We are just starting to use SharePoint via 365. We found an app that we like, that asks for the following permissions:

  • Let it access basic information about this site.
  • Let it access basic information about the users of this site.

Basic info about site and users could mean a lot of data actually. This is for a private site, not public, if that makes a difference.

I did some google searching and strangely enough did not find a listing of what types of info they would get from us. Seemed strange that MS did not provide something a bit more descriptive with an example.

  • In one of Pluralsight videos by Sahil Malik, he mentions that the basic information about the users is property like email id of the user. But he doesn't say anything about basic information of site. Jan 24 '15 at 3:10

I'm basing my answer on this TechNet Article: https://technet.microsoft.com/en-us/library/jj219576(v=office.15).aspx

Effectively, a Read-Only permission request is the same as giving the App the following set of permissions:

  • View Items
  • Open Items
  • View Versions
  • Create Alerts
  • Use Self-Service Site Creation
  • View Pages

Meaning an app, acting along with a user will have that sub set of permissions a user has (since apps receive an intersection of the permissions it has with the permissions a user has)

The basic user information doesn't seem to be listed there. But we do have the User List which has some information regarding the user and since it's a list and the App does have permission to read lists... It can probably get to the following fields (translated from Portuguese so I might have gotten the actual name wrong):

  • Account
  • Name
  • Email
  • Cellphone
  • About me
  • Image
  • Department
  • Job
  • SIP Address

User Profile information is probably not accessed since the user profile has its own set of permissions.

Mind you, this is speculative.



All those details are maintained in appmanifest file. Please find following fields from appmanifest.

Required app manifest fields


Optional app manifest fieldsactivities

Chrome,csp,datastores-owned,datastores-access,fullscreen,installs_allowed_from,locales,messages,orientation,origin,permissions, precompile,redirects,role,version.

You can find more details in the following links : https://msdn.microsoft.com/en-us/library/office/jj583325(v=office.15).aspx

  • I appreciate the link and the info. The challenge here is that I am installing an app, not writing the app. I want to figure out what those two statements mean when it comes to installing a third party app in my tenancy at office 365. In most cases, where general statements are used for permissions (android, ios, etc) there would be an explanation of the 'type' of information exposed to the third party developer when accepting those permissions. Hope this helps.
    – david
    Jan 23 '15 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.