Which permissions does my SharePoint Add-in need to get Site Collections?

Question

I am building a Provider-Hosted SharePoint Add-in. Given a SharePoint Online tenant (account) where my add-in is installed, I want to get a list of their Site Collections

To get this done I am making a CSOM call that uses an add-in-only policy like so:

var tenantAdminUri = new Uri("https://<tenant_name>-admin.sharepoint.com/");

var realm = TokenHelper.GetRealmFromTargetUrl(tenantAdminUri);

var token = TokenHelper.GetAppOnlyAccessToken(
    TokenHelper.SharePointPrincipal,
    tenantAdminUri.Authority, 
    realm)
    .AccessToken;

using (var clientContext = TokenHelper.GetClientContextWithAccessToken(targetUrl, token))
{
    var tenant = new Tenant(clientContext);

    var siteProperties = tenant.GetSiteProperties(0, true);

    clientContext.Load(siteProperties);

    clientContext.ExecuteQuery();
}

When I run this code an exception is thrown by the call to ExecuteQuery(). The error message is:

"Access denied. You do not have permission to perform this action or access this resource."

Which permission do I need to specify in my SharePoint Add-in's AppManifest.xml file to be able to get this working?

---

PS - In the Add-in's AppManifest.xml I've set the permission to "Tenant, Read" like so:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Read" />
</AppPermissionRequests>

Now I'm getting an exception that says:

Current user is not a tenant admin.

Googling this sentence yields no results (!)

---

PPS - The Add-in has been installed into SharePoint Online tenant by a user with Site Administrator privileges.

Answer 1

The user who is installing the app that has tenant level permissions should be tenant administrator.

Answer 2

Turns out the code works if I set my Add-in to ask for "Tenant, Modify" permissions like so:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Manage" />
</AppPermissionRequests>

Credit goes to the kind people over at the "SharePoint 2013 - Development and Programming" forum over at the Office Dev Center.