SharePoint app detailed permission level descriptions

Question

I was searching for detailed description about permission scopes and the operations I can perform using them. However, I only found this information:

• Read – Enables apps to view pages, list items, and download documents.
• Write – Enables apps to view, add, update, and delete items in existing lists and document libraries.
• Manage – Enables apps to view, add, update, delete, approve, and customize items or pages within a web site.
• Full Control – Enables apps to have full control within the specified scope.

But it does not tell which permission scope is the lowest needed for e.g.:

• creating a site (from tenant-admin site)
• applying a template to a site
• creating a group
• adding a person to a group
• creating a site column
• creating a content type

I only found this information dated early 2014 from a user who states that for creating a subsite FullControl permissions are needed but I can only guess that it also applies to all of the aforementioned operations. Have someone experimented with other operations and can guarantee that all of these operations require FullControl permissions?

Answer 1

For creating a site from tenant admin site, creating a group and adding a person to a group, it needs Full Control permission.

For applying a template to a site, creating a site column and creating a content type, it needs at least Manage permission.