I've built a SharePoint 2013 app that requests permissions on the fly via OAuth. The scope being requested is Web.Write. I've been able to authorize this app as a SharePoint user part of the Team Site Owners group since that group gives the user Full Control. However, I receive an access_denied error code in the redirect if I'm a "normal" user part of Team Site Members.

I gradually added increasing levels of permissions for the user and it appears that in addition to the Edit permission granted to the user by virtue of being in Team Site Members, the user also requires "Manage Permissions", "Create Subsites" and "Manage Web Site", which doesn't make much sense to me. Even the scope List.Read requires this level of permissions to complete the OAuth flow.

Is there a workaround possible that allows normal SharePoint users to grant access to data they can edit without having to get their admin involved?

For example, here is a screenshot of the page when requesting Web.Write scope and the 'Create Subsites' permission isn't provided to the user:

SP 2013 OAuth

(The actual domain has been replaced with "example.com")

1 Answer 1


A user must have the Manage Web site and Create Subsites permissions to add an app for SharePoint. By default, these permissions are available only to users who have the Full Control permission level or who are in the site Owners group.


This (I believe) is because the installation of an App implies in the creation of an APP Web - a Subsite of where the app is being installed.

Also, as stated by the documentation, a user cannot grant a permission he does not have.

An app for SharePoint requests the permissions that it needs during installation from the user who is installing it. The developer of an app must request, through the app manifest file, the permissions that the particular app needs to be able to run. (Device and web apps that access SharePoint, but are not installed to SharePoint websites must be granted permissions at runtime by the user who is executing the app. For more information, see Get an overview of apps that request access permission from SharePoint on the fly.) Users can grant only the permissions that they have. The user must grant all the permissions that an app requests or not grant any permission. Selective grants are not possible. (For apps that request permissions on the fly, only a user with Manage permissions to the SharePoint resources that the app seeks to access can run the app, even if the app is asking only for lesser permissions, such as Read.)


Apparently, asking for Read permissions implies asking for:

  • View Items
  • Open Items
  • View Versions
  • Create Alerts
  • Use Self-Service Site Creation
  • View Pages

while asking for Write permissions implies asking for the read-only permissions as well as:

  • Add Items
  • Edit Items
  • Delete Items
  • Delete Versions
  • Browse Directories
  • Edit Personal User Information
  • Manage Personal Views
  • Add/Remove Personal Web Parts
  • Update Personal Web Parts


To answer the question, you can work around adding the users as owners if you give the Manage web and Create Subsite permissions, but that might be granting more permissions then desired to the users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.