, iPad, Android): on iPhone and iPad install through TestFlight; on Android from the beta invitation. On the sign-in screen enter the same site address under Your TIMBR site, then sign in.

Nothing else is set up per person. What they can see and do follows from the site membership in step 2.

If something doesn't work

Checking it afterwards

Three checks, any time: Get-PnPAzureADAppSitePermission against any other site shows no TIMBR; the Entra sign-in logs show TIMBR sign-ins as named people; and the TIMBR site's permissions page lists exactly the people you expect.

Questions IT usually asks