Modern SharePoint development does not mean building every component from scratch. In this episode of the M365 FM Podcast, Mirko Peters talks with Microsoft MVP Siddharth Vaghasia about building production-ready SharePoint Framework (SPFx) solutions by combining the right Microsoft 365 technologies with reusable community components.Siddharth brings nearly 18 years of experience across the Microsoft technology stack, from .NET and the early days of SharePoint Server to SharePoint Online, Microsoft 365, Power Platform, Azure, and modern SPFx development.
WHEN SHOULD YOU ACTUALLY USE SPFx?
Not every SharePoint requirement needs custom development. Siddharth explains a simple principle: first determine whether Microsoft already provides the functionality. If the requirement can reasonably be solved with standard SharePoint capabilities, avoid unnecessary customization.SPFx becomes valuable when organizations need experiences, integrations, or interfaces that cannot be delivered effectively with out-of-the-box functionality.
SPFx VS POWER PLATFORM
Should you build the solution with SPFx or Power Apps?The discussion explores where each approach fits. Power Apps can be effective for relatively straightforward forms, conditional fields, business rules, and scenarios where citizen development and low-code maintainability matter.SPFx becomes particularly powerful when developers need greater control over the user interface, complex data handling, reusable components, APIs, or sophisticated application experiences directly inside SharePoint. Siddharth also argues that generative AI coding tools are changing the traditional assumption that pro-code development necessarily takes longer than low-code development.
THE MODERN SPFx TECHNOLOGY STACK
A modern SPFx project brings together several technologies rather than relying on one framework.Siddharth breaks down the roles of TypeScript, React, Fluent UI, PnPjs, and PnP React Controls. TypeScript provides stronger typing and compile-time checks, while Fluent UI helps custom solutions retain the familiar Microsoft user experience.PnPjs simplifies interaction with SharePoint, Microsoft Graph, and other Microsoft 365 services by replacing repetitive REST request code with reusable abstractions.
STOP REBUILDING CONTROLS THAT ALREADY EXIST
One of the central lessons of the episode is simple: professional development does not mean writing everything yourself.PnP React Controls provide SharePoint-aware and Microsoft 365-aware components for common development requirements. Instead of repeatedly creating the UI, API calls, data binding, and associated logic for components such as file pickers, developers can use established community controls.Siddharth's preferred approach is to check existing capabilities first: use Microsoft functionality when available, then Fluent UI or PnP React Controls where they satisfy the requirement, and create a custom component only when the required functionality does not already exist.
THE FIVE PnP REACT CONTROLS DEVELOPERS SHOULD KNOW
If Siddharth had to choose only five controls, his selection would be People Picker, Taxonomy Picker, List View, File Picker, and Live Persona.These components cover several recurring requirements in enterprise SharePoint applications, including selecting users, working with managed metadata, presenting SharePoint data, selecting or uploading files, and displaying Microsoft 365 user information.
BUILDING REAL APPLICATIONS INSIDE SHAREPOINT
The conversation moves from individual controls to application architecture with the example of a sophisticated project management solution.SharePoint lists can provide the underlying data layer for projects, customers, resources, and tasks, while SPFx can deliver a unified application experience containing dashboards, project views, charts, CRUD operations, role-specific interfaces, task management, and navigation.The result can feel much more like a dedicated business application while remaining embedded inside the SharePoint environment users already know.
SHAREPOINT DOESN'T HAVE TO BE YOUR DATABASE
SPFx applications are not restricted to SharePoint data.Siddharth discusses retrieving information from Dataverse and integrating external systems. When data resides in systems such as Azure SQL, a backend API can provide the secure middle layer between the client-side SPFx application and the database.He also describes a real example where an SPFx web part surfaces Power Automate approvals directly inside SharePoint and allows users to approve or reject requests without moving to another application.
MICROSOFT GRAPH AND SPFx
Microsoft Graph expands SPFx far beyond SharePoint itself.Applications can interact with Microsoft 365 services including OneDrive, Planner, Outlook, meetings, and other resources exposed through Graph. Siddharth explains when SharePoint REST APIs remain appropriate and when Graph becomes the better or necessary option.
SECURITY, PERMISSIONS AND LEAST PRIVILEGE
Security is a major part of professional SPFx development.SPFx solutions calling Microsoft Graph typically operate using delegated permissions and therefore respect the identity and access rights of the currently signed-in user. Requested API permissions also require administrative approval.One of the most common mistakes Siddharth sees is requesting more permissions than the application actually requires. His recommendation is to start with the minimum permissions necessary rather than granting broad access by default.Developers also need to test solutions from the perspective of real users instead of assuming that permissions available during development will also exist in production.
NEVER PUT SECRETS IN CLIENT-SIDE SPFx CODE
Because SPFx executes client-side, sensitive secrets should never be embedded directly into the application code.For scenarios requiring secrets or credentials, Siddharth recommends introducing a backend API that can securely access services such as Azure Key Vault while the SPFx frontend communicates only with that API.
SECURITY REVIEW DOESN'T END WITH YOUR OWN CODE
SPFx relies heavily on the modern JavaScript and npm ecosystem. Organizations therefore need to consider the security and maintenance status of third-party packages as well as their own application logic.Siddharth recommends reviewing dependencies, paying attention to package warnings and vulnerabilities, and including security assessment as part of the deployment process rather than assuming every dependency is safe simply because it is available through npm.
WHY IS YOUR SPFx SOLUTION SO SLOW?
When an SPFx application performs badly, Siddharth starts with the browser's network tools.Developers should examine how many API calls occur during page load, identify unnecessary requests, look for API calls accidentally executed inside loops, and inspect React components for excessive rendering or state changes.A seemingly simple application can generate dozens of requests when data retrieval is implemented inefficiently.
BATCH YOUR REQUESTS
Once unnecessary API traffic has been identified, batching can significantly improve how requests are handled.Instead of sending multiple individual operations from the client, developers can combine appropriate SharePoint operations into batch requests and reduce client-side request overhead.
FROM DEVELOPMENT TO THE SHAREPOINT APP CATALOG
Siddharth also walks through the SPFx deployment process, from packaging the solution into an .sppkg package to deploying it through the SharePoint App Catalog and approving required API permissions.Importantly, deploying a package does not automatically mean installing it everywhere. Organizations can control which SharePoint sites receive the application, and site collection App Catalogs can provide an even narrower deployment scope.
SPFx MEETS COPILOT AND AI AGENTS
SPFx is also moving into the agent era.Siddharth discusses SharePoint Copilot apps and how SPFx can provide interactive user-interface components inside Microsoft 365 Copilot experiences. Instead of returning only text or Markdown, an agent can potentially surface richer interfaces that users can interact with directly.He describes the concept as similar to taking the idea behind Adaptive Cards much further by enabling richer, more customizable application experiences.
THE BIG TAKEAWAY
The strongest SharePoint developers are not necessarily the developers who write the most code.They know when to use SharePoint out of the box, when Power Platform is sufficient, when SPFx provides the necessary flexibility, when Microsoft Graph is required, and when existing Fluent UI and PnP components can eliminate unnecessary development.The goal is not to reinvent another component. It is to combine the Microsoft 365 ecosystem into solutions that are secure, maintainable, performant, accessible, and capable of solving an actual business problem.
ABOUT SIDDHARTH VAGHASIA
Siddharth Vaghasia is a Microsoft MVP, consultant, founder, speaker, blogger, and community contributor specializing in Microsoft 365, SharePoint, Power Platform, Azure, and related technologies. He also discusses his company Binary Roots and its work with customers across multiple international markets.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-copilot-ai-modern-work--6704921/support.
