As I understand there can be a "User+App" and "App" only policy permissions in SharePoint apps. The SharePoint hosted app cannot use the App-only policy. So here is the doubt I have. Suppose I have a SharePoint hosted app which has modify permissions on a list in the HOST web. The app adds new items/modifies items in the list. Now a user accessing the APP has READ permission on the list in host web. In this case both, the app and user identities will be sent during the add/modify operation.

So does this mean that the app wont be able to add/modify list items because the user has READ only permissions on the list ?

Also, can we say that the APP-only policy is something which can be used as Elevating privilages to perform operations that a user cannot perform ?


Yes, the user won't be able to add/modify items in the host web. The App+User policy takes lower of the two.

Besides that you are also right in saying that App Only Policy can be used to elevate privileges.

For more details check this link.

  • Great, thanks for your respone. Now in a scenario where I want to build an APP part that reads some list items on a criteria and shows it on home page of a Portal. The lists can only be updated by a set of Content authors (contd.) – Vipul Kelkar Aug 13 '14 at 11:04
  • , however the data should be shown to all the users. Here, an approach can be to setup the list in host web and build an app to read (customized look and feel needed). By this, the content authors will be able to navigate to the list easily. If I keep the list in APP web, all the users having permissions to the app would be able to modify the list (if only a user could figure out how to navigate to list in app web). – Vipul Kelkar Aug 13 '14 at 11:05
  • Agree or app web is also a normal web. You can break the permission on the list and give proper access to users. But that means lots of JSOM code or manual configuration – Garima Aug 13 '14 at 11:54

As far is I know, the individual users' permission to a list in the host web get overridden when it is accessed through the app. Then it uses app permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.