I was searching for detailed description about permission scopes and the operations I can perform using them. However, I only found this information:
- Read – Enables apps to view pages, list items, and download documents.
- Write – Enables apps to view, add, update, and delete items in existing lists and document libraries.
- Manage – Enables apps to view, add, update, delete, approve, and customize items or pages within a web site.
- Full Control – Enables apps to have full control within the specified scope.
But it does not tell which permission scope is the lowest needed for e.g.:
- creating a site (from tenant-admin site)
- applying a template to a site
- creating a group
- adding a person to a group
- creating a site column
- creating a content type
I only found this information dated early 2014 from a user who states that for creating a subsite FullControl permissions are needed but I can only guess that it also applies to all of the aforementioned operations. Have someone experimented with other operations and can guarantee that all of these operations require FullControl permissions?