SheetTrack for IT administrators

Updated: October 21, 2026

Someone in your organization wants to use SheetTrack, an Excel add-in that lists what changed in a workbook, keeps its versions and checks it for formula errors. This page says what it needs from your Microsoft 365 organization, where workbook data goes, and how to approve, deploy or limit it. SheetTrack is not on Microsoft AppSource yet (coming soon): until it is, people can't add it from Excel and you can't deploy it, but you can already approve it (below).

At a glance

Question	Answer
Publisher	SheetTrack, a sole proprietorship of Lakshay Goel, New Delhi, India. A verified publisher in Microsoft Entra.
Microsoft Entra application	SheetTrack, application (client) ID `b2045b10-716b-4922-8138-f9635cb337e1`. Multitenant, delegated Microsoft Graph permissions only, no client secrets or certificates.
Runs in	Excel for Windows and the web (Excel API 1.9 and Shared Runtime 1.1 or later: Microsoft 365 Version 2002 or later, Excel 2021 or later). Excel for Mac (16.35 or later) is being tested before launch. Not Excel on iPad.
Needs your approval	Only for shared history of a workbook in SharePoint or in someone else's OneDrive, because Microsoft's default consent settings reserve `Files.ReadWrite.All` for administrators. A person can share the history of a workbook in their own OneDrive without you, but the teammates who then open it are opening a workbook in someone else's OneDrive, so they need your approval. Approving grants all five permissions below for your whole organization; with Assignment required?, only the people you assign can sign in to use them (see "Limit who can use it"). Everything else works without you.
Workbook data SheetTrack stores	None. Its service has no database or disk: history stays on the user's computer or in your Microsoft 365 storage.
Workbook data passing through SheetTrack's service	Only for shared history: each version's note and changed cells and the workbook's address, which the service writes into your own storage as the user, then drops. It holds in memory only where the workbook is (its address, file name, folder and OneDrive or SharePoint IDs, up to 10 minutes), the user's name, email address and ID (up to 5 minutes), and, for rate limiting, the user's IP address (about a minute); each is removed within a few minutes after that. The user's access token is used for that request and never stored. Tracking also writes a small record into the workbook file itself (a random history ID and one-way fingerprints, no names or paths), which every copy of the file carries. Everything else goes only between the add-in and Microsoft, or stays on the computer.
Telemetry, cookies, advertising	None. The service keeps request logs for 30 days (below), never workbook content.
Data processing agreement	Being reviewed by counsel; then signed on request at privacy@sheettrack.com (the security page).
Security contact	security@sheettrack.com

What needs approval

Most of SheetTrack needs no sign-in and no approval: listing changes, history kept on the computer, Compare, Go Back To and Check Workbook work for any workbook, including one in OneDrive or SharePoint. People sign in only to back up history to their own OneDrive, to list OneDrive's own versions of a workbook in their own OneDrive, to share a workbook's history with their team, and for Team features (reviews, roles and an audit log). SheetTrack asks for each permission when someone first uses the feature that needs it.

Permission	Microsoft calls it	Asked when	Who can approve it
`User.Read`	Sign in and read user profile	Sign-in from Settings, or the first use of shared history or OneDrive's own versions	The user
`Files.ReadWrite.AppFolder`	Have full access to the application's folder	OneDrive backup starts	The user
`Files.Read`	Read user files	Listing what changed since one of OneDrive's own versions of a workbook in the user's own OneDrive, when SheetTrack doesn't already have `Files.ReadWrite`	The user
`Files.ReadWrite`	Have full access to user files	Sharing the history of a workbook in the user's own work or school OneDrive, or opening its shared history	The user
`Files.ReadWrite.All`	Have full access to all files user can access	Sharing, or opening, the shared history of a workbook in SharePoint, in someone else's OneDrive or in a personal OneDrive, such as a teammate opening the history a colleague shared from their own OneDrive. Once approved, it also lets people list OneDrive's own versions of such a workbook; SheetTrack never asks for it for that	An administrator

"Who can approve it" is under Microsoft's default consent settings; yours may differ. Sign-in also uses Microsoft's standard openid, profile and offline_access, so people stay signed in on their device. Sign-in tokens stay in Office or the browser on that device. For shared history, each request to SheetTrack's service carries the user's access token, which it uses for that request only and never stores.

All five are delegated permissions. SheetTrack acts only as the signed-in person, so it reaches only files that person can already open, and it has no access when nobody is using it. It uses the file permissions only for the workbook open in Excel (to keep its history, or to read its earlier versions), the .sheettrack folder next to it, and its own app folder in the user's OneDrive. Files.ReadWrite.All is the narrowest Microsoft Graph permission a person can be asked for that reaches a SharePoint workbook, or a workbook someone else shared. Microsoft's site-by-site permission (Sites.Selected) and per-file permission (Files.SelectedOperations.Selected) are narrower, but an administrator must approve them too, and then someone with full control of each site, or of each workbook and its .sheettrack folder, must grant SheetTrack access to it through Microsoft Graph before anyone can use SheetTrack there (Microsoft's description). People open SheetTrack on whatever workbook they are working on, so it does not use them. If no one should have Files.ReadWrite.All, don't approve it: history on the computer, OneDrive backup, OneDrive's own versions of a person's own workbooks and sharing history in a person's own OneDrive keep working, though only that person can then open the history they shared.

If people may approve only low-impact permissions (Allow user consent for apps from verified publishers, for selected permissions under Enterprise apps → Consent and permissions → User consent settings), they can approve only the permissions you classify as low impact under Enterprise apps → Consent and permissions → Permission classifications. SheetTrack is a verified publisher. To let people use it without asking you, classify User.Read, openid, profile and offline_access (sign-in), Files.ReadWrite.AppFolder (OneDrive backup), Files.Read (OneDrive's own versions) and Files.ReadWrite (sharing history from their own OneDrive); classify only those you want. Whatever you don't classify, approve with the admin approval below, or leave unapproved: the features that need it then ask for your approval. Files.ReadWrite.All reaches every file a person can open, so keep it for the admin approval.

If you have turned on Microsoft's admin consent workflow, people's requests reach you in the Microsoft Entra admin center under Enterprise apps → Admin consent requests.

Approve SheetTrack for everyone

Open the admin approval link and sign in as a Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator.
Microsoft shows Permissions requested: Review for your organization, with SheetTrack, its verified publisher and the five permissions above. Choose Accept.
Microsoft then opens a SheetTrack page that says whether the approval worked.

Or, once anyone in your organization has signed in to SheetTrack: in the Microsoft Entra admin center, open Enterprise apps → All applications → SheetTrack → Permissions and choose Grant admin consent.

The approval covers those five permissions and the standard sign-in ones above, and nothing else, for your whole organization (with Assignment required?, only the people you assign can sign in to use them); people who saw "Need admin approval" choose Sign in again in SheetTrack. To stop it later, see "Remove SheetTrack" below.

Limit who can use it

Who can sign in: under Enterprise apps → SheetTrack → Properties, set Assignment required? to Yes and add people or groups under Users and groups. Microsoft then requires the admin approval above, even for permissions people could otherwise approve themselves. Enabled for users to sign-in? set to No turns sign-in off for everyone.
Backup and their own files: SheetTrack has no organization-wide switch of its own. People can approve User.Read, Files.ReadWrite.AppFolder, Files.Read and Files.ReadWrite themselves under Microsoft's default settings; to stop that, turn off user consent under Enterprise apps → Consent and permissions, or require assignment (above).
Who can install it: without sign-in, the add-in still lists changes, keeps history on the computer and runs Check Workbook, so sign-in settings do not stop it. In the Microsoft 365 admin center, Settings → Org settings → User owned apps and services → Let users access the Office Store controls whether people can add store add-ins themselves. With it off, only add-ins you deploy are available.

Deploy it to people

Once SheetTrack is on Microsoft AppSource: in the Microsoft 365 admin center, open Settings → Integrated apps, choose Get apps, find SheetTrack (listed as Model Version History & Compare, from SheetTrack), and deploy it to everyone or to chosen users or groups. It appears on Excel's Home tab, which Microsoft says can take up to 24 hours. Centralized deployment needs a Microsoft 365 licence that includes Exchange Online and an Exchange Online mailbox for each person (Microsoft's requirements). Deploying does not approve the permissions, because SheetTrack asks for each one when a feature first needs it rather than listing them in its manifest; use the approval link above as well if people will share history of SharePoint workbooks.

Remove SheetTrack

The add-in: if you deployed it, open Settings → Integrated apps in the Microsoft 365 admin center, choose Model Version History & Compare (SheetTrack), then Remove app. It leaves Excel for the people it was deployed to.
Sign-in and approvals: in the Microsoft Entra admin center, under Enterprise apps → SheetTrack → Properties, set Enabled for users to sign-in? to No. Or choose Delete, which removes every approval and sign-in; anyone may then approve it again for themselves where your settings allow, so turn sign-in off as well if no one should.
People adding it themselves: turn off Let users access the Office Store (under "Limit who can use it").
What stays: none of this deletes what people saved. History on their computers, their OneDrive backups (under Apps) and .sheettrack folders (see "Find SheetTrack's files") stay until they delete them, as the support page describes. SheetTrack's service keeps nothing to delete (its request logs expire after 30 days).

Sign-ins and Conditional Access

Sign-in logs: people's sign-ins to SheetTrack are in the Microsoft Entra admin center under Entra ID → Monitoring & health → Sign-in logs; filter on Application (SheetTrack, application ID b2045b10-716b-4922-8138-f9635cb337e1). Sign-ins made without a window, through the account Excel already uses, are under User sign-ins (non-interactive). Approvals are in the audit logs, and Enterprise apps → SheetTrack → Permissions lists what was granted.
Conditional Access: SheetTrack is a client app, and Conditional Access applies to the services an app calls, not to the app itself, so SheetTrack is not in a policy's app picker (Microsoft's explanation). It calls Microsoft Graph for files in OneDrive and SharePoint, so policies for All resources or Office 365 apply to its sign-ins, and people see Microsoft's own prompts (multifactor authentication, a compliant device, terms of use). If a policy blocks them, SheetTrack can't sign in; listing changes, history on the computer and Check Workbook keep working.

Find SheetTrack's files

Shared history: a folder named .sheettrack next to each workbook whose history was shared, with a folder per history inside (an index.json, the versions under v, and, for a long history, older records under archive).
OneDrive backups: in each person's own OneDrive, under Apps › SheetTrack, a folder per workbook history (a history.json, and the versions under s).
History on the computer: in Office's add-in storage, or the browser's storage, on that person's device; it isn't visible from the admin centers.
Across your organization: a search in Microsoft Purview eDiscovery of SharePoint sites and OneDrive accounts for filename:index.json OR filename:history.json lists them among other files of those names; the ones in a .sheettrack folder or under Apps/SheetTrack are SheetTrack's. Add path: with a site's address and a trailing slash to search one site.

Personal Microsoft accounts

People can also sign in with a personal Microsoft account (Outlook.com, a personal OneDrive). Those accounts belong to no organization, so nothing on this page applies to them: each person approves SheetTrack's permissions for themselves, including Files.ReadWrite.All for the shared history of a workbook in a personal OneDrive, and you can't approve, limit or deploy it for them. Someone signed in with a personal account or from another organization (a guest) can't yet be counted on to open history shared in your SharePoint: SheetTrack hasn't been tested that way.

Where workbook data goes

Feature	What leaves the computer	Where it goes	Kept by SheetTrack?
Changes, Compare, Go Back To, Copy summary	Nothing	Nowhere	No
History on the computer (the default)	Nothing	The add-in's storage on that computer	No
OneDrive backup	Each version's cell values and formulas	Straight to Microsoft Graph, into SheetTrack's app folder in the user's own OneDrive	No
Shared history (opt-in)	Each version; its note and a change summary (changed cells and their values); the workbook's address; the user's access token	Versions straight to Microsoft Graph, into a `.sheettrack` folder next to the workbook. The rest to SheetTrack's service, which writes the signed history index there as the user	No. The token is used for that request only; where the workbook is (address, file name, folder, IDs) stays in the service's memory for up to 10 minutes, and the user's name, email address and ID for up to 5 minutes, each removed within a few minutes after that
Check Workbook	Nothing	Nowhere: it runs inside the add-in, on the user's computer	No

The add-in's storage is Office's add-in storage in Excel for Windows and Mac, and the browser's storage for app.sheettrack.com in Excel on the web. OneDrive backup is on by default for workbooks in OneDrive or SharePoint as soon as SheetTrack may use the user's OneDrive app folder (often with no click, through the account Excel already uses; otherwise it asks first), and offered for others; the user can turn it off in Settings → Backup, and it never passes through SheetTrack's service. Shared history starts only when a user chooses Share history with my team. Everything travels over HTTPS. SheetTrack's service keeps request logs (IP address, browser, address requested, status, timing) for 30 days, in Google Cloud Logging, never workbook content, notes, comments or tokens. The privacy policy has the full list.

Copies outside SharePoint's controls

History on the computer and the OneDrive backup are copies of a workbook's cell values and formulas, including cells later deleted from it.

They do not follow the workbook's protections. SharePoint permissions, retention, sensitivity labels, encryption and data loss prevention rules that apply to the workbook do not carry over to these copies. SheetTrack stores them as compressed data files, not workbooks.
On the computer, they sit in Office's add-in storage for that user, protected like the rest of that user's profile; SheetTrack adds no encryption of its own. Clearing Office's add-in cache deletes them.
The OneDrive backup is in the user's own OneDrive, under OneDrive's policies for that user, not the workbook's site.
Another organization's workbooks (a consultant working in a client's SharePoint, say) are not backed up unless the user turns backup on for that workbook.
Shared history lives in a .sheettrack folder next to the workbook. It has the sharing of its parent folder, not of the workbook, and keeps every version, including cells later deleted.

If your policies do not allow copies of some workbooks outside SharePoint, do not deploy SheetTrack to the people who work on them, and turn off Let users access the Office Store (above).

Security

Part	Provider and place	What it holds
The add-in's web pages (`app.sheettrack.com`)	Cloudflare	Static files only
SheetTrack's service	Google Cloud Run, us-east1 (United States)	No database or disk
The service's request logs	Google Cloud Logging, in its `global` location, which Google may store in any of its regions	30 days of request details (below), never workbook content
Signing key for Team records	Google Secret Manager	One key, readable only by the service
History and backups	Your Microsoft 365 storage, and the user's computer	Everything the user saves
Sign-in	Microsoft Entra ID	Your organization's accounts
SheetTrack's email (support@, privacy@, security@)	GoDaddy (United States)	What people write to SheetTrack

All traffic uses HTTPS. The add-in's pages send a strict Content Security Policy and load scripts only from SheetTrack and Microsoft.
The service limits request sizes and rates, and has no user accounts or passwords of its own.
Team records (versions, reviews, roles, the audit log) are chained with SHA-256 and signed with a key only SheetTrack's service holds, so edits made outside SheetTrack are detected. This is tamper-evident, not tamper-proof: someone who can edit the folder can still delete it or restore an older copy.
SheetTrack has not completed Microsoft 365 Certification, Publisher Attestation or a SOC 2 audit.
The security page lists SheetTrack's service providers (sub-processors) and what each holds, how the service is protected, and how SheetTrack handles a breach.
Report a security problem to security@sheettrack.com. We aim to reply within two business days.

Network addresses

If your network filters web traffic, allow app.sheettrack.com, sheettrack-api-672830646726.us-east1.run.app, appsforoffice.microsoft.com, login.microsoftonline.com, login.live.com and graph.microsoft.com, and for OneDrive and SharePoint files *.sharepoint.com, *.svc.ms, api.onedrive.com, *.1drv.com and *.microsoftpersonalcontent.com.

The security page, the privacy policy, the terms and the support page cover the rest. Questions about deploying SheetTrack: support@sheettrack.com.