Microsoft Solutions Partner — SharePoint · 6,500+ deployments

SharePoint Framework (SPFx) + ACEs Enterprise Guide (2026)

The canonical extensibility surface for modern SharePoint, Microsoft Teams, and Viva Connections — client-side web parts, application customizers, command sets, field and form customizers, and Adaptive Card Extensions. Shipped by a senior-architect-led Microsoft Solutions Partner founded in 1997.

Book an SPFx modernization briefing Call 888-381-9725

What is SharePoint Framework (SPFx) and why is it the canonical extensibility surface for modern SharePoint and Viva Connections? SharePoint Framework (SPFx) is the Microsoft-supported TypeScript + React + Fluent UI extensibility model for modern SharePoint Online, Microsoft Teams, and Viva Connections. SPFx covers six component types — client-side web parts that render inside SharePoint pages and Teams tabs, application customizers that attach branded chrome to every page, list view command sets that add toolbar and context-menu actions, field customizers that override column rendering, form customizers that replace Microsoft Lists forms, and Adaptive Card Extensions (ACEs) that target Viva Connections dashboards plus the broader Microsoft 365 card surface. SPFx integrates with Microsoft Graph through delegated permissions under the signed-in user identity, deploys through the SharePoint App Catalog with full application lifecycle management, and pairs developer-built ACEs with low-code Card Designer authoring for an efficient cross-team Viva Connections backlog. Six enterprise patterns anchor adoption — custom branded intranets, document workflow approvers, mass-deployed data visualization web parts, M&A SharePoint extranets, regulated industry compliance dashboards, and ISV SPFx solutions shipped to tenant fan-out customer bases.

SharePoint Framework (SPFx) is the canonical TypeScript + React + Fluent UI extensibility surface for modern SharePoint Online, Microsoft Teams, and Viva Connections. Six component types — client-side web parts, application customizers, list view command sets, field customizers, form customizers, and Adaptive Card Extensions (ACEs). Six enterprise patterns — branded intranet, document workflow approver, mass-deployed enterprise visualization, M&A extranet, regulated industry compliance dashboard, ISV tenant fan-out solution. Build-once-show-everywhere for ACEs across Viva Connections, SharePoint dashboard, Teams, and increasingly Outlook through the Microsoft 365 Adaptive Card runtime. EPC Group ships the five-phase SPFx Modernization Accelerator covering classic-to-modern inventory, SPFx architecture and ALM design, TypeScript + React build, governance hardening, and managed operate under fixed fee $120K to $500K.

Key Facts

Six SPFx component types — web parts, application customizers, command sets, field customizers, form customizers, and Adaptive Card Extensions (ACEs)
TypeScript + React + Microsoft Fluent UI toolchain — same stack as modern Microsoft 365 client surfaces
Delegated Microsoft Graph integration through SPFx HttpClient and AadHttpClient under signed-in user identity
ACEs target Viva Connections dashboard, SharePoint dashboard, Microsoft Teams, and increasingly Outlook through the Microsoft 365 Adaptive Card runtime
SharePoint App Catalog deployment with tenant, hub, and site-collection scope options and semantic version control
Card Designer pairs with developer SPFx ACEs — low-code authoring for lightweight cards alongside heavy developer-built cards
Classic SharePoint farm solutions (2013, 2016, 2019, Subscription Edition) require re-platform to SPFx for SharePoint Online migration
Microsoft Solutions Partner founded in 1997, 6,500+ SharePoint deployments, 11,000+ Microsoft engagements

The model

Client-side extensibility on the Microsoft 365 substrate — TypeScript, React, Fluent UI

SharePoint Framework (SPFx) is the Microsoft-supported, future-aligned extensibility model for modern SharePoint Online, Microsoft Teams personal app surfaces backed by SharePoint, and Viva Connections dashboards. It replaces the classic SharePoint server extensibility stack — farm solutions, sandboxed solutions, JSLink, client-side rendering, SharePoint Designer customizations, InfoPath forms, and the legacy SharePoint Add-in model — with a single TypeScript + React + Microsoft Fluent UI authoring contract that produces packages deployed through the SharePoint App Catalog.

SPFx components run client-side under the signed-in user identity, call Microsoft Graph through delegated tokens, render to the same Fluent UI design system that modern SharePoint, Microsoft Teams, and Viva Connections use, and respect the section, column, theme, accessibility, and reduced-motion contract that the SharePoint modern surface enforces. The same component bundle ships to multiple Microsoft 365 client surfaces — a single SPFx web part appears on SharePoint pages, in Microsoft Teams tabs, and in the Viva Connections desktop and mobile experience without source rewrite.

For information architects and SharePoint admins, the property pane authoring model keeps configuration in their hands without code edits. For SharePoint developers, the gulp build pipeline produces signed and versioned .sppkg artifacts that move through the App Catalog with semantic version control and one-click rollback. For governance teams, the Microsoft Graph permission scope catalog is explicit in the package manifest and gated by SharePoint admin consent — the architecture supports the security and compliance reviews that enterprise IT runs every quarter.

Six SPFx component types — web parts, extensions, ACEs

SharePoint Framework spans six distinct component types. Each type targets a specific surface inside modern SharePoint or Viva Connections, ships through the same SharePoint App Catalog topology, and shares the same TypeScript + React + Fluent UI authoring stack. Most enterprise SPFx engagements ship two to four component types from a single solution package.

Client-side web parts — the canonical SPFx surface

What it does: Client-side web parts are the canonical SharePoint Framework surface — TypeScript and React components that render inside modern SharePoint pages, Microsoft Teams tabs, and the Viva Connections desktop and mobile app. A web part is what a SharePoint information architect drops onto a communication site landing page to expose a custom KPI, a curated news feed, a branded hero, or a Microsoft Graph-backed business data view. SPFx web parts run inside the user browser under the signed-in user identity, call Microsoft Graph through the SPFx HttpClient with delegated permissions, render to the same Microsoft Fluent design system that modern SharePoint and Teams use, and respect the SharePoint section, column, and theme system so that information architects style them without code edits. The same web part bundle runs in SharePoint, in a Teams tab, and in Viva Connections desktop and mobile with no source rewrite.

TypeScript + React + Microsoft Fluent UI — same toolchain as modern Microsoft 365 surfaces
Run inside SharePoint modern pages, Teams tabs, and Viva Connections desktop and mobile
Delegated Microsoft Graph permissions via the SPFx HttpClient and AadHttpClient
Property pane authoring — information architects configure the web part without code edits
Respect SharePoint section, column, theme, and accessibility contract automatically

Application customizers — global page header + footer extensions

What it does: Application customizers are SPFx extensions that attach to every modern SharePoint page, every Teams personal app surface that hosts a SharePoint page, and every Viva Connections page at the global header or footer placeholders. They are the enterprise pattern for branded site banners that surface compliance reminders, an enterprise-wide announcement strip, a SOC 2 or HIPAA classification badge, a regulatory disclosure footer, or a SharePoint hub-wide cookie consent banner. Application customizers deploy once at tenant scope or hub scope and apply to every site within the scope without per-site configuration — the right pattern for governance teams that need a tenant-wide presence on every page.

Tenant-scoped or hub-scoped deployment — global page-level presence
Top placeholder for branded banner, compliance ribbon, or announcement strip
Bottom placeholder for regulatory disclosure footer or cookie consent
Survives template changes, site rename, and content updates
Centrally managed by the SharePoint admin without site-owner intervention

List view command sets — toolbar + context-menu actions on lists and libraries

What it does: List view command sets are SPFx extensions that add custom toolbar buttons and context-menu items to modern SharePoint lists and document libraries. They are the enterprise pattern for triggering a Power Automate flow on selected items, opening a custom Microsoft Graph-backed approval modal, exporting selected rows to an external system, applying a custom retention label, or launching a record-management workflow scoped to the highlighted records. Command sets respect the user identity, evaluate permissions before showing the command, and integrate with Microsoft Graph for downstream actions — far more durable than the old SharePoint Designer custom action model.

Toolbar + context-menu items on modern lists and document libraries
Identity-aware — permission evaluation before showing the command
Trigger Power Automate flows, Microsoft Graph calls, or custom modal experiences
Replace SharePoint Designer custom actions with a governed deployment model
Per-list, per-content-type, or per-library scoping through property bag

Field customizers — list column rendering extensions

What it does: Field customizers are SPFx extensions that override the rendering of a specific list column inside modern SharePoint lists and libraries. They are the pattern for rendering a custom progress bar inside a project status column, a colored compliance badge inside a record-classification column, a custom thumbnail preview inside a document-type column, or an inline approval-state visualization inside a workflow column. Field customizers are the modern replacement for SharePoint client-side rendering (CSR) and the SPFx pattern that enterprises adopt for visually rich column experiences that the standard Microsoft Lists rendering does not provide.

Custom rendering of a specific column inside modern lists and libraries
Progress bars, status badges, thumbnails, inline visualizations
Modern replacement for client-side rendering (CSR) and JSLink
Per-column deployment — does not affect other columns or lists
Identity-aware and theme-aware — respects user theme and accessibility settings

Form customizers — replace list new + edit + display forms

What it does: Form customizers are SPFx extensions that replace the default Microsoft Lists new, edit, and display forms with a fully custom React form for a specific content type. They are the enterprise pattern for wizard-style data capture, multi-step approval intake, branded form chrome that matches a customer-facing intranet, validation logic that calls external systems before allowing save, and field interactions that go beyond what Microsoft Lists native form designer supports. Form customizers cover the gap between simple Lists forms and a full Power Apps canvas app — they are TypeScript and React, run inside SharePoint, and stay aligned to the SharePoint information architecture without spinning up Dataverse.

Replace default new, edit, and display forms with custom React form
Per content type — different content types get different form experiences
Wizard-style intake, multi-step approval, branded chrome, external validation
Stays inside SharePoint list IA — no Dataverse spin-up required
Survives Microsoft Lists native form designer changes

Adaptive Card Extensions (ACEs) — Viva Connections cards built once, shown everywhere

What it does: Adaptive Card Extensions (ACEs) are the SPFx surface that targets the Viva Connections dashboard, the SharePoint dashboard web part, and increasingly Microsoft Teams and Outlook through the unified Microsoft 365 Adaptive Card runtime. An ACE is a small, interactive card that surfaces a single piece of business data or a single action — the user benefits balance, the next-up training assignment, the open expense report awaiting approval, the safety incident report quick action, the daily production-line OEE score, the open service ticket count. ACEs come in card-size and quick-view interaction modes, render the Microsoft Adaptive Cards JSON schema, and increasingly act as the canonical "card" surface across Microsoft 365 — the build-once-show-everywhere pattern.

Target Viva Connections dashboard, SharePoint dashboard web part, Teams, and Outlook
Card-size + quick-view interaction model with Adaptive Cards JSON rendering
Single-purpose cards — one KPI, one action, one alert per card
Build once in SPFx — surface across multiple Microsoft 365 client surfaces
Card Designer in SharePoint admin for low-code authoring without SPFx build

Six enterprise SPFx + Viva Connections patterns

EPC Group has shipped SPFx and Adaptive Card Extension patterns across regulated industries, M&A advisors, mass-deployed global intranets, and ISVs publishing SharePoint-native products into tenant fan-out customer bases. Each pattern below maps to a distinct combination of the six SPFx component types and a distinct Microsoft Graph data layer.

Pattern 1 — Custom enterprise intranet with branded news center + global header

The most common SPFx engagement EPC Group ships is a custom enterprise intranet that goes beyond what the Microsoft SharePoint Look Book and stock communication-site templates deliver. The pattern combines an application customizer at tenant scope that renders the branded global header and footer with corporate color palette, logo, executive announcement strip, and emergency notification ribbon; a set of client-side web parts for the corporate news center (curated editorial feed, video hero, executive spotlight, regional newsroom rotation); ACEs on the Viva Connections dashboard for personalized KPIs (HR balances, training due, paycheck stub, expense status); and field customizers on the corporate news library to render publish state, editor approval status, and content-life-cycle metadata. The deliverable is a SharePoint hub-anchored intranet that feels custom-built but rides the modern SharePoint substrate for governance, mobile responsiveness, and Copilot grounding inheritance. Cross-link to /sharepoint-modern-intranet-design-best-practices-2026 for the broader intranet pattern.

Pattern 2 — Document workflow approver with field + form customizers

The document workflow approver pattern combines a form customizer that replaces the new + edit forms on a document approval library with a wizard-style React intake, a list view command set that lets approvers trigger an inline approval modal from the toolbar, and a field customizer that renders the approval state as a colored badge in the library view. The Power Automate engine handles the actual workflow; the SPFx surface handles the user experience — branded, role-aware, identity-aware, and integrated with Microsoft Graph for delegated approver authentication. Enterprises adopt this pattern when the stock Microsoft Lists forms cannot represent the full intake schema, when the approval requires conditional fields based on document type or value, or when the approver experience needs to call external systems (legal entity directory, vendor master, project portfolio) before recording the decision.

Pattern 3 — Mass-deployed enterprise data visualization web part

The mass-deployed data visualization pattern is a single SPFx web part that ships to every regional or business-unit SharePoint hub site and renders a Power BI-backed or Microsoft Graph-backed visualization with per-site configuration through the property pane. The information architect drops the web part onto the hub home page; the property pane lets them pick the regional data slice (region code, business unit, cost center) and the visualization type (revenue trend, headcount, project pipeline, safety incidents). The web part deploys once through the SharePoint App Catalog at tenant scope and shows up in the property pane of every modern page across thousands of sites — the canonical scale pattern for global enterprises that want a single visualization surface curated by a central analytics team and adopted by hundreds of regional information architects. Cross-link to /microsoft-graph-api-enterprise-2026 for the Graph backbone behind the data layer.

Pattern 4 — M&A SharePoint extranet for due diligence + integration

The M&A SharePoint extranet pattern combines a custom-branded application customizer that renders the M&A deal name and deal-team chrome on every page, ACEs on the deal-team Viva Connections dashboard for daily diligence KPIs (documents remaining, open redactions, financial reconciliation status, integration milestone), a form customizer on the integration task library for structured task intake with cross-entity validation, and a list view command set that allows the integration team to trigger Power Automate flows for entity consolidation, GL mapping, and HR system migration. The extranet rides on a SharePoint communication site secured to the deal team and approved external counsel; the SPFx surface gives the workspace a custom feel that respects the confidentiality and sensitivity of the engagement. EPC Group has shipped this pattern across the M&A advisor segment for both private-equity portfolio integration and corporate strategic acquisition use cases.

Pattern 5 — Regulated industry compliance dashboard with ACEs + customizers

The regulated industry compliance dashboard pattern targets healthcare, financial services, life sciences, government contractor, and energy operators — segments where a Viva Connections dashboard with role-aware compliance cards is a meaningful productivity surface. The SPFx surface combines ACEs for daily compliance KPIs (open audit findings, training-due count, policy attestation outstanding, incident open-by-severity, hazard-disclosure required), an application customizer that renders the regulatory classification badge on every page (HIPAA PHI scope, SOC 2 boundary, CMMC level, FedRAMP-aligned scope), and a list view command set that lets compliance officers attach a regulatory tag or trigger an evidence-gathering flow from any list. EPC Group has shipped this pattern across HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP regulatory profiles, integrating the SPFx surface with Microsoft Purview, Microsoft Defender, and Compliance Manager scoring.

Pattern 6 — ISV SPFx solution shipped to a tenant fan-out customer base

The ISV SPFx solution pattern is for software vendors selling a SharePoint-native product into a portfolio of customer Microsoft 365 tenants — the customer installs the SPFx package from the SharePoint App Catalog, the package deploys web parts, extensions, and ACEs across the customer tenant, and the ISV ships product updates through the standard SharePoint Framework versioning model. ISVs use this pattern for vertical-specific intranets (manufacturing safety, healthcare clinical communication, K-12 school district communication, municipal government), regulated industry dashboards, and Viva Connections enrichment products. The ISV builds against the SPFx contract, ships through the Microsoft commercial marketplace or direct app-catalog upload, and avoids the Microsoft Entra app gallery consent flow that other Microsoft 365 ISV patterns require. The package is delegated-permission only and runs under the signed-in user identity inside the customer tenant.

Viva Connections + ACE runtime

Viva Connections, Card Designer, and ACEs — build-once-show-everywhere

Viva Connections is the Microsoft 365 employee-experience home — a SharePoint-anchored destination delivered through Microsoft Teams (desktop and mobile) and the SharePoint mobile app, featuring a dashboard of Adaptive Card Extensions. Viva Connections has become the canonical way enterprises surface daily-relevance cards to every employee without a custom mobile app, a separate intranet app, or a per-region front door.

The Viva Connections dashboard is composed of ACEs — Adaptive Card Extensions that render under the Microsoft Adaptive Cards JSON schema. The Microsoft 365 unified card runtime means the same ACE can target the Viva Connections desktop and mobile dashboard, the SharePoint dashboard web part on a communication site landing page, the Microsoft Teams personal dashboard, and increasingly the Microsoft Outlook reading pane. The developer authors the card once in SPFx + TypeScript + React, declares the target surfaces in the package manifest, and the Microsoft 365 runtime renders the card on each surface with the appropriate chrome and interaction model.

SharePoint Card Designer is the low-code authoring surface inside the SharePoint admin center that lets a SharePoint admin or Viva Connections owner compose simple cards without SPFx build pipelines. Card Designer covers the lightweight cards — single-action quick links, branded announcement cards, simple URL launchers, RSS-style content feeds. Developer-built SPFx ACEs cover the heavy cards — Microsoft Graph-backed KPIs, multi-step quick-view interactions, identity-aware conditional content, and custom React rendering with Fluent UI design tokens. The EPC Group pattern pairs the two cleanly so the SharePoint admin team and the central SPFx team share the Viva Connections dashboard backlog without contention.

Viva Connections desktop + mobile

The dashboard renders in Microsoft Teams (desktop and mobile) and the SharePoint mobile app — the canonical Microsoft 365 employee-experience home surface.

SharePoint dashboard web part

The same ACE catalog surfaces inside a SharePoint communication site landing page via the SharePoint dashboard web part — no rebuild required.

Outlook + Teams unified runtime

Microsoft 365 is consolidating to a unified Adaptive Card runtime — ACE coverage expands into Outlook and Teams personal dashboards across 2026 releases.

Design system alignment

Modern SharePoint design system + Adaptive Card Extensions v2

SPFx components inherit the modern SharePoint design system — Microsoft Fluent UI as the React component library, the SharePoint theme JSON for brand color and typography tokens, the modern section and column layout grid, and the SharePoint accessibility contract for keyboard, screen reader, color contrast, and reduced-motion behavior. Developers do not roll their own design system; they consume the Fluent UI components and the SharePoint theming pipeline.

Adaptive Card Extensions v2 — the current ACE evolution — adds richer quick-view interactions, multi-step card flows, deeper Microsoft Graph integration patterns, improved support for the Outlook and Teams surfaces, and tighter alignment to the Microsoft 365 unified card runtime. ACE v2 also improves the developer experience for building cards that respond to user identity, organizational role, and tenant context — the building blocks for the regulated industry compliance dashboards and personalized employee-experience surfaces enterprises ship in 2026.

EPC Group designs the SPFx component portfolio against the customer brand system, maps the Fluent UI design tokens to the customer color and typography contract, and ships the ACE v2 patterns that align to Viva Connections, SharePoint dashboard, and the Microsoft 365 unified card runtime. Cross-link to the SharePoint usage and collaboration guide for the broader user-experience strategy.

Classic-to-modern

Migration from classic SharePoint farm solutions to SPFx

Enterprises moving from SharePoint Server 2013, 2016, 2019, or SharePoint Subscription Edition to SharePoint Online face a re-platform exercise for every classic customization. Classic full-trust farm solutions, sandboxed solutions, and on-premises SharePoint Add-ins do not run on SharePoint Online. The migration path is well-known and EPC Group has shipped it across hundreds of enterprise engagements, but it requires disciplined inventory and component-by-component mapping.

Classic visual web parts → SPFx client-side web parts

Classic .NET visual web parts re-platform to SPFx TypeScript + React client-side web parts. The business logic moves to either client-side TypeScript or an Azure Function called by the SPFx surface; the rendering surface becomes Fluent UI.

SharePoint Designer + InfoPath → Power Automate + form customizers

SharePoint Designer workflows re-platform to Power Automate cloud flows; InfoPath forms re-platform to SPFx form customizers, Microsoft Lists, or Power Apps depending on complexity. EPC Group maps each artifact in Phase 1.

JSLink + client-side rendering → field customizers

JSLink and client-side rendering customizations on classic list views re-platform to SPFx field customizers, which provide a governed deployment model and a stable Microsoft-supported surface.

Event receivers + timer jobs → Azure Functions + Graph webhooks

Classic event receivers and timer jobs re-platform to Azure Functions triggered by Microsoft Graph subscriptions, webhooks, and SharePoint change feeds — a fully serverless replacement for the on-premises back-end customization model.

Cross-link to EPC Group SharePoint consulting services for the senior-architect-led re-platform engagement model.

The EPC Group five-phase SPFx Modernization Accelerator

Fixed-fee delivery in 10 to 18 weeks per workstream, anchored on the The EPC Group Lifecycle. The engagement covers Assess (classic inventory + Viva opportunity map), Design (SPFx solution architecture + ALM model + App Catalog topology), Build (TypeScript + React + Fluent UI implementation + Card Designer pairing), Governance Harden (security and accessibility attestation + permission scope minimization), and Operate (managed SPFx with quarterly upgrade and Microsoft Graph change monitoring). Pricing ranges $120K to $500K depending on component-type count, the number of Microsoft Graph integrations, the complexity of the ACE portfolio, and the scope of the classic-to-modern re-platform.

Phase 1 — Assess

Inventory classic customizations, Viva opportunity, target SPFx surfaces

Phase one inventories the customer existing SharePoint customization stack — classic web parts (SharePoint farm solutions, sandboxed solutions, add-ins), legacy InfoPath forms, SharePoint Designer workflows, SharePoint 2013 or 2016 or 2019 farm solutions still running on-premises or in hybrid, JSLink + client-side rendering customizations, and any third-party SharePoint products with classic dependencies. In parallel, the team maps the Viva Connections opportunity surface (dashboard ACEs that would replace today's email blasts and intranet announcements), the modern intranet brand requirements (application customizer scope), and the Microsoft Graph data integrations that will back the new SPFx web parts. The deliverable is a classic-to-modern inventory matrix, a Viva opportunity scorecard, a target SPFx surface design, and a costed roadmap against the The EPC Group Lifecycle Assess stage.

Classic SharePoint customization inventory — web parts, workflows, farm solutions, InfoPath
Viva Connections opportunity map — dashboard ACE candidates by audience
Modern intranet brand and global chrome requirements via application customizer
Microsoft Graph data layer design for the SPFx web part portfolio

Phase 2 — Design

SPFx solution architecture, ALM model, tenant + hub + site scope

Phase two designs the SPFx solution architecture across the six component types (web parts, application customizers, command sets, field customizers, form customizers, ACEs), the application lifecycle management (ALM) model that governs the dev, test, and production environments, the SharePoint App Catalog topology (tenant App Catalog, site-collection App Catalogs, hub App Catalog), and the package scoping decisions (tenant-scoped versus site-collection-scoped, opt-in versus auto-deploy). The team also designs the Microsoft Graph permission scopes the package will request, the property pane authoring experience for information architects, the Card Designer surface for low-code Viva Connections card authoring, and the Microsoft Teams + Outlook surface alignment for the ACE portfolio.

SPFx solution architecture spanning the six component types with module boundaries
ALM model — gulp build, bundle, package, app catalog deploy, version management
App Catalog topology — tenant, hub, and site-collection scope decisions
Microsoft Graph permission scope catalog with admin consent requirements

Phase 3 — Build

TypeScript + React + Fluent UI implementation, ACE Card Designer pairing

Phase three is the build — TypeScript + React + Microsoft Fluent UI implementation of the SPFx web parts, application customizers, command sets, field customizers, form customizers, and ACEs designed in Phase 2. The build pattern pairs developer-authored SPFx ACEs (the heavy-logic, data-rich cards) with Card Designer-authored low-code cards (the lightweight branding + simple-action cards) so the central SPFx team and the SharePoint admin team share the Viva Connections dashboard backlog efficiently. Microsoft Graph integration follows the EPC Group rate-limit, retry, and error-budget patterns; the Fluent UI design tokens align to the customer brand system through the SharePoint theme JSON; and the build emits accessibility evidence (WCAG 2.1 AA conformance, screen-reader transcripts) for the SharePoint admin and compliance review.

TypeScript + React + Microsoft Fluent UI implementation across the six component types
Developer SPFx ACEs paired with Card Designer low-code cards for division of labor
Microsoft Graph integration with rate-limit, retry, and error-budget instrumentation
Accessibility evidence package — WCAG 2.1 AA conformance + screen-reader transcripts

Phase 4 — Governance harden

ALM hardening, App Catalog discipline, security + accessibility sign-off

Phase four hardens the SPFx delivery for production. ALM is locked down — the build pipeline runs in Azure DevOps or GitHub Actions, packages are signed and versioned semantically, the App Catalog topology is governed by a SharePoint admin with documented release process, and the rollback model is rehearsed against a representative production-class tenant. Security review covers Microsoft Graph permission scope minimization, content security policy alignment, third-party JavaScript dependency audit, and the SPFx isolated web part model for high-trust scenarios. Accessibility review verifies WCAG 2.1 AA conformance across keyboard, screen reader, color contrast, and reduced-motion contracts. The deliverable is a signed-off security and accessibility attestation package against the customer compliance baseline.

ALM pipeline lockdown — Azure DevOps or GitHub Actions with semantic versioning
Microsoft Graph permission scope minimization and admin consent documentation
Content security policy + isolated web part model for high-trust scenarios
WCAG 2.1 AA accessibility attestation across keyboard, screen reader, contrast

Phase 5 — Operate

Managed SPFx with quarterly upgrade + Microsoft Graph change monitoring

Phase five is steady-state operation. EPC Group provides managed SPFx services — quarterly SharePoint Framework version upgrades as Microsoft ships new SPFx versions, Microsoft Graph API change monitoring against the package permission scope catalog, Viva Connections dashboard authoring support for the SharePoint admin team, Card Designer governance for the low-code card portfolio, and senior-architect escalation for SPFx production incidents. Annual capability roadmap review as Microsoft extends ACEs into Outlook, Teams, and the Microsoft 365 unified surface. The retainer scales from a single-architect quarterly cadence for small customizations to a multi-engineer monthly cadence for large-scale custom intranet portfolios.

Quarterly SPFx version upgrade against the Microsoft release cadence
Microsoft Graph API change monitoring against the package permission scope catalog
Card Designer governance + Viva Connections dashboard authoring support
Annual capability roadmap aligned to ACE expansion across Microsoft 365 surfaces

Why enterprises choose EPC Group for SharePoint Framework + SPFx

Senior-architect-led delivery from a 1997-founded Microsoft Solutions Partner with 6,500+ SharePoint deployments, three Microsoft Press SharePoint titles authored by founder Errin O’Connor, and a Fortune 500 portfolio of branded intranet, Viva Connections, and SPFx modernization engagements.

6,500+

SharePoint deployments

11,000+

Microsoft engagements

70+

Fortune 500 clients

1997

Founded · Microsoft consulting

Microsoft Solutions Partner — six designations

Modern Work, Data & AI (Azure), Digital & App Innovation, Infrastructure, Security, and Business Applications — the full Microsoft stack coverage required for SPFx delivery anchored on Microsoft Graph, Microsoft Fluent UI, and SharePoint modern.

Senior-architect-led SPFx delivery

Every SPFx engagement is led by a senior Microsoft architect — no junior staff on SPFx solution architecture, ACE portfolio design, or Microsoft Graph permission scope work. The architects who design your SPFx surface ship the production deployment.

Microsoft Press SharePoint authorship

Founder Errin O’Connor is a four-time Microsoft Press & Sams author with three SharePoint titles, and brings nearly three decades of Microsoft consulting leadership to every SPFx engagement — including the original SharePoint client-side extensibility architecture work that informed the SPFx model.

Governance + accessibility expertise

EPC Group ships SPFx packages with WCAG 2.1 AA accessibility attestation, Microsoft Graph permission scope minimization documentation, and security review evidence aligned to HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP compliance profiles. Cross-link to Microsoft 365 consulting for the broader engagement model.

Frequently asked questions — SharePoint Framework (SPFx) + ACEs

When should an enterprise build with SPFx versus Power Pages, Power Apps, or low-code SharePoint?

SPFx is the right surface for any custom SharePoint or Viva Connections experience that needs full TypeScript + React power, deep Microsoft Graph integration, deep Microsoft Fluent UI control, or component reuse across SharePoint pages, Teams tabs, and Viva Connections dashboards. Power Pages is the right surface for external-facing customer or partner portals where the audience is not part of the customer Microsoft 365 tenant. Power Apps is the right surface for tenant-internal business apps where the data lives in Dataverse and the audience is end-user employees rather than information architects. Low-code SharePoint (Lists, Pages, native web parts, Power Automate) is the right surface for departmental productivity scenarios that do not require custom code. EPC Group sizes the surface choice in Phase 1 against the customer audience, data layer, brand requirements, and lifecycle horizon. Cross-link to /microsoft-cloud-orchestrator for the broader Microsoft platform delivery method.

How do classic SharePoint farm solutions (full-trust code) migrate to SPFx + modern extensibility?

Classic SharePoint full-trust farm solutions running on SharePoint Server 2013, 2016, 2019, or Subscription Edition on-premises do not run on SharePoint Online — they must be re-platformed. The migration path inventories the classic surface (visual web parts, application pages, event receivers, timer jobs, custom workflows, SharePoint Designer artifacts, InfoPath forms), maps each classic surface to the modern equivalent (SPFx web part, SPFx extension, Power Automate flow, Azure Function for back-end logic, form customizer for InfoPath replacement), and ships the modern surface in parallel to the on-premises stack so the SharePoint Online migration can complete without forcing functional regression. EPC Group has shipped this re-platform pattern across more than four hundred SharePoint engagements. Cross-link to /sharepoint-migration-consulting-enterprise-services-2026 for the broader migration program model.

What is the difference between an SPFx ACE and a classic SharePoint web part?

A classic SharePoint web part is a server-side .NET control rendered inside SharePoint Server full-page chrome — relevant only for SharePoint Server on-premises and irrelevant for SharePoint Online and Viva Connections. An SPFx ACE (Adaptive Card Extension) is a client-side TypeScript + React component that targets the Viva Connections dashboard, the SharePoint dashboard web part, and increasingly Microsoft Teams and Outlook through the Microsoft 365 Adaptive Card runtime. ACEs are single-purpose cards (one KPI, one action) versus SPFx client-side web parts which are richer multi-purpose layouts on a SharePoint page. Both render through the SPFx framework; the difference is the consumption surface — ACE goes to the Viva Connections + dashboard + cross-Microsoft 365 card surfaces, web parts go to the SharePoint page + Teams tab surface.

How does the SPFx application lifecycle management (ALM) model work across dev, test, and production?

The SPFx ALM model uses three tiers — developer workstations running gulp serve against the SharePoint workbench, a tenant-level test App Catalog deployed into a non-production SharePoint Online tenant or a dedicated SharePoint hub for integration testing, and the production tenant App Catalog or hub App Catalog for production rollout. Packages are signed, semantically versioned, and built through Azure DevOps or GitHub Actions CI/CD pipelines that produce the .sppkg artifact. Rollback is supported through SharePoint App Catalog version history — the SharePoint admin can revert to the prior package version in seconds. EPC Group has documented this ALM model as part of the Phase 4 governance hardening deliverable across our SharePoint engagement portfolio. Cross-link to /services/sharepoint-consulting for senior-architect SPFx delivery.

How does build-once-show-everywhere work for ACEs across Viva Connections, Outlook, and Microsoft Teams?

Adaptive Card Extensions render through the Microsoft Adaptive Cards JSON schema, which Microsoft 365 standardized as the cross-surface card runtime. An ACE built in SPFx surfaces natively in the Viva Connections desktop and mobile dashboard, the SharePoint dashboard web part, the Microsoft Teams personal dashboard, and increasingly the Microsoft Outlook reading pane and the Microsoft 365 unified card runtime. The developer authors the card once in SPFx + TypeScript + React; the runtime renders the card on each surface with the appropriate chrome and interaction model. This pattern means enterprise IT can ship a single ACE for "expense report waiting on you" or "training due this week" or "open compliance findings" and have it surface across every modern Microsoft 365 client the employee uses. EPC Group designs the ACE portfolio in Phase 2 with explicit cross-surface targeting.

What is the SharePoint Card Designer and where does it fit alongside developer-built SPFx ACEs?

SharePoint Card Designer is a low-code authoring surface inside the SharePoint admin center that lets a SharePoint admin or a Viva Connections owner compose simple Adaptive Card Extensions without an SPFx build pipeline. Card Designer is right for lightweight cards — single-action quick links, branded announcement cards, simple URL launchers, RSS-style content feeds — that do not need complex Microsoft Graph integration or stateful interaction. Developer-built SPFx ACEs cover the heavy scenarios — Microsoft Graph-backed dynamic KPIs, multi-step quick-view interactions, custom React rendering with Fluent UI design tokens, and identity-aware conditional content. The EPC Group SPFx Modernization Accelerator pairs the two — SharePoint admins author the lightweight cards in Card Designer, the central SPFx team ships the heavy cards through the build pipeline, and the Viva Connections dashboard authoring backlog gets split efficiently across the two roles.

How does SPFx integrate with Microsoft Graph and what are the permission scope considerations?

SPFx integrates with Microsoft Graph through two HttpClient implementations — the SPFx HttpClient (for any REST API including SharePoint REST) and the AadHttpClient (for Microsoft Graph and Microsoft Entra-protected APIs). The package declares the Microsoft Graph permission scopes it needs in its manifest, the SharePoint admin approves the scopes through the SharePoint admin center API Access page, and Microsoft Entra issues delegated tokens to the SPFx surface at runtime under the signed-in user identity. Permission scope minimization is part of the Phase 4 governance hardening — every package requests only the scopes it actually needs, every scope is justified in the deployment documentation, and the SharePoint admin retains the ability to revoke approval. Cross-link to /microsoft-graph-api-enterprise-2026 for the deeper Graph integration pattern.

Does SPFx work with Microsoft 365 Copilot, and can SPFx web parts be Copilot-grounded?

SPFx web parts that render content from SharePoint lists, libraries, and pages benefit from Microsoft 365 Copilot grounding automatically — the underlying SharePoint content is indexed by Microsoft Search and surfaced to Copilot through the standard grounding pipeline. SPFx web parts that render content from external systems through Microsoft Graph connectors can also be Copilot-grounded by publishing the underlying connector to the Microsoft Search index. ACEs increasingly act as the launch surface for Copilot interactions — the employee taps the ACE quick view, opens a focused Copilot Chat scoped to the card data, and gets generative responses grounded in the underlying SharePoint or Microsoft Graph content. EPC Group designs the Copilot grounding strategy alongside the SPFx surface in Phase 2 of the Accelerator.

Related EPC Group enterprise guides

Modernize your SharePoint customizations on SPFx — fixed fee, senior-architect-led

Book an SPFx modernization briefing with a senior EPC Group architect. Two-week classic-to-modern inventory, costed five-phase roadmap, ACE portfolio design, Viva Connections opportunity map, and ALM topology — all delivered against the The EPC Group Lifecycle.

Book an SPFx modernization briefing Call 888-381-9725

AI assistant — not human